Procedure

1. In the Red Hat OpenShift Container Platform web console, navigate to Operators → OperatorHub or Ecosystem → Software Catalog.
2. In the Filter by keyword box, enter RHTPA exploit intelligence.
3. Click the RHTPA exploit intelligence Operator tile.
4. Read the Operator description and click Install.
5. On the Install Operator page, select the installation mode and click Install.

6. Verify the Operator installation:

   $ oc get csv -n <operator-namespace> | grep exploit-iq-operator

   Copy code to clipboard

   The output should show the Operator with a Succeeded phase.

7. Create a project for the Exploit Intelligence stack:

   $ oc new-project exploit-iq

   Copy code to clipboard

8. Create the API credentials secret:

   $ oc create secret generic exploit-iq-secret \
     --from-literal=ghsa_api_key="<github-token>" \
     --from-literal=nvidia_api_key="<nvidia-api-key>" \
     --from-literal=ngc_api_key="<ngc-organization-key>" \
     --from-literal=nvd_api_key="<nvd-api-key>" \
     --from-literal=serpapi_api_key="<serpapi-key>" \
     --from-literal=registry_redhat_username="<redhat-registry-username>" \
     --from-literal=registry_redhat_password="<redhat-registry-password>"

   Copy code to clipboard

9. Create the Red Hat registry credentials secret:

   1. Download the pull secret from your Red Hat registry service account.

   2. Create the secret:

      $ oc create secret generic image-registry-credentials \
        --from-file=.dockerconfigjson=<path-to-pull-secret.json> \
        --type=kubernetes.io/dockerconfigjson

      Copy code to clipboard

10. Create the MongoDB credentials secret.

    Choose one of the following options based on your MongoDB configuration:

    • For MongoDB with host and port:

      $ oc create secret generic mongodb-credentials \
        --from-literal=host="<mongodb-host>:27017" \
        --from-literal=username="<mongodb-username>" \
        --from-literal=password="<mongodb-password>"

      Copy code to clipboard

    • For MongoDB Atlas or SRV connection string:

      $ oc create secret generic mongodb-credentials \
        --from-literal=connection-string="mongodb+srv://<user>:<password>@<cluster>/"

      Copy code to clipboard

11. Optional: Create the OAuth client secret.

    Note

    The Operator automatically generates a random OAuth client secret if you do not provide one.

    1. Generate the OAuth secrets:

       $ export OAUTH_CLIENT_SECRET=$(openssl rand -base64 32)
       $ export OPENSHIFT_DOMAIN=$(oc get dns cluster -o jsonpath='{.spec.baseDomain}')

       Copy code to clipboard

    2. Create the secret:

       $ oc create secret generic oauth-client-secret \
         --from-literal=client-secret="$OAUTH_CLIENT_SECRET" \
         --from-literal=openshift-domain="$OPENSHIFT_DOMAIN"

       Copy code to clipboard

12. Create the credential encryption key secret:

    $ oc create secret generic credential-encryption-key \
      --from-literal=credential-encryption-key="$(openssl rand -hex 32)"

    Copy code to clipboard

13. Deploy the Exploit Intelligence stack by creating an ExploitIQStack custom resource:

    The Exploit Intelligence Operator provides multiple ExploitIQStack custom resource sample configurations in the Content from github.com is not included.exploit-iq-operator repository depending on your deployment scenario:

    • exploitiq_v1alpha1_exploitiqstack.yaml: Minimal production deployment on Red Hat OpenShift Container Platform with Routes, OAuth integration, and automatic TLS certificate management.
    • exploitiq_v1alpha1_exploitiqstack_self_hosted_llm.yaml: For self-hosted LLM deployments using OpenAI-compatible APIs (Ollama, vLLM, LocalAI, Text Generation Inference) instead of NVIDIA NIM.

    1. Download the ExploitIQStack custom resource for your deployment scenario:

       • For minimal production deployment:

         $ curl -O https://raw.githubusercontent.com/RHEcosystemAppEng/exploit-iq-operator/0.0.3/config/samples/exploitiq_v1alpha1_exploitiqstack.yaml

         Copy code to clipboard

       • For self-hosted LLM deployment:

         $ curl -O https://raw.githubusercontent.com/RHEcosystemAppEng/exploit-iq-operator/0.0.3/config/samples/exploitiq_v1alpha1_exploitiqstack_self_hosted_llm.yaml

         Copy code to clipboard

    2. Edit the custom resource to match your secret names:

       apiVersion: exploitiq.openshift.io/v1alpha1
       kind: ExploitIQStack
       metadata:
         name: exploit-iq
       spec:
         webApp:
           registryCredentialsSecretRef:
             name: image-registry-credentials
         database:
           mode: hostPort       # Use 'connectionString' for MongoDB Atlas
           secretRef:
             name: mongodb-credentials

       Copy code to clipboard

    3. Apply the custom resource:

       $ oc apply -f exploitiq_v1alpha1_exploitiqstack.yaml

       Copy code to clipboard

14. Monitor the deployment progress:

    $ oc get exploitiqstack exploit-iq -w

    Copy code to clipboard

    Wait for the stack to reach a ready state.

15. Grant user access to the Exploit Intelligence application:

    $ oc adm groups new exploit-iq-view
    $ oc adm groups add-users exploit-iq-view <username>

    Copy code to clipboard

16. Optional: Configure custom OIDC CA certificate.

    If your OIDC or OAuth provider uses a private or self-signed certificate authority (CA) that the WebApp does not trust by default, configure a custom CA bundle.

