samaritan // resources
Everything published so far.
Documentation, methodology, sample output, and community links: organized by what they are, honest about what's built and what's still coming.
#documentation
Documentation
Full reference for the Samaritan REST API: authentication, scan endpoints, asset query, incident retrieval, and webhook configuration.
How external surface discovery works: DNS enumeration via zone walks and CT logs, ASN routing table analysis, service fingerprinting, and CVE correlation.
Read-only IAM role deployment for cloud-asset correlation. Covers EC2 inventory, S3 bucket policies, and IAM role graphs (no write permissions).
The default detection set: CVE signatures for commonly-exposed services (web servers, databases, admin panels, debug endpoints, storage). Includes the signature spec for writing custom detection rules for non-standard services.
What Samaritan retains, for how long, in which region, and how CMK encryption via AWS KMS is configured for incident record storage.
#product
Product
A real scan output for acme-corp.io: 18 discovered assets, 7 findings (2 critical), and a correlated credential-access incident. The full story from discovery to alert.
What has shipped, when, and what changed. Detection rule additions, ingest volume increases, and new log source support are listed here.
Real-time system status for the Samaritan correlation pipeline, ingest endpoints, and alert dispatch, with historical incident data.
#community
Community
Technical posts on attack surface methodology, detection rule design, and specific incident patterns we have seen in the wild.
Open-source Terraform modules, example detection rules, and the Samaritan CLI for programmatic scan management.
Start with the sample report.
see exactly what a scan produces before running your own