Chapter 7 — Security Tools

The Security menu is the largest single menu in AidaIDE — eleven feature tabs for vulnerability hunting, dependency hygiene, certificate management, threat intelligence, and compliance. This chapter walks each one.

Tab inventory

Security Scanner

Open from Security → Security Scanner.

The general-purpose vulnerability sweep. Aim it at a host or a CIDR:

1. Enter target (host, IP, or CIDR).
2. Tick scan modules: Ports, CVEs (cross-references service banners against CVE database), Weak SSH ciphers, TLS misconfigurations.
3. Click Scan.

Results land in a tabbed report. Severity bands: Critical / High / Medium / Low / Info. Click any finding for context plus a suggested remediation.

Export Report… writes HTML, PDF, or JSON. The HTML report HTML-escapes every user-supplied field (host name, banner text) — this was a real XSS trap historically.

CVE Scanner

Open from Security → CVE Scanner.

Targets a single Linux host (the focused connection tab, or one you pick). Reads dpkg -l / rpm -qa / pip freeze / npm ls and matches against the NVD CVE feed (auto-updated daily).

Findings include the CVE ID, base CVSS score, affected package + installed version + fixed version. One-click "Apply fix" runs the appropriate apt upgrade <pkg> or equivalent — counts as a WRITE operation and prompts for confirmation.

Dependency Scanner

Open from Security → Dependency Scanner.

Different from CVE Scanner: this one scopes to a project, not a host. Reads requirements.txt, package.json, Cargo.toml, go.mod, pom.xml, etc. and checks each declared dependency against vulnerability databases (PyUp, npm Audit, RustSec, Snyk public feed).

Output includes vulnerable transitives, upgrade paths, and (when known) the minor/patch version that fixes the issue.

Secret Scanner

Open from Security → Secret Scanner.

Walks a project folder looking for things that look like leaked secrets — AWS keys, GitHub tokens, GCP service account files, SSH private keys, generic high-entropy strings.

Configurable confidence threshold. Right-click a finding to Mark False Positive — the finding hash is added to a personal allow-list so you do not see it again.

Tip: run this before pushing to GitHub. Once a secret is in your git history, even deleting the file does not remove it from past commits.

SAST Scanner

Open from Security → SAST Scanner.

Static Application Security Testing — analyses your source for vulnerability patterns without running it. Plugs into language-specific scanners:

• Python: bandit (+ semgrep rules).
• JavaScript/TypeScript: eslint-plugin-security, semgrep rules.
• Go: gosec.
• Java: spotbugs + find-sec-bugs.
• C/C++: cppcheck.

The relevant tool must be installed where AidaIDE can find it (locally, or in PATH on the host you are scanning). Settings → Security → SAST tells AidaIDE where each binary lives.

Findings are graded by severity and have remediation hints inline.

Threat Intel Feeds

Open from Security → Threat Intel Feeds.

Subscribes to public + (configurable) private feeds:

• Abuse.ch URLhaus / MalwareBazaar.
• AlienVault OTX (needs an API key).
• MISP — point at your org's instance.
• CISA Known Exploited Vulnerabilities.

Aggregated indicators (hashes, IPs, domains, URLs) flow into the IOC Database (next section).

IOC Database

Open from Security → IOC Database.

Searchable store of indicators of compromise. Filter by type (file hash / domain / IP / email / URL), by feed source, by date range. Manually add custom IOCs from incident reports.

Hooks into:

• Network Topology — if a node has an IP listed in the IOC database, the node turns red and the right-side panel calls it out.
• Packet Capture — packets sourcing from or destined to a flagged IP are highlighted.

PKI Manager

Open from Security → PKI Manager.

Run your own certificate authority for lab and internal use.

• Create a root CA — generates a 4096-bit RSA or P-384 EC key plus a self-signed cert. Stored in the vault.
• Create intermediates — sign sub-CAs off the root.
• Issue server certs — SANs, lifetime, key type all configurable.
• Revoke certs — adds to a CRL.
• Export trust bundle — for installing the root CA on client devices.

Anything you issue here is not trusted by browsers by default — it is your private CA. Install the root cert manually on the boxes that need to trust it.

Certificate Inventory

Open from Security → Certificate Inventory.

Catalogue of certs known to AidaIDE — those issued by your PKI plus any cert AidaIDE has seen in scans.