    Note

    This step is only required when using external OIDC providers (such as Keycloak or AWS Cognito) with custom or self-signed certificates. If you are using the default Red Hat OpenShift Container Platform OAuth or a provider with a publicly trusted certificate, skip this step.

    1. Extract the cluster domain from the API server URL:

       $ export OCP_DOMAIN=$(oc whoami --show-server | sed -E 's#^https?://api\.##; s#:[0-9]+/?$##; s#/$##')
       $ echo "Cluster domain: ${OCP_DOMAIN}"

       Copy code to clipboard

    2. Retrieve the OAuth issuer URL from the public well-known endpoint:

       $ export OAUTH_ISSUER=$(curl -sk \
         "https://api.${OCP_DOMAIN}:6443/.well-known/oauth-authorization-server" \
         | jq -r '.issuer')
       $ echo "OAuth issuer: ${OAUTH_ISSUER}"

       Copy code to clipboard

    3. Extract the OAuth hostname from the issuer URL:

       $ export OAUTH_HOST=$(echo "${OAUTH_ISSUER}" | sed -E 's#^https?://##; s#/.*$##')
       $ echo "OAuth host: ${OAUTH_HOST}"

       Copy code to clipboard

    4. Create a working directory for the CA certificates:

       $ export CA_DIR=$(mktemp -d)

       Copy code to clipboard

    5. Extract the CA certificate chain from the OAuth endpoint:

       $ openssl s_client \
         -connect "${OAUTH_HOST}:443" \
         -servername "${OAUTH_HOST}" \
         -showcerts </dev/null 2>/dev/null \
         | awk '/BEGIN CERT/,/END CERT/' \
         | awk 'BEGIN{n=0;buf=""} /BEGIN CERT/{n++;buf=""} {buf=buf $0"\n"} /END CERT/{if(n>1) printf buf}' \
         > "${CA_DIR}/oauth-ca.crt"

       Copy code to clipboard

    6. Extract the CA certificate chain from the API server endpoint:

       $ openssl s_client \
         -connect "api.${OCP_DOMAIN}:6443" \
         -servername "api.${OCP_DOMAIN}" \
         -showcerts </dev/null 2>/dev/null \
         | awk '/BEGIN CERT/,/END CERT/' \
         | awk 'BEGIN{n=0;buf=""} /BEGIN CERT/{n++;buf=""} {buf=buf $0"\n"} /END CERT/{if(n>1) printf buf}' \
         > "${CA_DIR}/api-ca.crt"

       Copy code to clipboard

    7. Merge both certificate chains into a single CA bundle:

       $ cat "${CA_DIR}/oauth-ca.crt" "${CA_DIR}/api-ca.crt" > "${CA_DIR}/ca-bundle.crt"

       Copy code to clipboard

    8. Create a ConfigMap with the CA bundle in your deployment namespace:

       $ oc create configmap oidc-ca-bundle \
         --from-file=ca-bundle.crt="${CA_DIR}/ca-bundle.crt" \
         -n exploit-iq

       Copy code to clipboard

    9. Update the ExploitIQStack custom resource to reference the CA bundle ConfigMap:

       Edit your ExploitIQStack custom resource YAML file to add the oidcCaBundleConfigMapRef field under spec.webApp:

       apiVersion: exploitiq.openshift.io/v1alpha1
       kind: ExploitIQStack
       metadata:
         name: exploit-iq
         namespace: exploit-iq
       spec:
         webApp:
           oidcCaBundleConfigMapRef:
             name: oidc-ca-bundle
           registryCredentialsSecretRef:
             name: image-registry-credentials
         database:
           mode: hostPort
           secretRef:
             name: mongodb-credentials

       Copy code to clipboard

    10. Apply the updated custom resource:

        $ oc apply -f exploitiq_v1alpha1_exploitiqstack.yaml

        Copy code to clipboard

        The Operator automatically mounts the ConfigMap into the WebApp pod at /etc/oidc-ca/ca-bundle.crt and configures the required environment variables.

    11. Verify that the WebApp pod mounts the OIDC CA volume:

        $ oc get pod -n exploit-iq -l app.kubernetes.io/component=webapp \
          -o jsonpath='{.items[0].spec.volumes[*].name}' | grep oidc-ca

        Copy code to clipboard

        The output should include oidc-ca.

Verification

1. Verify that all Exploit Intelligence pods are running:

   $ oc get pods -n exploit-iq

   Copy code to clipboard

   All pods should show a Running status.

2. Verify the ExploitIQStack custom resource status:

   $ oc get exploitiqstack exploit-iq -o yaml

   Copy code to clipboard

   Check the status section for successful deployment conditions.

3. Access the Exploit Intelligence web interface:

   1. Retrieve the route URL:

      $ oc get route -n exploit-iq

      Copy code to clipboard
   2. Open the route URL in a web browser and verify that you can log in using your Red Hat OpenShift Container Platform credentials.

Procedure

1. Clone the Exploit Intelligence vulnerability analysis repository:

   $ git clone https://github.com/RHEcosystemAppEng/exploit-iq-agent
   $ cd exploit-iq-agent/kustomize

   Copy code to clipboard

2. Create a namespace for the Exploit Intelligence deployment:

   $ export YOUR_NAMESPACE_NAME=<your_namespace_name>
   $ oc new-project $YOUR_NAMESPACE_NAME

   Copy code to clipboard

   Where:

   <your_namespace_name> is the name for your Exploit Intelligence deployment namespace, for example, exploit-iq.

