Sold by: Son Cha LLC
Deployed on AWS
Panoptes watches deployed container images and alerts the moment a new CVE matches one of them. Your CI scan was a snapshot, this covers the window after you ship.
Overview
Most scanners look at an image once, at build or push. That's useful, but the CVE feed doesn't stop when you deploy. A package that was clean on Tuesday can pick up a critical on Friday, and the container already running in ECS or EKS has no idea.
Panoptes keeps one SBOM per deployed image digest and diffs new disclosures against that live inventory. If a previously-clean image becomes vulnerable, you get one alert for the fleet event, not one per replica. How fast you find out depends on the feed, not on when the next nightly scan happens to run.
It ships as a single container in your VPC. Generate SBOMs with the bundled agent (dpkg/apk today) or import CycloneDX/SPDX from Trivy, Syft, or whatever you already use. Metering is per digest, so a shared base image across fifty services is billed once. Growth covers up to 20 images. Business goes to 50, with more feeds and ticketing. Enterprise is a private offer if you need compliance exports and an SLA.
Highlights
- Watches images after they ship. When a new CVE lands, you hear about it then, not at the next cron job.
- One alert per CVE against the fleet, not one per replica. You get paged for the event, not the replica count.
- Runs in your VPC as a single container. Bring your own SBOMs or generate them with the bundled agent. Billed per image digest.
Details
Sold by
Categories
Delivery method
Supported services
Delivery option
Single container (dashboard, API, Postgres)
Latest version
Operating system
Linux
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on the duration and terms of your contract with the vendor. This entitles you to a specified quantity of use for the contract duration. If you choose not to renew or replace your contract before it ends, access to these entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/month |
|---|---|---|
Growth (up to 20 images) | Up to 20 monitored image digests. NVD and GitHub Security Advisories, SBOM import, drift timeline, and Slack alerts. Community support. A shared digest across many services still counts as one. | $500.00 |
Business (up to 50 images) | Up to 50 monitored image digests. All feeds, including distro trackers. Reachability, live ECS/EKS/ECR inventory, and Jira or PagerDuty. Replies during US business hours. | $1,000.00 |
Enterprise (unlimited) | Unlimited monitored image digests. EPSS and CISA KEV ranking, blast-radius, compliance exports, and an SLA. Sold as a private offer. Talk to us before you pick this one. | $1,500.00 |
Dimensions summary
Pricing follows three tiers based on how many container image digests you monitor. You are metered per image digest, and a shared base image counts once. Growth covers up to 20 images with core feeds, SBOM import, drift timeline, and Slack alerts. Business covers up to 50 images and adds more feeds, reachability, live inventory, and extra alert integrations. Enterprise removes the image limit and adds exploitability ranking, blast-radius scoring, compliance exports, and an SLA. Support scales with each tier. Enterprise is sold as a private offer, so you contact the vendor before choosing it.
Top-of-mind questions for buyers
A digest is the unique fingerprint of a specific built image. Each distinct digest running across your ECS, EKS, and ECR inventory counts as one monitored unit. A shared base image used by many services counts once, not once per service or per container instance.
Growth caps monitoring at 20 digests and Business at 50. These are fixed limits, not overage-billed thresholds. To monitor more digests, you move to a tier with a higher or unlimited count. Enterprise removes the limit and is arranged as a private offer.
Growth includes core CVE feeds, SBOM import, drift timeline, and Slack alerts with community support. Business adds distro feeds, reachability, live inventory, extra alert integrations, and business-hours replies. Enterprise adds exploitability ranking, blast-radius scoring, compliance exports, and an SLA. Support scales with each tier.
sonchallc.com
Helpful?
Vendor refund policy
We don't refund usage that already ran. If you were billed by mistake, or you never got the container running, email support@sonchallc.com within 30 days of the charge. Include your AWS account ID and the invoice. We'll check the metering records and sort it out. Private offers: sales@sonchallc.com .
