Trajectory of an external finding.
Hand Katar an external IP and it surveys the trail live — firewalls, NAT, load-balancer pools — to the exact process and identity it reaches. Then it does the part a network scanner cannot: reports what is actually installed at the end of that path. Surveyed the way your NOC already draws it: VLANs, physical firewalls, bare-metal racks.
- Walk forwardExternal IP → NAT → load balancer → backend pool → process → identity → data reachable.
- Walk backwardPick any internal asset; surface every external path that reaches it.
- Choke pointsWhich one fix removes the most paths — surfaced in a single query.
- Installed → running → reachable → scoredThe package is on the host, running as a listening service, on a path something external reaches — and the risk score already accounts for all three.
Exploded view. Five collectors, one mechanism.
EDR, FIM, vulnerability scanner, DLP, and CSAM collector — five overlapping kernel hooks, five pipelines, five failure modes, five line items, multiplied across the fleet. Katar's single hyper-lightweight agent (eBPF on Linux, ETW on Windows) captures the same signal once. Two consequences, and the second is the one nobody talks about: you cannot walk a path across five disconnected collectors, and an agentless tool cannot make this argument at all — it has no agent to consolidate into.
Every asset finds itself. Every finding earns its priority.
Enroll one binary and Katar fingerprints the host, its packages, its listening services, its identities — no manual CMDB entry. Findings are scored by a declarative risk engine, not raw CVSS: exploit likelihood, exposure, and the blast radius from the same graph Plate II just walked. Provenance, in the catalog sense and the audit sense, are the same record here.
- Zero-touch enrollmentOne binary fingerprints packages, services, and identities on install.
- Risk, not just severityEPSS and environmental exposure feed a configurable scoring policy.
- Deduplicated across feedsOS packages, language deps, and known-vuln databases reconciled into one finding.
{
host(hostname: "app-server-04") {
packages(severity: [CRITICAL, HIGH]) {
cve
epssScore
exploitPriority
}
reachableFrom { externalIp }
}
}The catalogue grows. The entry format doesn't.
Every signal Katar collects — inventory, events, vulnerabilities, identities, reachability — lands in one GraphQL surface. Query exactly the fields you need, scoped to a key, audited per request. Ten hosts or ten thousand: the schema doesn't change shape, only the graph beneath it grows.