3. Create the API credentials file in the base directory:

   1. Create a file named base/secrets.env with the following content:

      GHSA_API_KEY=<github_advisory_database_api_key>
      NVD_API_KEY=<national_vulnerability_database_api_key>
      NVIDIA_API_KEY=<nvidia_api_key_or_placeholder>
      SERPAPI_API_KEY=<serpapi_api_key>
      registry_redhat_username=<your_registry_username>
      registry_redhat_password=<your_registry_password_or_token>

      Copy code to clipboard

      Where:

      <github_advisory_database_api_key>

      Your GitHub Personal Access Token with access to the GitHub Security Advisory Database API.

      <national_vulnerability_database_api_key>

      Your API key from the National Vulnerability Database (NVD).

      <nvidia_api_key_or_placeholder>

      Your NVIDIA API key for NVIDIA-hosted inference services. If using a self-hosted LLM, you can use a placeholder value.

      <serpapi_api_key>

      Your SerpAPI API key for web search functionality.

      <your_registry_username>

      Your Red Hat registry username for accessing registry.redhat.io.

      <your_registry_password_or_token>

      Your Red Hat registry password or token for authenticated pulls.

      Note

      Product scanning requires valid API credentials for authenticated access to vulnerability databases.

4. Create the image registry credentials file:

   1. Create a file named base/image-registry-credentials.env with your Red Hat registry authentication JSON:

      REGISTRY_AUTH_JSON=<registry_auth_json>

      Copy code to clipboard
      Note

      Product scanning requires valid registry authentication JSON to pull product component container images from registry.redhat.io.

5. Configure OAuth credentials:

   1. For a first-time deployment, generate new OAuth secrets:

      $ export OAUTH_CLIENT_SECRET=$(openssl rand -base64 32)
      $ export OAUTH_SESSION_SECRET=$(openssl rand -base64 32)
      $ export OCP_DOMAIN=$(oc whoami --show-server | sed -E 's#^https?://api\.##; s#:[0-9]+/?$##; s#/$##')

      Copy code to clipboard

   2. For reusing an existing OAuthClient, extract the existing secret:

      $ export OAUTH_CLIENT_SECRET=$(oc get oauthclient exploit-iq-client -o jsonpath='{..secret}')
      $ export OAUTH_SESSION_SECRET=$(openssl rand -base64 32)

      Copy code to clipboard

   3. Create the base/oauth-secrets.env file with the generated secrets:

      client-secret=<oauth_client_secret>
      session-secret=<oauth_session_secret>
      openshift-domain=<openshift_cluster_domain>

      Copy code to clipboard

      Where:

      <oauth_client_secret>

      The OAuth client secret value from the earlier step.

      <oauth_session_secret>

      The OAuth session secret value from the earlier step.

      <openshift_cluster_domain>

      The OpenShift cluster domain extracted from the earlier step.

      Note

      The OAuth client secret must be at least 32 bytes (256 bits) for HS256 signing.

6. Create the MongoDB credentials secret with the following keys:

   $ oc create secret generic mongodb-credentials \
     --from-literal=exploit-iq-user=<mongodb_user> \
     --from-literal=exploit-iq-password=<mongodb_password> \
     --from-literal=admin-user=<mongodb_admin_user> \
     --from-literal=admin-password=<mongodb_admin_password>

   Copy code to clipboard

7. Set the callback URL:

   $ export CALLBACK_URL="https://exploit-iq-client.$(oc project -q).svc:8443"
   $ find . -type f -name 'exploit-iq-config.yml' -exec sed -i "s|CALLBACK_URL_PLACEHOLDER|$CALLBACK_URL|g" {} +

   Copy code to clipboard

8. Configure encryption and SSL:

   1. Generate an encryption key for securing sensitive data:

      $ echo -n "credential-encryption-key=$(openssl rand -hex 32)" > base/credential-encryption-key.env

      Copy code to clipboard

   2. Create the CA certificate bundle:

      The CA bundle file base/ca-certs/ca-bundle.crt is required before running oc kustomize in the deployment step. The bundle must include CA certificates for SSL/TLS verification of external endpoints and internal services.

      1. Create the certificate directory:

         $ mkdir -p base/ca-certs

         Copy code to clipboard

      2. Add custom CA certificates if you need to connect to internal services:

         $ cp /path/to/your-custom-ca.pem base/ca-certs/

         Copy code to clipboard

         where /path/to/your-custom-ca.pem is the path to your organization’s CA certificate file.

      3. Create the CA bundle file:

         $ cat /path/to/your-custom-ca.pem > base/ca-certs/ca-bundle.crt

         Copy code to clipboard

      4. Verify the CA bundle:

         $ openssl crl2pkcs7 -nocrl -certfile base/ca-certs/ca-bundle.crt | \
           openssl pkcs7 -print_certs -noout

         Copy code to clipboard

9. Deploy a deployment variant:

   Note

   The Exploit Intelligence deployment supports three variants depending on your LLM configuration:

   • Self-Hosted LLM: For self-managed LLM endpoints accessible over the network.
   • Self-Hosted LLM + MLOps: Includes Grafana and Tempo for observability.
   • Remote NVIDIA Inference Microservices (NIM): Uses NVIDIA-hosted inference services.

