The Vigil Subsystem: Local Threat Detection

Traditional vulnerability scanners often require communication with third-party cloud APIs to scan files. This approach transmits metadata or file hashes outside the local infrastructure, which can introduce latency and data privacy considerations.

StateWarden's Vigil Active Defense Engine is a local threat detection system designed to operate entirely within a private network, providing threat triage without relying on external APIs during scans.

1. Local Scanning Architecture

Relying on external APIs for threat intelligence presents several challenges:

• Rate Limiting: Cloud providers may rate-limit API lookups, causing delays when scanning large filesystems.
• Data Privacy: Transmitting hashes of proprietary software or internal configurations to a third party can conflict with organizational security policies and GDPR compliance.
• Latency: Network round-trip times for API queries increase the total duration of a security scan.

2. The Architecture of Vigil

Vigil addresses these issues by mirroring global threat intelligence into a local, optimized environment.

The Aggregator (Control Plane)

The StateWarden Control Plane downloads and parses databases from standard threat feeds:

1. OSV (Open Source Vulnerabilities): Vulnerability data for software packages (dpkg, rpm, pip, npm).
2. NVD (National Vulnerability Database): The U.S. government repository of standard vulnerability data (CVEs).
3. MalwareBazaar: A database of known malicious file hashes (SHA256).

StateWarden ingests this JSON data, deduplicates it, and stores it in a PostgreSQL database within the local Control Plane.

The Bloom Filter (Memory Structure)

To optimize search speed during a live scan, Vigil uses Bloom Filters—a probabilistic data structure.

Upon startup, the Vigil service loads malware signatures from the database into a memory-resident Bloom Filter. This allows Vigil to check for malicious hashes with low latency without executing disk reads.

The Scanner (The Agent)

When Artemis schedules a SECURITY_SCAN task, the StateWarden Agent executes the following steps:

1. Inventory Collection: The Agent catalogs installed packages (e.g., via dpkg or the Windows Registry) and calculates the SHA256 hashes of executable files.
2. Local Transmission: The Agent sends this "Inventory JSON" directly to the local Artemis Control Plane over mTLS.
3. Triage: Vigil processes the payload by checking hashes against the Bloom Filter and matching package versions against the CVE database.

The entire process occurs within the private network without external data transmission.

3. Reporting and Management

Vigil is integrated into the StateWarden Dashboard. Findings are populated in the Vigil Triage view.

• Risk Scoring: Findings are mapped to their CVSS (Common Vulnerability Scoring System) severity levels (0.0 to 10.0).
• Device Context: The dashboard displays the specific physical or virtual devices associated with each finding.
• Suppression Management: Administrators can suppress specific findings (e.g., false positives). The Vigil engine will ignore suppressed findings in future scans.

4. Remediation Tracking

Vigil updates its status based on system changes.

When a vulnerable package is patched on a server, the StateWarden Agent catalogs the updated package version during its next scan. Vigil registers the update, verifies that the CVE is resolved, and automatically updates the status in the Dashboard.