Scanners Overview

The CBOM sensor includes 9 specialized scanners, each designed to discover cryptographic assets from different sources. Scanners can be combined in a single sensor configuration to provide comprehensive visibility across your environment.

Available Scanners

Scanner	What It Scans	Asset Types Produced	Auth Required
HTTPS Endpoint	TLS/HTTPS endpoints	certificate, public-key, protocol	No
File System	Certificate and key files on disk	certificate, private-key, public-key	No (filesystem access)
Java Keystore	JKS and PKCS#12 keystores	certificate, private-key, public-key, symmetric-key	Keystore password
SSH Keys	SSH key files	private-key, public-key	No (filesystem access)
Windows Certificate Store	Windows CryptoAPI stores	certificate, public-key	Local admin
Source Code	Source code repositories	algorithm, signature	No (filesystem access)
Binary	Compiled binaries (DLL, EXE, SO, JAR)	algorithm, signature, certificate	No (filesystem access)
AWS	ACM, KMS, IAM services	certificate, symmetric-key, public-key	AWS credentials or IAM role
Active Directory	ADCS, LDAP certificate attributes	certificate, public-key	AD/LDAP credentials

How Scanners Work

Each scanner follows the same lifecycle:

1. Configuration — Define targets (endpoints, paths, credentials) in the sensor YAML config
2. Discovery — Scanner connects to or reads from the target source
3. Extraction — Cryptographic assets are parsed and normalized
4. Deduplication — Assets are fingerprinted to avoid duplicates across scans
5. Reporting — Discovered assets are sent to the CBOM platform for inventory

Choosing Scanners

• Network-facing services → HTTPS Endpoint Scanner
• Servers and VMs → File System + Java Keystore + SSH Keys
• Windows environments → Windows Certificate Store + File System
• Cloud infrastructure → AWS Scanner
• Enterprise PKI → Active Directory Scanner
• Application security → Source Code + Binary Scanners

Scanner Configuration

All scanners are configured in the sensor’s config.yml file. Multiple scanners can run in a single sensor instance:

scanners:
  https-endpoint:
    - endpoints:
        - api.example.com:443
  filesystem:
    - paths:
        - /etc/ssl/certs
  java-keystore:
    - paths:
        - /opt/app/keystore.p12
      password: changeit

---

For sensor installation and setup, see the Sensor Setup Guide.