   1. For a self-hosted LLM deployment:

      $ oc kustomize overlays/self-hosted-llama3.1-70b-4bit | oc apply -f - -n $YOUR_NAMESPACE_NAME

      Copy code to clipboard

   2. For a self-hosted LLM deployment with MLOps observability:

      Note

      This variant requires additional namespace patches and Grafana token creation. Refer to the overlay documentation for details.

      $ oc kustomize overlays/mlops | oc apply -f - -n $YOUR_NAMESPACE_NAME

      Copy code to clipboard

   3. For a remote NIM deployment using NVIDIA-hosted services:

      $ oc kustomize overlays/remote-nim-all | oc apply -f - -n $YOUR_NAMESPACE_NAME

      Copy code to clipboard

10. Verify the OAuth client:

    Verify that the OAuthClient resource was created with the proper redirect URIs.

    $ oc get oauthclient exploit-iq-client

    Copy code to clipboard
    Note

    If the OAuthClient is missing, re-apply the kustomize overlay from the earlier step: $ oc kustomize overlays/<your_variant> | oc apply -f - -n $YOUR_NAMESPACE_NAME

11. Grant user access to the Exploit Intelligence application:

    $ oc adm groups new exploit-iq-view
    $ oc adm groups add-users exploit-iq-view <username>

    Copy code to clipboard

Verification

1. Verify that the core services pods are running and in a ready state:

   $ oc get pods -n $YOUR_NAMESPACE_NAME

   Copy code to clipboard

   Example output:

   NAME                                   READY   STATUS    RESTARTS   AGE
   exploit-iq-6dfdd8fd66-2mcnl            2/2     Running   0          2m
   exploit-iq-client-db-545b94dd6-5d9vl   1/1     Running   0          2m
   nginx-cache-595cd758db-zwkw6           1/1     Running   0          2m

   Copy code to clipboard
   Note

   All pods should show Running status with containers ready (for example, 2/2 or 1/1). The application pod does not reach a ready state without a reachable MongoDB endpoint.

2. Access the Exploit Intelligence web interface:

   1. Retrieve the route hostname:

      $ oc get route -n $YOUR_NAMESPACE_NAME

      Copy code to clipboard
   2. Open the route URL in a web browser and verify that you can log in using your Red Hat OpenShift Container Platform credentials.

Procedure

1. Create a Cognito User Pool if one does not already exist:

   1. Navigate to AWS Console → Amazon Cognito → User Pools.
   2. Click Create user pool.

   3. Follow the wizard to configure your user pool:

      • Under Cognito user pool sign-in options, select Email and Username.
      • Under Self-service sign-up, to prevent public access, disable Enable self-registration.
      • Under Required attributes, select email and preferred_username.
      • Under Initial app client, set App type to Traditional web application.
   4. Click Create user pool to complete the user pool creation.
   5. Note the User Pool ID in the format <region>_<region_id> (for example, eu-north-1_rIW9qmUNl).
   6. Note the AWS Region (for example, eu-north-1).

2. Configure a domain for the hosted UI:

   1. In your User Pool, navigate to Branding → Cognito domain.
   2. Under Cognito domain, select the branding version Hosted UI (classic).

   3. Choose one of the following methods:

      Cognito domain: Enter a unique domain prefix (for example, my-exploitiq)

      Custom domain: Use your own domain with SSL certificate

   4. Note the full domain (for example, Content from my-exploitiq.auth.eu-north-1.amazoncognito.com is not included.https://my-exploitiq.auth.eu-north-1.amazoncognito.com).

3. Create a resource server to define the machine-to-machine API access scope:

   1. Navigate to Application → Resource servers → Create resource server.
   2. Set Resource server name to ExploitIQ API.
   3. Set Identifier to exploitiq-resource-server.

   4. Add a Custom scope:

      Scope name: exploitiq-api-access

      Description: Full access to ExploitIQ API

   5. Click Create resource server.

      Note

      The full scope identifier is exploitiq-resource-server/exploitiq-api-access.

4. Create the UI app client for browser authentication:

   1. Navigate to Application → App clients → Create app client.
   2. Set App client name to exploitiq-ui-client.
   3. Set App type to Traditional web application.
   4. Click Create app client to create the app client.
   5. After the app client is created, navigate to Login pages of the newly created app client and click Edit to configure the managed login pages.
   6. Under Authentication flows, enable Authorization code grant.
   7. Under Allowed OAuth scopes, enable openid, profile, and email.
   8. Under Allowed OAuth scopes, add exploitiq-resource-server/exploitiq-api-access (custom scope).
   9. Under Identity providers, ensure Cognito user pool is selected.

   10. Under Allowed callback URLs, add both URLs with and without trailing slash:

       https://exploit-iq-client-<namespace>.apps.<cluster_domain>
       https://exploit-iq-client-<namespace>.apps.<cluster_domain>/

       Copy code to clipboard

       Where:

       <namespace>

       Your OCP namespace where you deployed Exploit Intelligence

       <cluster_domain>

       Your OCP cluster domain (for example, apps.example.com)

       Note

       These are placeholder URLs. You will update them with the actual route in step 10.

