SupportConsoleDevelopersStart a trialContact

Chapter 13. System components

Exploit Intelligence consists of interconnected components that work together to deliver AI-driven vulnerability analysis. Each component has a specific role in the analysis workflow, from accepting analysis requests to orchestrating LLM-based reasoning and delivering actionable reports.

The Exploit Intelligence system follows a distributed architecture where components are deployed as Kubernetes workloads and communicate through REST APIs and event-driven mechanisms.

Core components, Exploit Intelligence Operator
Kubernetes operator that provides declarative management of the entire Exploit Intelligence stack through the ExploitIQStack custom resource. Manages lifecycle and synchronization of all components.
Exploit Intelligence Client
User-facing component that provides the web UI and handles analysis input. Accepts CycloneDX SBOMs and CVE lists, manages request queuing, displays analysis reports, and stores results in MongoDB. Built with Java (Quarkus) back end and React front end.
Exploit Intelligence Engine
Core analysis back end that orchestrates vulnerability analysis by using NVIDIA NeMo Agent Toolkit. Correlates SBOM data with source code context and CVE intelligence, manages LLM prompting, and exposes REST API endpoints. Includes Nginx caching layer for improved performance.

13.1. Exploit Intelligence Engine
Copy link

Core analysis backend built using NVIDIA NeMo Agent Toolkit. Orchestrates vulnerability analysis by correlating SBOM data with source code context and CVE intelligence.

Analysis Orchestration
Receives analysis requests and prompts the LLM
Caching
Nginx proxy server caches API requests to reduce duplicates and improve workflow speed
API
Exposes endpoints for client consumption

13.2. Exploit Intelligence Client
Copy link

User-facing web application that provides the Exploit Intelligence dashboard interface and manages analysis requests.

Technology
Java (Quarkus) back end + React (Quinoa Quarkus extension) front end
Request Analysis
Accepts CycloneDX SBOMs and CVE lists
Git Snapshots
Users can manually supply GitHub repository and commit ID
Reporting
Displays reports with justification labels, reasoning, and checklists
Feedback Loop
Integrates with Argilla for data labeling and model feedback
Queue Management
Configurable pool for concurrent requests to avoid overloading engine and LLM
Persistence
Stores reports and analysis history in a customer-provided MongoDB database (see database requirements)
Configuration
Integrated with Red Hat OpenShift Container Platform OAuth for authentication

13.3. ComponentSyncer
Copy link

Specialized component for processing product scanning events.

Technology
Python
Workflow
  1. Triggered by Knative event
  2. Checks Git commit SHA against stored state in S3
  3. Clones/Updates repository
  4. Serializes processed documents to storage

13.4. Exploit Intelligence Operator
Copy link

Provides declarative management of the stack through ExploitIQStack custom resource.

  • Creates and synchronizes Kubernetes resources for entire stack (Engine, Client, Database, Cache, MinIO, Syncer)
  • Manages lifecycle of all components
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Legal Notice

Theme

© 2026 Red HatBack to top