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Single container (dashboard, API, Postgres)
Supported services: Learn more
- Amazon ECS
- Amazon EKS
Container image
Containers are lightweight, portable execution environments that wrap server application software in a filesystem that includes everything it needs to run. Container applications run on supported container runtimes and orchestration services, such as Amazon Elastic Container Service (Amazon ECS) or Amazon Elastic Kubernetes Service (Amazon EKS). Both eliminate the need for you to install and operate your own container orchestration software by managing and scheduling containers on a scalable cluster of virtual machines.
Version release notes
1.0.1 is the first build you should run. 1.0.0 was a thin slice. This one is the one that works on a real image.
What changed
- Dashboard shows severity counts, fixable vs no-fix, per-image finding counts, SBOM contents, and a drift timeline. Findings are searchable and filterable. Advisory IDs link out to osv.dev.
- Manual scan timeout is 5 minutes (was 60 seconds). A 142-package nginx image finishes instead of returning 502.
- If one OSV advisory fetch fails, the rest of the scan still records. One slow CVE no longer aborts the pass.
- Advisory summaries are truncated on rune boundaries so Postgres does not reject UTF-8.
- Health and image APIs now return severity rollups, fixable counts, and the SBOM package list.
How to tell you are on this build docker inspect --format '{{.RepoDigests}}' 709825985650.dkr.ecr.us-east-1.amazonaws.com/son-cha/panoptes:1.0.1 Expected digest: sha256:0020f6171c766392d4c6957ba3a4ed71d64c73295c99907fc3744655c978efa5
Do not use the latest tag. In this registry latest is immutable and still points at 1.0.0.
Additional details
Usage instructions
PREREQS: AWS CLI v2, Docker 24+, pull rights on this image. linux/amd64 only (on Apple Silicon keep --platform linux/amd64). Outbound HTTPS to api.osv.dev. Host port 18080 free. Do not publish 5432; Postgres is 127.0.0.1 inside the container. The SBOM agent reads dpkg or apk only (Debian, Ubuntu, Alpine). Distroless/scratch will import 0 packages.
-
PULL aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin 709825985650.dkr.ecr.us-east-1.amazonaws.com docker pull 709825985650.dkr.ecr.us-east-1.amazonaws.com/son-cha/panoptes:1.0.1 Use tag 1.0.1. Do not use latest (that tag is a different, older image).
-
RUN (bundled Postgres) docker rm -f panoptes 2>/dev/null docker run -d --name panoptes --restart unless-stopped --platform linux/amd64 -p 18080:8080 -v panoptes-data:/var/lib/postgresql/data -e PANOPTES_SEED_DEMO=0 709825985650.dkr.ecr.us-east-1.amazonaws.com/son-cha/panoptes:1.0.1
-
WAIT FOR HEALTH (up to 60s) for i in $(seq 1 30); do curl -fsS http://127.0.0.1:18080/api/v1/health && break; sleep 2; done Success includes "status":"ok" and "source":"osv.dev". If curl fails: docker logs panoptes Dashboard: http://127.0.0.1:18080
-
OPTIONAL DEMO (fake feed, not OSV) docker rm -f panoptes docker run -d --name panoptes --platform linux/amd64 -p 18080:8080 -e PANOPTES_SEED_DEMO=1 709825985650.dkr.ecr.us-east-1.amazonaws.com/son-cha/panoptes:1.0.1 After health, dashboard shows example/api:1.4.2 and CVE-2022-0778. Recreate with SEED_DEMO=0 before a real scan.