   11. Under Allowed sign-out URLs, add the API logout URL:

       https://exploit-iq-client-<namespace>.apps.<cluster_domain>/api/v1/user/logged-out

       Copy code to clipboard

       Where:

       <namespace>

       Your OCP namespace where you deployed Exploit Intelligence

       <cluster_domain>

       Your OCP cluster domain (for example, apps.example.com)

   12. Under Default URL, set the default redirect URL:

       https://exploit-iq-client-<namespace>.apps.<cluster_domain>

       Copy code to clipboard

       Where:

       <namespace>

       Your OCP namespace where you deployed Exploit Intelligence

       <cluster_domain>

       Your OCP cluster domain (for example, apps.example.com)

   13. Click Save changes to apply the configuration.
   14. Note the Client ID and Client secret.

5. Create the machine-to-machine app client for agent authentication:

   1. Navigate to Application → App clients → Create app client.
   2. Set App client name to exploitiq-m2m-client.
   3. Set App type to Machine-to-machine application.
   4. Under Allowed OAuth scopes, enable exploitiq-resource-server/exploitiq-api-access.
   5. Click Create app client to create the app client.
   6. After the app client is created, navigate to Login pages of the newly created app client and click Edit to configure the managed login pages.
   7. Under OAuth 2.0 grant types, ensure Client credentials is enabled.
   8. Under Allowed custom scopes, ensure exploitiq-resource-server/exploitiq-api-access is enabled.
   9. Under Identity providers, ensure Cognito user pool is selected.
   10. Click Save changes to apply the configuration.
   11. Note the Client ID and Client secret.

6. Create a Cognito group to control access:

   1. Navigate to Users and groups → Groups → Create group.
   2. Set Group name to exploit-iq-admin.

   3. Click Create group.

      Note

      The cognito:groups claim in the JWT token includes the group names.

7. Create a Cognito user and add them to the group:

   1. Navigate to User management → Users → Create user.

   2. Configure the user information:

      • Under Alias attributes used to sign in, select Email.
      • Under Invitation message, choose whether to send an email invitation or set a temporary password.
      • Set User name to the desired username.
      • Set Email address to the user’s email.
   3. Click Create user to create the user account.
   4. After the user is created, select the user from the Users list and navigate to Group memberships.
   5. Click Add user to group and select the exploit-iq-admin group.

8. Configure the agent deployment for machine-to-machine authentication using the machine-to-machine app client credentials:

   export COGNITO_DOMAIN="https://<your_domain_prefix>.auth.<region>.amazoncognito.com"
   export COGNITO_CLIENT_ID="<m2m_app_client_id>"
   export COGNITO_CLIENT_SECRET="<m2m_app_client_secret>"
   export COGNITO_SCOPE="exploitiq-resource-server/exploitiq-api-access"
   
   oc set env deployment/exploit-iq -n $YOUR_NAMESPACE_NAME \
     AUTH_TYPE=cognito \
     COGNITO_DOMAIN="${COGNITO_DOMAIN}" \
     COGNITO_SCOPE="${COGNITO_SCOPE}" \
     COGNITO_CLIENT_ID="${COGNITO_CLIENT_ID}" \
     COGNITO_CLIENT_SECRET="${COGNITO_CLIENT_SECRET}"

   Copy code to clipboard

   Where:

   <your_domain_prefix>

   The Cognito domain prefix you configured in step 2 (for example, my-exploitiq)

   <region>

   Your AWS region (for example, eu-north-1)

   <m2m_app_client_id>

   The Client ID from the M2M app client you created in step 5

   <m2m_app_client_secret>

   The Client secret from the M2M app client you created in step 5

9. Configure the client deployment for browser authentication using the UI app client credentials:

   export USER_POOL_ID="<region>_<region_id>"
   export AWS_REGION="<region>"
   export UI_CLIENT_ID="<ui_app_client_id>"
   export UI_CLIENT_SECRET="<ui_app_client_secret>"
   export COGNITO_DOMAIN="https://<your_domain_prefix>.auth.<region>.amazoncognito.com"
   
   oc set env deployment/exploit-iq-client -n $YOUR_NAMESPACE_NAME \
     QUARKUS_PROFILE=external-idp \
     QUARKUS_OIDC_ENABLED=true \
     QUARKUS_OIDC_AUTH_SERVER_URL="https://cognito-idp.${AWS_REGION}.amazonaws.com/${USER_POOL_ID}" \
     QUARKUS_OIDC_CLIENT_ID="${UI_CLIENT_ID}" \
     QUARKUS_OIDC_CREDENTIALS_SECRET="${UI_CLIENT_SECRET}" \
     QUARKUS_OIDC_APPLICATION_TYPE=hybrid \
     QUARKUS_OIDC_TOKEN_CLIENT_ID_CHECK=none \
     QUARKUS_OIDC_TOKEN_SUBJECT_REQUIRED=false \
     QUARKUS_OIDC_TOKEN_TOKEN_TYPE=access \
     QUARKUS_OIDC_USER_INFO_REQUIRED=false \
     QUARKUS_OIDC_AUTHENTICATION_USER_INFO_REQUIRED=false \
     QUARKUS_OIDC_ROLES_SOURCE=accesstoken \
     QUARKUS_OIDC_TOKEN_HEADER=Authorization \
     QUARKUS_OIDC_AUTHENTICATION_REDIRECT_PATH=/ \
     QUARKUS_SECURITY_JAXRS_DENY_UNANNOTATED_ENDPOINTS=false \
     COGNITO_DOMAIN="${COGNITO_DOMAIN}" \
     EXPLOITIQ_SECURITY_OIDC_SCOPE_ROLE_MAPPINGS='exploitiq-resource-server/exploitiq-api-access=exploitiq-api-access'

