Infrastructure: hosts, VMs and Kubernetes nodes
The Infrastructure pillar (Attack Surfaces → Infrastructure) checks the machines your software runs on: OS packages with known vulnerabilities, host hardening, Kubernetes node settings and runtime alerts. It is unlocked with Cloud posture (Cloud & AI and above). Every tool is free and open source. DVSentry never asks for an SSH key, a password or a kubeconfig: an agent you install connects outbound and is the only path.
Start here (no cloud account needed)
The page opens with three cards:
- Scan a VM: installs the read-only host agent on a Linux VM.
- Scan a Kubernetes cluster (k3s included): installs the posture-only agent and the node-checks DaemonSet.
- Connect a cloud account: optional; adds the cloud's own package inventory (Cloud).
One-command install (Owner or Admin)
Choose Scan a VM or Scan a Kubernetes cluster, pick a name and environment, optionally tick Falco, and choose Generate. DVSentry gives you one line to paste on the machine:
export DVSENTRY_ENROLLMENT_TOKEN='...'; curl -fsSL https://app.dvsentry.com/downloads/dvsentry-agent-install.sh \
| sudo --preserve-env=DVSENTRY_ENROLLMENT_TOKEN sh -s -- --url https://app.dvsentry.com \
--organization <org id> --environment staging --kind auto --label web-1 --name web-1 \
--key <evidence-signing public key> --bundle-sha256 <sha256 of the agent files>; \
unset DVSENTRY_ENROLLMENT_TOKEN- The enrollment token is single use and valid 10 minutes; it never appears as a process argument.
- The script detects Kubernetes or a VM. On a VM it installs a read-only host agent that runs as user
dvsentry-posturewith no root and no sudo rule; on Kubernetes the posture-only manifests. Downloads are checked against the SHA-256 values in the command, so a changed file is refused. - The page shows live progress (command generated, token used, first heartbeat, inventory) and, once the agent is connected, Run first scan.
If the Kubernetes agent is not available yet, the Kubernetes card says "Not configured".
What is checked
| Check | Source | Notes |
|---|---|---|
Host posture (DVS-OS-001 to DVS-OS-075) | The VM agent reads typed facts (SSH settings, sysctl, services, file permissions...) | DVSentry's own rule wording, never CIS text. An Admin queues the scan; it is metered like a cloud scan |
| Host packages | The VM agent's package list, or the cloud's inventory (AWS SSM Inventory, Google OS Config, Azure Update Manager) after an Admin opts the cloud account in | Matched offline against vulnerability data |
Kubernetes node checks (DVS-K8S-N...) | A DaemonSet (non-root, read-only mounts, no service-account token, deny-all network policy) logs typed kubelet and node settings; the agent reads the pod logs | Added to the Kubernetes posture snapshot |
| Kubernetes posture | The agent lists resources with a read-only ClusterRole (never Secrets or ConfigMaps) | RBAC escalation paths, workloads, NetworkPolicy, admission; CIS section 5 |
| Runtime alerts (Falco) | Optional Falco on the VM (JSON file) or in the cluster (pod logs) | Only rule, priority, 5-minute bucket, workload names and image digest are sent; display only; one notification per agent, rule and day |
| Kubernetes cost | The agent sums node capacity and pod requests | Shown in Burnwatch |
Commands to the agent are Ed25519-signed and bound to that agent and machine; the agent refuses anything not pinned in its own trust file.
Data sources
The public page /data-sources lists every vulnerability feed and tool, their licences and the NVD notice.
Not built
The optional root tier (OpenSCAP with SCAP Security Guide content) is a design only.
Something missing or unclear? Tell us with Feedback in the app.