Ctadel concepts

This page describes the model every page of the application shares: resources linked in a graph, one list of findings, attack paths, projects, and the scan that refreshes all of it.

The model on one page

Notion	What it is	Where it appears
Resource	An object read from a cloud account, a cluster or a Git repository: instance, volume, bucket, database, role, cluster, function.	"Inventory", "Explorer"
Relationship	A link between two resources: contains, uses, has access to, is exposed by.	"Explorer"
Finding	A rule that applies to a resource, with a severity, a status and a fix.	"Findings" and its sub-pages
Attack path	A sequence of resources and relationships that, taken together, form a toxic combination.	"Toxic Combinations"
Project	The scope a resource belongs to: a cloud project, account or subscription.	"All Projects" selector
Scan	A full cycle of reading and evaluation, started by hand or on a schedule.	"Scan running" in the header

Resources and the graph

Each collector reads one cloud through its API and Ctadel writes what it finds into a graph. Every resource becomes a typed node (instance, volume, bucket, database, Kubernetes cluster, role, encryption key, and so on), and every link between two resources becomes a relationship. A Project node stands for the cloud project, account or subscription the resource belongs to; every resource carries its project identifier.

There is one graph for the whole instance: the six clouds, the Kubernetes clusters and the Git repositories write into it side by side. This is what makes it possible to link an AWS role to a bucket, or a Kubernetes workload to the image it runs. The Security graph page describes what it holds.

Findings

A finding is born when a rule applies to a resource. Each scanner (CSPM, including the AI-SPM rules; DSPM; KSPM; HCR; vulnerabilities; secrets; IaC; toxic combinations) produces its findings with the same essential information: the resource, the rule, the severity, the status, the first and last time it was seen, and the project.

The "Findings" page gathers them into a single list whatever their module, and the sub-pages ("Vulnerabilities", "Secrets", "Data Security", "CSPM", "HCR", "KSPM", "AI-SPM", "IaC") show one family at a time.

A finding carries one of the following statuses.

Status	Who sets it
OPEN	The scan, when the finding is first seen.
RESOLVED	The scan, when the resource no longer triggers the rule; or you, by hand.
IGNORED	You, with a reason and an optional expiry date; the finding reopens when it passes.
ACCEPTED	You, for an accepted risk.
INVESTIGATING	Incidents from audit-log detection (internal validation).
FIXED	Vulnerabilities whose package has been updated.

Every status change is dated and attributed to its author, which is what lets the dashboard history be rebuilt. The Severity and score page explains the severity scale and the scores.

Attack paths

A toxic combination is a rule that does not apply to a single resource but to a path in the graph: for example an instance exposed to the Internet, carrying a role, whose role has access to a bucket holding sensitive data. Taken one by one, these links are not necessarily findings; together they form an exploitable path. The Attack paths page describes how they are evaluated and scored.

Projects and folders

A project is the smallest unit of scope. The "All Projects" selector in the header restricts every page to one project, or to a folder, that is a group of cloud accounts and Git repositories you define. A user can be limited to certain projects or folders by their role: they then see only the resources and findings of that scope. The Projects and folders page covers this in detail.

The scan

A scan is a full cycle. It runs in four phases, shown in the application header.

1. Inventory: every connected cloud account is read again by its collector; the header shows "inventory 2/4" while accounts remain to be synced.
2. Evaluating rules: the configuration rules are evaluated against the refreshed graph.
3. "Dispatching workers": the content analyses of disks, buckets, databases, clusters and hosts start.
4. Done: the cycle is closed; findings from the content analyses keep arriving for a few minutes.

Only one scan runs at a time: starting a scan while another is running returns "A scan is already running." When automatic scheduling is enabled in the settings, a scan starts as soon as the chosen interval (24 hours by default) has elapsed since the last one.

The scan also does two quiet things: it reopens findings whose temporary ignore has expired, and it resolves findings whose resource no longer triggers the rule.

Read on

• Security graph: what the graph holds and how to explore it.
• Attack paths: how a chain is evaluated, scored and broken.
• Severity and score: the severity scale, the risk score and the dashboard score.
• Agentless: how Ctadel reads without installing anything, and what that rules out.
• Projects and folders: the scope of users and views.
• Frameworks: the compliance references each rule carries.