   Copy code to clipboard

   Where:

   <region>_<region_id>

   Your User Pool ID from step 1 (for example, eu-north-1_rIW9qmUNl)

   <region>

   Your AWS region (for example, eu-north-1)

   <ui_app_client_id>

   The Client ID from the UI app client you created in step 4

   <ui_app_client_secret>

   The Client secret from the UI app client you created in step 4

   <your_domain_prefix>

   The Cognito domain prefix you configured in step 2 (for example, my-exploitiq)

10. After you create the client route, update the Cognito callback and sign-out URLs:

    1. Get the client route:

       oc get route exploit-iq-client -o jsonpath='{.spec.host}' -n $YOUR_NAMESPACE_NAME

       Copy code to clipboard
    2. In AWS Cognito Console, navigate to Application → App clients and click exploitiq-ui-client.
    3. Navigate to Login pages and click Edit.

    4. Update Allowed callback URLs with both URLs with and without trailing slash:

       https://<client_route>
       https://<client_route>/

       Copy code to clipboard

       Where:

       <client_route>

       The route hostname you retrieved in the earlier step.

    5. Update Allowed sign-out URLs with the API logout URL:

       https://<client_route>/api/v1/user/logged-out

       Copy code to clipboard

       Where:

       <client_route>

       The route hostname you retrieved in the earlier step.

    6. Click Save changes to apply the updated URLs.

Verification

1. Verify that users in the exploit-iq-admin group can authenticate to the Exploit Intelligence UI.
2. Verify that the agent can authenticate using the machine-to-machine credentials and access API endpoints.

Procedure

1. In your Keycloak admin console, configure a realm with the following settings:

   Realm name: quarkus (or your preferred realm name)

   SSL Required: none (for development) or external (for production)

   Brute Force Protection: Enabled (recommended for production)

2. In your Keycloak realm, create an OIDC client:

   1. Navigate to Clients → Create client.
   2. Set Client ID to exploit-iq-client.
   3. Set Client Protocol to openid-connect.

   4. Enable the following settings:

      Client authentication: Enabled (confidential client)

      Standard Flow Enabled: Enabled (Authorization Code flow)

      Direct Access Grants Enabled: Enabled (Resource Owner Password Credentials flow)

      Service Accounts Enabled: Enabled (for agent authentication)

      Implicit Flow Enabled: Disabled

   5. Set Valid Redirect URIs to Content from exploit-iq-client-route is not included.https://exploit-iq-client-route/* (update with your actual route after deployment).
   6. Set Web Origins to Content from exploit-iq-client-route is not included.https://exploit-iq-client-route (update with your actual route after deployment).
   7. Set Client secret to match the value you created in the keycloak-credentials secret.

3. Configure protocol mappers for the client:

   Add the following protocol mappers to ensure required claims are present in tokens:

   preferred_username mapper:

   Name	preferred_username
   Mapper Type	User Property
   Property	username
   Token Claim Name	preferred_username
   Claim JSON Type	String
   Add to ID token	Enabled
   Add to access token	Enabled
   Add to userinfo	Enabled

   email mapper:

   Name	email
   Mapper Type	User Property
   Property	email
   Token Claim Name	email
   Claim JSON Type	String
   Add to ID token	Enabled
   Add to access token	Enabled
   Add to userinfo	Enabled

   upn mapper:

   Name	upn
   Mapper Type	User Property
   Property	username
   Token Claim Name	upn
   Claim JSON Type	String
   Add to ID token	Enabled
   Add to access token	Enabled
   Add to userinfo	Enabled

4. Create roles for authorization:

   Define the following roles (either at realm level or client level):

   • exploit-iq-view - Read-only access to the UI
   • exploit-iq-prodsec - Product security team access
   • exploit-iq-admin - Full administrative access
   • exploitiq-api-access - API access for service accounts

5. Assign roles to users and service accounts:

   1. Assign one of the first three roles (exploit-iq-view, exploit-iq-prodsec, or exploit-iq-admin) to human users who need UI access.
   2. Assign the exploitiq-api-access role to the service account user of the client (used by the agent) for API endpoint access.

6. Create the keycloak-credentials secret in your OCP namespace:

   oc create secret generic keycloak-credentials \
     --from-literal=client-secret=<your_client_secret> \
     -n $YOUR_NAMESPACE_NAME

   Copy code to clipboard

   Where:

   <your_client_secret>

   The client secret from the OIDC client you created in step 2

   Note

   For development environments using the embedded Keycloak component, include admin-user and admin-password keys. For production external Keycloak instances, you must include only the client-secret key.

7. Configure the Exploit Intelligence client deployment with Keycloak environment variables:

   export KEYCLOAK_URL="https://<keycloak_hostname>/realms/quarkus"
   
   oc set env deployment/exploit-iq-client -n $YOUR_NAMESPACE_NAME \
     QUARKUS_PROFILE=external-idp \
     QUARKUS_OIDC_ENABLED=true \
     QUARKUS_OIDC_AUTH_SERVER_URL="${KEYCLOAK_URL}" \
     QUARKUS_OIDC_CLIENT_ID=exploit-iq-client \
     QUARKUS_OIDC_AUTHENTICATION_SCOPES=openid,profile,email

   Copy code to clipboard

   Where:

   <keycloak_hostname>

   The fully qualified domain name of your Keycloak instance (for example, keycloak.example.com)

   The client secret is automatically loaded from the keycloak-credentials secret.

