ATK Security Checks

Does this public hostname negotiate hybrid post-quantum key exchange (X25519MLKEM768)? Returns TLS version, hybrid yes/no and a one-line verdict. Free. One TLS handshake per probe, no scanning.

{
  "type": "object",
  "properties": {
    "hostname": {
      "description": "Public DNS hostname, e.g. www.example.com. IP addresses and internal names are refused.",
      "title": "Hostname",
      "type": "string"
    }
  },
  "required": [
    "hostname"
  ],
  "title": "check_post_quantum_tlsArguments"
}

Certificate issuer, expiry date, days left, and whether the chain verifies for the hostname from a strict client (catches missing intermediate certificates and name mismatches). Free.

{
  "type": "object",
  "properties": {
    "hostname": {
      "description": "Public DNS hostname, e.g. www.example.com. IP addresses and internal names are refused.",
      "title": "Hostname",
      "type": "string"
    }
  },
  "required": [
    "hostname"
  ],
  "title": "check_tls_certificateArguments"
}

Finds Wazuh custom rules that pass wazuh-analysisd -t but are dropped at load (load order across ruleset/rules and etc/rules, missing parents, duplicate or colliding ids). Input: list of {filename, xml}. Supported versions: 4.14.7, 4.14.9. Free: counts + 2 findings. Full report: pass api_key.

{
  "type": "object",
  "properties": {
    "files": {
      "description": "Custom rule files, each {\"filename\": \"0094-local.xml\", \"xml\": \"<group>...</group>\"}; filename exactly as in /var/ossec/etc/rules/, up to 20 files.",
      "items": {
        "additionalProperties": true,
        "type": "object"
      },
      "title": "Files",
      "type": "array"
    },
    "wazuh_version": {
      "default": "4.14.9",
      "description": "Wazuh manager version: 4.14.7 or 4.14.9.",
      "title": "Wazuh Version",
      "type": "string"
    },
    "api_key": {
      "default": "",
      "description": "Optional key for the full report. Without it you get counts and 2 findings; the full report is also sold per call by x402 at POST https://atkvn.com/agent/v1/wazuh-audit.",
      "title": "Api Key",
      "type": "string"
    }
  },
  "required": [
    "files"
  ],
  "title": "audit_wazuh_rulesArguments"
}

Runs log lines through a real wazuh-manager 4.14.9 (fresh logtest session) with your custom rules and decoders: which decoder and rule matched, whether YOUR rule fired, and load warnings such as 7617/7619. Logtest engine: frequency/timeframe rules and some live-only behaviour are out of scope. Free: 1 log line with your files (3 with the stock ruleset only), summary. 10 lines with decoded fields and full alerts: POST https://atkvn.com/agent/v1/wazuh-testfire (x402, USD 0.10).

{
  "type": "object",
  "properties": {
    "logs": {
      "description": "Raw log lines exactly as the agent would forward them, one event per item.",
      "items": {
        "type": "string"
      },
      "title": "Logs",
      "type": "array"
    },
    "rules": {
      "default": [],
      "description": "Optional custom rule files: [{\"filename\": \"0096-local.xml\", \"xml\": \"<group>...</group>\"}]. Filename order matters: files load by name together with the stock ruleset.",
      "items": {
        "additionalProperties": true,
        "type": "object"
      },
      "title": "Rules",
      "type": "array"
    },
    "decoders": {
      "default": [],
      "description": "Optional custom decoder files, same shape as rules.",
      "items": {
        "additionalProperties": true,
        "type": "object"
      },
      "title": "Decoders",
      "type": "array"
    },
    "log_format": {
      "default": "syslog",
      "description": "Wazuh log_format, e.g. syslog or json.",
      "title": "Log Format",
      "type": "string"
    }
  },
  "required": [
    "logs"
  ],
  "title": "test_wazuh_ruleArguments"
}

Is this PHP install exposed to PHP2Shell, the two critical unauthenticated RCE flaws patched on 21 Oct 2026 (CVE-2026-109618, CVE-2026-109619)? Paste local evidence collected on the server: `php -v`, `php -i` or `php-fpm -i`, `cat /etc/os-release`, `dpkg -l 'php*'` or `rpm -qa 'php*'`. Returns patched / vulnerable / check_vendor_backport, the exact changelog command that decides distribution builds, upgrade commands, config mitigations until patched, and a tested Wazuh rule pack for crash and OOM signals. Free. Nothing is fetched from your servers.

{
  "type": "object",
  "properties": {
    "evidence": {
      "description": "Raw output of the commands above, pasted as one text block (up to 20 KB).",
      "title": "Evidence",
      "type": "string"
    }
  },
  "required": [
    "evidence"
  ],
  "title": "check_php2shellArguments"
}