Five levels
CRITICAL, HIGH, MEDIUM, LOW, and INFO. Trivy's UNKNOWN becomes INFO.
The scanners
Seven scanners, one API.
Aegis does not write its own detection rules. It runs seven open-source scanners and normalizes what they report. This is what each one looks at and how Aegis runs it.
What runs
The seven, at a glance
Every scanner runs over the same directory and returns JSON, which Aegis parses. Nothing trusts a scanner's process state.
| Scanner | Looks at | Reads | Time limit | Worth knowing |
|---|---|---|---|---|
| Semgrep | Source code in many languages | The scan directory, recursively | 5 minutes | Rules from Semgrep's registry by default; metrics off |
| Bandit | Python source for insecure patterns | The scan directory, recursively | 5 minutes | Aegis raises shell=True subprocess calls and eval() to CRITICAL |
| pip-audit | Python dependencies with known vulnerabilities | requirements.txt | 5 minutes | Remediation names the first fixed version when there is one |
| Safety | Python dependencies, against Safety's own database | requirements.txt | 2 minutes | A second opinion alongside pip-audit |
| detect-secrets | Hardcoded secrets and high-entropy strings | Every file in the directory | 5 minutes | The finding names the kind of secret, never the secret |
| Checkov | Infrastructure-as-code misconfiguration | The scan directory; Checkov detects the frameworks | 5 minutes | Terraform, CloudFormation, Kubernetes, and Dockerfiles, among others |
| Trivy | Known vulnerabilities in the filesystem | The scan directory (trivy fs) | 5 minutes | A pinned release binary; it scans a directory, not container images |
When one goes wrong
A broken scanner is a result, not a crash
Each scanner runs as its own subprocess under a time limit. A scanner that is not installed, exits with an error, returns output Aegis cannot parse, or runs out of time is recorded for that scan as failed or timed out, with how long it ran. The other scanners still run, and the scan still finishes.
A scanner that did not complete cannot say a problem is gone, so Aegis leaves that scanner's open findings open until a scan in which it does complete.
One severity scale
Each scanner's severity, on one scale
Mapping files
Each scanner has a mapping file. It can raise or lower a particular rule's severity and attach CWE tags the scanner leaves out.
Examples Aegis pins today
Bandit's shell=True subprocess and eval() rules are CRITICAL with CWE-78 and CWE-95, and Trivy's Log4Shell entry is raised from HIGH to CRITICAL.
Contact
Questions about this tool?
Write to Renkara Media Group and a person will answer.