8. Configure the Exploit Intelligence agent deployment with Keycloak environment variables:

   export KC_SERVER="https://<keycloak_hostname>"
   export KC_REALM="quarkus"
   
   oc set env deployment/exploit-iq -n $YOUR_NAMESPACE_NAME \
     AUTH_TYPE=keycloak \
     KC_SERVER="${KC_SERVER}" \
     KC_CLIENT_ID=exploit-iq-client \
     KC_REALM="${KC_REALM}"

   Copy code to clipboard

   Where:

   <keycloak_hostname>

   The fully qualified domain name of your Keycloak instance (for example, keycloak.example.com)

   The client secret is automatically loaded from the keycloak-credentials secret.

9. After you create the route, update the Keycloak client redirect URIs:

   1. Get the client route:

      oc get route exploit-iq-client -o jsonpath='{.spec.host}' -n $YOUR_NAMESPACE_NAME

      Copy code to clipboard
   2. In Keycloak Admin Console, navigate to your client → Settings.

   3. Update Valid Redirect URIs to:

      https://<client_route>/*

      Copy code to clipboard

   4. Update Web Origins to:

      https://<client_route>

      Copy code to clipboard

      Where:

      <client_route>

      The route hostname you retrieved in the previous step

   5. Click Save.

Verification

1. Verify that users with assigned roles can authenticate to the Exploit Intelligence UI.
2. Verify that the agent service account can authenticate and access API endpoints.

Procedure

1. Identify the Exploit Intelligence client endpoint URL:

   $ oc get route exploit-iq-client -n <exploit_iq_namespace> -o jsonpath='{.spec.host}'

   Copy code to clipboard

   where:

   <exploit_iq_namespace> is the OpenShift namespace where Exploit Intelligence is deployed (for example, exploit-iq).

   The endpoint is the OpenShift Route or Service URL for the exploit-iq-client deployment that you will use to configure the integration in the TrustedProfileAnalyzer custom resource.

2. In your identity provider (for example, Red Hat build of Keycloak or AWS Cognito), create an OIDC client for RHTPA with the following configuration:

   1. Set the grant type to client credentials.

   2. Assign the exploit-iq-view role:

      • For Keycloak: Assign as a realm role or client role under the exploit-iq-client client.

      • For other providers: Ensure the role appears in the groups claim of the issued token.

        Note

        Note the client ID and client secret. You will use these values in subsequent steps.

3. Ensure the client secret exists as a Kubernetes Secret in the RHTPA namespace:

   The secret can be created manually, managed by your identity provider operator, or synchronized by an external secrets manager. The TrustedProfileAnalyzer custom resource will reference this secret by name.

4. Configure Exploit Intelligence integration in the spec section of your TrustedProfileAnalyzer custom resource:

   spec:
     exploitIntelligence:
       enabled: true
       url: "https://<exploit_iq_client_route>"
       oidc:
         clientId: "<client_id>"
         clientSecret:
           valueFrom:
             secretKeyRef:
               name: <secret_name>
               key: <secret_key>
         issuerUrl: "https://<idp_host>/realms/<realm>"

   Copy code to clipboard

   <exploit_iq_client_route>

   The Exploit Intelligence client endpoint URL from step 1.

   <client_id>

   The OIDC client ID.

   <secret_name>

   The name of the Kubernetes Secret containing the client secret.

   <secret_key>

   The key within the secret that holds the client secret value.

   <idp_host>

   Your identity provider hostname.

   <realm>

   Your identity provider realm name. For AWS Cognito, use the pattern Content from cognito-idp.<region>.amazonaws.com is not included.https://cognito-idp.<region>.amazonaws.com/<user-pool-id> as the issuerUrl.

5. Apply the updated TrustedProfileAnalyzer resource:

   $ oc apply -f trustedprofileanalyzer.yaml

   Copy code to clipboard
6. In the RHTPA web UI, navigate to an SBOM details page and select the Vulnerabilities tab.

7. Click Request Analysis in the Exploit Intelligence column for a CVE.

   The status changes to In Progress while RHTPA submits the request to Exploit Intelligence.

8. When analysis completes, review the status:

   Vulnerable

   The CVE is exploitable in this SBOM context.

   Not vulnerable

   The vulnerable code path is not reachable.

   Uncertain

   Exploitability could not be determined with sufficient confidence.

   Click the report link next to the status to view full details in the Exploit Intelligence UI.

9. View the CSAF VEX document on the RHTPA advisories page. The document is labeled exploit-intelligence.

Verification

1. In the RHTPA web UI, open an SBOM details page and select the Vulnerabilities tab.
2. Verify that the Request Analysis button appears in the Exploit Intelligence column for CVEs.

3. Check the Exploit Intelligence service logs for successful API connections:

   $ oc logs -n <exploit_iq_namespace> deployment/exploit-iq-client --tail=50

   Copy code to clipboard

   where:

   <exploit_iq_namespace> is the OpenShift namespace where Exploit Intelligence is deployed (for example, exploit-iq).

   Confirm that log entries show analysis requests from RHTPA:

   INFO: Analysis request received from Red Hat Trusted Profile Analyzer: CVE-2024-1234 for component pkg:maven/org.example/vulnerable-lib@1.2.3
   INFO: Request queued for processing by Exploit Intelligence Engine

   Copy code to clipboard

Procedure

1. Open the Exploit Intelligence application, select Home from the left menu, click Request Analysis, and then select the SBOM option.

