The Vigil Subsystem: Local Threat Detection

Traditional vulnerability scanners often require communication with third-party cloud APIs to scan files. This approach transmits metadata or file hashes outside the local infrastructure, which can introduce latency and data privacy considerations.

StateWarden's Vigil Active Defense Engine is a local threat detection system designed to operate entirely within a private network, providing threat triage without relying on external APIs during scans.

1. Local Scanning Architecture

Relying on external APIs for threat intelligence presents several challenges:

• Rate Limiting: Cloud providers may rate-limit API lookups, causing delays when scanning large filesystems.
• Data Privacy: Transmitting hashes of proprietary software or internal configurations to a third party can conflict with organizational security policies and GDPR compliance.
• Latency: Network round-trip times for API queries increase the total duration of a security scan.

2. The Architecture of Vigil

Vigil addresses these issues by mirroring global threat intelligence into a local, optimized environment.

The Aggregator (Control Plane)

The StateWarden Control Plane downloads and parses databases from standard threat feeds:

1. OSV (Open Source Vulnerabilities): Vulnerability data for software packages (dpkg, rpm, pip, npm).
2. NVD (National Vulnerability Database): The U.S. government repository of standard vulnerability data (CVEs).
3. MalwareBazaar: A database of known malicious file hashes (SHA256).

StateWarden ingests this JSON data, deduplicates it, and stores it in a PostgreSQL database within the local Control Plane.

The Bloom Filter (Memory Structure)

To optimize search speed during a live scan, Vigil uses Bloom Filters - a probabilistic data structure.

Upon startup, the Vigil service loads malware signatures from the database into a memory-resident Bloom Filter. This allows Vigil to check for malicious hashes with low latency without executing disk reads.

The Scanner (The Agent)

When Artemis schedules a scan task, the StateWarden Agent executes the following steps:

1. Inventory Collection: The Agent catalogs installed packages (e.g., via dpkg or the Windows Registry) and calculates the SHA256 hashes of executable files.
2. Local Transmission: The Agent sends this "Inventory JSON" directly to the local Artemis Control Plane over mTLS.
3. Triage: Vigil processes the payload by checking hashes against the Bloom Filter and matching package versions against the CVE database.

The entire process occurs within the private network without external data transmission.

3. Reporting and Management

Vigil is integrated into the StateWarden Dashboard through two pages: Threat Landscape and Vulnerability Triage.

Threat Landscape (/security-dashboard)

The Threat Landscape page provides a fleet-wide view of the current security posture:

• Fleet KPIs: Aggregate metrics such as active threats, severity distribution, and scan volume over a selectable time range.
• Threat Charts: Time-series charts of vulnerability and malware detections, engine throughput, and remediation velocity.
• Flight Recorder Log: A 30-day history of scan activity and alert status per day.
• Priority Devices: Devices ranked by current risk score, with direct navigation to their findings.
• Report Generation: On-demand PDF security reports covering the entire Realm or a single selected device.

Vulnerability Triage (/triage)

The Vulnerability Triage page is the decision-support interface for individual findings:

• Tabs: Findings are organized into ACTIVE, RESOLVED / IGNORED, and SUPPRESSION RULES tabs.
• Risk Scoring: Findings are mapped to their CVSS (Common Vulnerability Scoring System) severity levels (0.0 to 10.0).
• Device Context: Findings can be displayed as a flat list or grouped by device, showing the specific physical or virtual devices associated with each finding.
• Bulk Triage: Administrators can apply triage decisions to multiple selected findings at once and export the findings list as CSV.
• Suppression Management: Administrators can suppress specific findings (e.g., false positives) by creating suppression rules, each requiring a recorded justification. The Vigil engine ignores suppressed findings in future scans. Applying triage decisions and creating suppression rules requires the vigil.triage_risks permission.

Devices that have never been scanned are displayed with a neutral "NO DATA" risk state instead of a severity score.

4. Remediation Tracking

Vigil updates its status based on system changes.

When a vulnerable package is patched on a server, the StateWarden Agent catalogs the updated package version during its next scan. Vigil registers the update, verifies that the CVE is resolved, and automatically updates the status in the Dashboard.