Outbound communication
Communication destinations
This page lists destinations contacted by KestreLynx and the tools used for scanning and dependency updates. Communication depends on the enabled features and the work required in each cycle.
KEV downloads
| Sender | Destination | Information retrieved or sent | When |
|---|---|---|---|
| KestreLynx | www.cisa.gov by default |
Bulk download of the KEV feed | Triage is enabled and the feed needs to be downloaded or refreshed. |
Detected CVEs are matched locally; the list of detected CVEs is not sent to the download source.
See Configuration for the source, and Threat intelligence updates and Unavailable threat intelligence for updates and download failure handling.
EPSS downloads
| Sender | Destination | Information retrieved or sent | When |
|---|---|---|---|
| KestreLynx | epss.empiricalsecurity.com by default |
Bulk download of the EPSS feed | Triage is enabled and the feed needs to be downloaded or refreshed. |
Detected CVEs are matched locally; the list of detected CVEs is not sent to the download source.
See Configuration for the source, and Threat intelligence updates and Unavailable threat intelligence for updates and download failure handling.
Hacker News searches
| Sender | Destination | Information retrieved or sent | When |
|---|---|---|---|
| KestreLynx | hn.algolia.com |
Send CVE IDs classified as Act now by exploitation intelligence as search queries and retrieve discussion links | Triage and discussion links are enabled and an eligible CVE needs to be searched. |
See Configuration to enable searches. Notification delivery continues when searches are disabled.
Trivy downloads
| Sender | Destination | Information retrieved or sent | When |
|---|---|---|---|
| Trivy | Vulnerability database distribution registries | Download databases required for scanning | Databases need to be prepared for ordinary or comparison scans. |
| Trivy | Target image registries and distribution download destinations | Download images for scanning or comparison | Images required for scanning need to be downloaded from a registry. |
See Scan comparison conditions for comparison conditions.
GitHub communication
| Sender | Destination | Information retrieved or sent | When |
|---|---|---|---|
| KestreLynx | api.github.com |
Read mapped repositories, branches, and source files | Remediation planning checks sources. |
| KestreLynx | api.github.com |
Match existing PRs and past operation results | PR processing is enabled. |
| KestreLynx | api.github.com |
Create commits, branches, PRs, and replacement comments, and close eligible older PRs | PR processing is enabled and write conditions are met. |
PRs may contain image references and digests, workload names, repository names, source paths, and changes. They may also contain package names and versions, vulnerability IDs, comparison results, and processing reasons.
PRs that adopt re-resolution through dependent packages may also contain the names and before/after versions of direct dependencies updated along with the targets, and the ranges that required older versions. If an intermediate package declares such a range, its name is also included.
See PR management for management conditions and Enabling PR creation for workflows triggered by PRs.
Image candidate downloads
| Sender | Destination | Information retrieved or sent | When |
|---|---|---|---|
| KestreLynx | Public image registries or registries with configured authentication | Retrieve tag lists, manifests, configs, and other information used to verify image identity | Looking for published-image or base-image candidates. |
See Image registry authentication for authentication settings and Image candidate selection for candidate discovery.
Work image downloads
| Sender | Destination | Information retrieved or sent | When |
|---|---|---|---|
| Docker | Docker Hub or the configured mirror | Download official Node.js and Python work images | An image required for a language-package update is not available locally. |
See Work image source for mirror settings and Pinning official images for pinning and handling unavailable images.
Tool downloads
| Sender | Destination | Information retrieved or sent | When |
|---|---|---|---|
| KestreLynx | registry.npmjs.org |
Retrieve npm and pnpm version information and distributions | Tool version information needs to be checked or distributions downloaded. |
| KestreLynx | pypi.org and files.pythonhosted.org |
Retrieve uv version information and distributions | Tool version information needs to be checked or distributions downloaded. |
Tool download requests and redirects are restricted to HTTPS on the hosts in this table.
See Tool downloads and verification for retrieval and verification, and Tool cache reuse for reuse.
Dependency downloads
| Sender | Destination | Information retrieved or sent | When |
|---|---|---|---|
| KestreLynx | registry.npmjs.org |
Retrieve dependency versions, dependency relationships, and other metadata | Checking Node.js compatibility requirements or update results. |
| KestreLynx | pypi.org and files.pythonhosted.org |
Retrieve Python package metadata and distributions | Checking Python update results. |
| KestreLynx | registry.npmjs.org |
Retrieve dependency declarations and publication times using package names and versions | Checking which dependent packages require older versions or whether 72 hours have elapsed since publication during npm or pnpm re-resolution through dependent packages. |
| KestreLynx | pypi.org |
Retrieve dependency declarations and distribution upload times using package names and versions | Checking which dependent packages require older versions or whether 72 hours have elapsed since publication during uv re-resolution through dependent packages. |
| Work container | Public npm registry, PyPI, and distribution download destinations | Retrieve metadata and distributions for dependency resolution, lockfile generation, and checks | Running language-package dependency updates. |
See Update processing by package manager for update processing.
Re-resolution through dependent packages also looks up intermediate dependent packages and versions newly introduced by re-resolution, in addition to the update targets. See Re-resolution support and limits for limits on lookups and received data.
Notification delivery
| Sender | Destination | Information retrieved or sent | When |
|---|---|---|---|
| KestreLynx | Configured Slack and generic webhook destinations | Send findings, plans, reasons, PR links, and operation results | The delivery conditions for each notification are met. |
Notifications may contain image references and digests, workload names, repository names, and source paths. They may also contain package names and versions, vulnerability IDs, and comparison results, so configure destinations according to the information you can share.
Notifications about re-resolution through dependent packages may also contain the dependent packages updated along with the targets, results that do not reach fixed versions, and information about skipped attempts or waiting periods. Webhooks may also contain required version ranges, change lists, processing usage, and the earliest retry time.
For carried vulnerabilities, webhooks may also contain package names, versions before and after the change, vulnerability IDs, position counts, and KEV listing information. Results rejected by position checks may also contain package names, versions, dependent package names, refusal types, and vulnerability IDs.
See Notification conditions for delivery conditions and Webhook field reference for JSON contents.
Credential destinations
| Credentials or communication | Destinations and restrictions |
|---|---|
| GitHub token | Sent only to api.github.com over HTTPS; redirects to other hosts are rejected. |
| Image registry credentials | Sent over HTTPS only to the configured registry and token services on the same host or allowed by token_hosts. |
| KestreLynx image-registry requests | Credentials are not forwarded to redirect destinations. |
| Trivy image-registry requests | Credentials may be included in redirects within the same host, but are not forwarded to other hosts. |
| Work container inputs | GitHub tokens and image registry credentials are not passed to work containers. |
Registries without configured authentication are accessed anonymously.
See GitHub access and Image registry authentication for configuration formats.
Work container network
Work containers use Docker bridge networking. Destinations are not restricted by a network allowlist.
See Runtime restrictions for restrictions other than networking.