2. Enter the required fields:

   CVE ID

   CVE identifiers to assess (for example, CVE-2024-50602)

   SBOM file

   Upload your SBOM file by dragging and dropping or clicking Upload

   Note

   Supported formats: SPDX 2.3 (multi-component) or CycloneDX 1.6 (single-component).

   Accepted file type: JSON.

3. Optional: Enable the Private repository toggle if the source repository referenced in the SBOM metadata requires authentication.

4. Click Submit Analysis Request.

   The client-side throttling checks queue capacity. If the queue is full, your request queues until capacity is available. The Nginx gateway caches duplicate requests to improve performance.

   The engine runs code evaluation and generates exploitability verdicts and evidence. If you have enabled contextual CVSS, recalculation occurs.

5. Open the Exploit Intelligence web application and click on Reports to view the analysis report.

   Note

   If analysis shows a Failed status, this might indicate invalid input data. For example, when analyzing RPM packages, ensure that you use the correct N-V-R (Name-Version-Release) syntax.

Procedure

1. Open the Exploit Intelligence application, select Home from the left menu, click Request Analysis, and then select the Single Repository option.

2. Enter the required fields:

   CVE ID

   CVE identifiers to assess (for example, CVE-2024-50602)

   Source Repository

   Full Git repository URL (for example, Content from github.com is not included.https://github.com/org/repo)

   Commit ID

   Specific commit identifier for analysis snapshot (for example, v1.0.0 or full commit SHA f76b3537930637666e7be800008f69731ea642d)

3. Optional: Enable the Private repository toggle if analyzing a private repository that requires authentication.

4. Optional: Expand Advanced options to configure additional settings:

   Manifest path

   Path to the dependency manifest file (for example, services/api/go.mod)

   Programming language

   Select the primary programming language from the dropdown

5. Click Submit Analysis Request. The system validates repository accessibility and queues the analysis.

Verification

1. Navigate to the Reports page to view the analysis report.

   The report includes:

   Exploitability verdicts

   Classification for each CVE

   Evidence summaries

   Detailed reasoning

   Vulnerable component information

   Dependency tree location

   Justification categories

   Reasoning for non-exploitable classifications

   VEX output

   CSAF 2.0 document

Procedure

1. Open the Exploit Intelligence application, select Home from the left menu, click Request Analysis, and then select the RPM option.

2. Enter the required fields:

   CVE ID

   CVE identifiers to assess (for example, CVE-2024-50602)

   Package N-V-R

   Package name, version, and release in N-V-R format using hyphens as separators (for example, openssl-3.0.7-5.el9)

   Note

   Use hyphens between the package name, version, and release (N-V-R). The format is critical for proper analysis.

   Architecture

   Select the target architecture from the dropdown (for example, x86_64, aarch64, ppc64le, s390x)

3. Click Submit Analysis Request.

   The client-side throttling checks queue capacity. If the queue is full, your request queues until capacity is available. The Nginx gateway caches duplicate requests to improve performance.

   The engine runs code evaluation and generates exploitability verdicts and evidence. If you have enabled contextual CVSS, recalculation occurs.

4. Open the Exploit Intelligence web application and click on Reports to view the analysis report.

   Note

   If analysis shows a Failed status, verify the following:

   • The N-V-R format uses hyphens (not spaces or other separators)
   • The package name, version, and release match an existing RPM package
   • The architecture is appropriate for the package

Verification

1. Navigate to the Reports page to view analysis results.

2. Verify the report includes:

   Exploitability verdicts

   Classification for each CVE

   Evidence summaries

   Detailed reasoning

   Vulnerable component information

   RPM package details

   Justification categories

   Reasoning for non-exploitable classifications

   VEX output

   CSAF 2.0 document

Procedure

1. Log in to the Exploit Intelligence browser interface.
2. In the left navigation panel, click Reports.

3. Select the analysis type tab:

   SBOMs: View reports for Software Bill of Materials analysis

   Single Repositories: View reports for individual repository analysis

   RPM: View reports for RPM package analysis

   1. (Optional) Filter and search the reports:

      • Click the Repository Name dropdown to filter by repository
      • Use the search field to search by repository name
      • Use the pagination controls to navigate between pages

4. Review the analysis results table:

   The table displays the following information for each analysis:

   ID: Unique identifier for the analysis request

   Repository: Repository URL or name that was analyzed

   Commit ID: Git commit or branch that was analyzed

   CVE ID: CVE identifier associated with the finding

   Finding: Status badge showing the exploitability verdict:

   • Vulnerable (red badge): Exploitable vulnerability detected
   • Not vulnerable (green badge): Vulnerability confirmed as not exploitable

   • Failed (gray badge): Analysis could not complete

     Date Requested: Timestamp when the analysis was initiated

     Date Completed: Timestamp when the analysis finished

5. Click on an analysis ID to view the detailed report with:

   • CVE exploitability verdicts and justification categories
   • Detailed evidence explaining code reachability, function calls, and environmental factors
   • VEX Justification Status Labels bound to CVE lines
   • Custom text blocks detailing dependency paths and reasoning

6. Download artifacts from the detailed report:

   • VEX document (CSAF 2.0 JSON format)
   • Full analysis report (PDF or JSON)
   • Evidence checklist generated by LLM planner

Verification

1. Verify that the analysis report displays exploitability verdicts for all submitted CVEs.
2. Confirm that you can download the VEX document from the report page.