Contents

• Getting Vardion
• Licence
• Install
• First steps
• Publish the console
• The hosted console
• How scanning works
• Connect your tools
• Software inventory
• API
• Command line
• Backup and updates
• Support

Getting Vardion

Ask on the demo form. For the hosted console we open a workspace and invite its owner. For your own server we deliver the release as source with its Docker files. Unpack it into a folder on the server, the Vardion folder below.

Licence

Vardion is used under the licence or service agreement each customer signs. The open-source tools in the image, with their versions and licences, are listed on the console's licences page under Diagnostics. All carry permissive licences, and none is GPL or AGPL.

Install

An empty server has its first results in under 10 minutes. From the Vardion folder, create the settings file from its example and start the console:

cp .env.example .env
docker compose up -d --build

The console is bound to 127.0.0.1:8080 only. On a server, reach it through an SSH tunnel:

ssh -L 8080:127.0.0.1:8080 user@your-server

Open http://127.0.0.1:8080 and finish first-run setup, which creates the owner account.

First steps

1. Scope: declare your domains.
2. Scope > Domain verification: publish the record it shows and press Verify now. It approves no address.
3. Scans: run discovery, or the express run, which approves the addresses that show no sign of shared infrastructure and leaves the rest for you.
4. Scope > Approvals: approve the addresses that are yours.
5. Scans: run the internet-facing scan, then read Findings and the fix plan.
6. Compliance > Which rules apply: classify the organisation, then apply a package under Programme.

The Getting started page in the account menu takes each part in order. For 3 months of sample data, press Create the demo under Manage workspaces in the workspace menu.

Publish the console

To reach the console over the internet with HTTPS, point a hostname at the server and start it with the bundled Caddy configuration, which fetches the certificate:

VARDION_DOMAIN=console.yourcompany.com docker compose -f docker-compose.yml -f docker-compose.public.yml up -d --build

Scanning stays on when you publish. Check that your hosting provider allows it, and set VARDION_SCAN_DISABLED=1 to turn it off. Until the first account exists, only a health check is served. Make the owner account inside the container:

docker compose exec vardion node src/cli.ts user add <name> --role owner

Two-step verification, password rules and single sign-on are set under Admin.

The hosted console

It runs your security programme from day one, with email and DNS checks and imported scan results. It keeps active scanning switched off and ranks your Tenable, Qualys or Defender findings with a fix plan. Vardion's own port and vulnerability scans need your own server.

First steps on the hosted console

1. Compliance > Which rules apply: classify the organisation, then apply a package under Programme.
2. Compliance > Assessments: start a maturity assessment or one from Greece's National Cybersecurity Authority (ΕΑΚ), and give each section to whoever answers it.
3. Scope: declare your domains. Discovery and the email and DNS checks run without scanning.
4. Findings > Imported: import a scanner's file or connect Tenable, Qualys or Microsoft Defender. Its findings join the ranked list.

How scanning works

• Discovery finds the names under your domains and the addresses they resolve to. Each new address waits in Approvals until you decide it.
• The default depth is the high-risk service ports. A full scan can also cover the 100 or 1,000 most common ports or every port, and the console states the time each one takes on your estate.
• An internal network is checked only when you declare its range, with a gentler profile and its own score.

Scan profile

Connect your tools

• Alerts: Slack, Microsoft Teams or any webhook, under Settings > Notifications.
• Tickets: Jira Cloud or GitHub issues opened from a finding or by a rule. Status and assignee sync back, and a finding closes only when a scan confirms the fix.
• SIEM: new, returning and fixed findings after each run, as JSON lines, Splunk HEC, CEF or Wazuh events, per workspace. Findings also export as STIX 2.1 for OpenCTI and MISP.
• Cloud and identity: AWS, Azure, Google Cloud, Cloudflare, Microsoft 365 and Google Workspace, read with read-only credentials.
• Repositories: JavaScript and Python dependencies in GitHub or GitLab, read with a read-only token, under Assets > Repositories.
• Scanners you already run: Tenable, Qualys and Microsoft Defender accounts and Nessus, OpenVAS, Burp or CSV files, under Findings > Imported.
• Sign-in: OpenID Connect and SCIM 2.0.

Software inventory

Agents for Linux, Docker and Windows report each host's operating system and packages once a day, with an enrolment token from Settings > Enrolment tokens and the inventory listener open to your hosts (docker-compose.ingest.yml, with TLS). Packages are matched against OSV and NVD.

API

A REST API answers at /api/v1 with a bearer token made under Settings > API. The OpenAPI document describes it.

curl -H "Authorization: Bearer $TOKEN" https://console.yourcompany.com/api/v1/findings

Writes run the console's own forms, with the token's scope.

Webhooks

Under Settings > Webhooks a workspace posts events to an https address, each signed as X-Vardion-Signature: t=SECONDS,v1=HEX: HMAC-SHA256 of the seconds, a full stop and the body. The platform owner turns writes and webhooks on under Admin > Scanning policy.

Command line

Every command runs inside the container and acts on one workspace, the first unless --workspace <id> names another.

docker compose exec vardion node src/cli.ts run-now --dry-run

Backup and updates

State lives in config/ and data/ in the Vardion folder and in Docker volumes. Run each command in the Vardion folder on the server.

Support

Write to support@getvardion.com. The support page says when we answer.