-
REAL IMAGE: nginx:1.20.2 With the step-2 container running: docker pull nginx:1.20.2 rm -rf /tmp/nginx-root && mkdir -p /tmp/nginx-root cid=$(docker create --platform linux/amd64 nginx:1.20.2) docker export "$cid" | tar -C /tmp/nginx-root -xf - docker rm "$cid" digest=$(docker image inspect nginx:1.20.2 --format '{{.Id}}') docker run --rm --platform linux/amd64 --entrypoint panoptes-sbom -v /tmp/nginx-root:/rootfs:ro 709825985650.dkr.ecr.us-east-1.amazonaws.com/son-cha/panoptes:1.0.1 /rootfs --ref nginx:1.20.2 > /tmp/nginx.cdx.json curl -fsS -X POST "http://127.0.0.1:18080/api/v1/import?digest=${digest}&ref=nginx:1.20.2 " -H 'Content-Type: application/json' --data-binary @/tmp/nginx.cdx.json Expect {"components":142,...} curl -fsS -m 320 -X POST http://127.0.0.1:18080/api/v1/scan Expect {"new_findings":N} after 1-3 minutes. Then curl -fsS http://127.0.0.1:18080/api/v1/findings and refresh the dashboard. Click the image for SBOM, findings, and timeline. To watch another Debian/Ubuntu/Alpine image, repeat this block and change the image name.
-
SLACK Recreate with -e PANOPTES_SLACK_WEBHOOK='https://hooks.slack.com/services/XXX/YYY/ZZZ ' No webhook: alerts appear in docker logs as [alert:dry-run].
-
YOUR OWN POSTGRES Create an empty DB, then recreate with: -e PANOPTES_BUNDLED_DB=0 -e DATABASE_URL='postgres://USER:PASS@HOST:5432/panoptes?sslmode=require' Do not attach the local volume. Schema is applied on connect. BUNDLED_DB=0 plus a localhost DATABASE_URL makes the process exit.
-
ENV PANOPTES_ADDR=:8080 PANOPTES_SEED_DEMO=0|1 PANOPTES_SLACK_WEBHOOK (empty=dry-run) PANOPTES_POLL_INTERVAL (default 5m) PANOPTES_BUNDLED_DB=0 skips local Postgres DATABASE_URL required when BUNDLED_DB=0 POSTGRES_USER/PASSWORD/DB default to panoptes (bundled only)
-
API on :18080 GET /api/v1/health GET /api/v1/images GET /api/v1/images/{digest} GET /api/v1/images/{digest}/timeline GET /api/v1/findings POST /api/v1/import?digest=sha256:...&ref=name:tag (CycloneDX or SPDX JSON body) POST /api/v1/scan (allow 5 minutes)
-
BROKEN? docker logs panoptes docker inspect --format '{{.State.Health.Status}}' panoptes curl -v http://127.0.0.1:18080/api/v1/health Pull/scan errors: confirm tag 1.0.1, amd64, and HTTPS to api.osv.dev. Empty findings: you scanned with SEED_DEMO=1. Recreate with 0, import again, POST /scan.
Support
Vendor support
Email support@sonchallc.com for product questions, setup, and Marketplace issues. Sales and private offers: sales@sonchallc.com . Security disclosures: security@sonchallc.com .
Growth: community support, we answer as we can. Business: replies during US business hours (Pacific). Enterprise: named contact and an SLA, arranged as a private offer.
Docs and the source live with the product. We don't run a phone line; email is the fastest way to reach someone who actually works on this.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
Schedule on-going, automated network and application vulnerability scans to be compliant with SOC2, HIPAA, FISMA, GDPR and more.
Alegion data labeling services provides both the platform and workforce to deliver quality at scale, processing structured and unstructured data including video, image, audio, and text for computer vision and natural language processing use cases. We lead the industry in streaming, high-resolution, high-density video annotation, delivering accurately-annotated, model-ready data to train and validate ML models.
Ango AI provides next-gen data labeling solutions for AI teams of all industries, from medical to banking and beyond. Our solutions are used to annotate millions of assets each month, for customers ranging from startups to national security agencies. We provide Ango Hub, the most fully-featured data labeling platform around, and Ango Service, the quality-first, fully-managed data labeling service.
Annotation Labs provides 100% secure & accurate data labeling solutions (image, video, audio & text) to train AI & Computer Vision models. We are SLA-driven with a methodical approach to each project for higher efficiency and faster turnaround. Trusted by S&P listed companies and Y Combinator incubated startups in the USA & Europe. Know more about our data solutions managed services at aws@annotationlabs.com.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.