• Import — paste PEM/DER or point at a file. The CN, SANs, issuer, validity, fingerprint, and key info are extracted.
• Scan host:port — connects, grabs the cert, adds it to the inventory.
• Expiry alerts — set a per-cert reminder; the toolbar will warn 30 days out by default.
• Compare two certs — diff their subjects, SANs, key types.

Note: historically this tab has had bugs that fabricated CN values from filenames or computed fingerprints over raw file bytes instead of DER. If something looks off (CN that matches a filename rather than the subject; fingerprints that change every time you reimport the same file), reimport from a fresh source and report a bug.

IP Access Control

Open from Security → IP Access Control.

Maintains allow / deny lists. These lists can be:

• Exported as iptables / nftables / Windows Firewall rule sets.
• Pushed to fleet devices that use aida-lite's firewall plugin.
• Consulted at scan time (so Port Scanner can skip known-bad ranges).

You can import community blocklists (Spamhaus DROP, Firehol, etc.) on a schedule.

Compliance Assessment

Open from Security → Compliance Assessment.

Run pre-built compliance checklists against a host:

• CIS Linux Benchmark (Ubuntu, Debian, RHEL profiles).
• CIS Windows Benchmark.
• NIST 800-53 control families (selected).
• PCI-DSS host-level controls.

For each control, AidaIDE either probes via SSH commands or asks you to confirm manually. Output is a pass/fail dashboard plus an evidence trail you can export.

The compliance log is supposed to record every audit event with full audit-trail integrity. Historically some demo paths logged no-ops; expect every check to leave a row in the audit log when run for real.

Workflows

"I want to know if my Pi has any known vulnerabilities"

Security → CVE Scanner, target = your Pi's connection tab, Scan. Address Critical/High first.

"Did I commit an AWS key by accident?"

Security → Secret Scanner, target = your project folder. Mark false positives, fix the real ones, rotate the keys (do not just delete the file — the leak is in git history).

"I need an internal TLS cert for my lab"

1. Security → PKI Manager. Create a root CA (one time).
2. Issue Server Cert with the SAN matching your service hostname.
3. Install the resulting bundle on the server.
4. Install the root CA cert on each client that needs to trust the new cert.

"I need to prove our hosts meet CIS Level 1"

Security → Compliance Assessment → CIS Linux Benchmark → Level 1. Run against each host. Export the report.

Terms & Setup

CVE

Common Vulnerabilities and Exposures. A globally unique ID for a specific bug — e.g. CVE-2024-12345. The CVE feed is hosted by NIST; AidaIDE mirrors a recent copy and refreshes daily.

CVSS

Common Vulnerability Scoring System. A 0.0–10.0 score for severity. AidaIDE shows the base score in scan results.

IOC

Indicator of Compromise. A piece of evidence that something bad has happened — a malicious file hash, a phishing URL, a C2 IP. Useful for detection ("alert if we ever see this IP again") and triage ("is the file the user downloaded known-bad?").

CA, Root CA, Intermediate

A Certificate Authority signs certificates. The root CA is self-signed; intermediates are signed by the root and used to issue end-entity certs. Browsers ship with a list of public root CAs that they trust; private CAs (like the one PKI Manager creates) have to be installed manually on every device that needs to trust them.

SAST vs DAST

SAST = Static. Reads source code without running it. DAST = Dynamic. Hits a running app from the outside. AidaIDE includes SAST out of the box. DAST coverage is via Security Scanner (TLS/port checks) and external tools.

"I scanned myself and got no results"

• Scanners need either an SSH connection (for CVE Scanner / Compliance) or a project folder (for Dependency / Secret / SAST). If you launched them with no target, they bail silently.
• Some scanners need a binary on PATH (bandit, gosec, etc.) — see Settings → Security → SAST.

"Report says I have 47 vulnerabilities, but most are Low"

That is expected. A normal Linux install has dozens of Low-severity findings (informational, theoretical, or already mitigated upstream). Focus on Critical/High first. The report's Risk Score is a weighted total — driving that down is the goal.

"Certificate Inventory shows my cert's CN as something weird"

A historical bug in _import_cert derived the CN from the filename and computed the fingerprint over raw file bytes instead of the parsed DER. Reimport from a freshly downloaded PEM and verify against openssl x509 -in cert.pem -noout -subject -fingerprint -sha256. File a bug if it still misreports.

Where the audit log lives

~/.aidaide/audit.log. Append-only. Each compliance check, PKI issuance, OTA publish, and bulk fleet action writes a row with timestamp + actor + action + target. Treat it as evidence; do not edit it by hand.