K&J Sensitive Data Discovery

Subscribe in AWS Marketplace and wait until the status is Active. Then run the container on a host with Docker.

Create a first-boot password (12 to 256 characters) on that host:

mkdir -p "$HOME/kj" chmod 700 "$HOME/kj" printf '%s\n' 'REPLACE-WITH-YOUR-PASSWORD' > "$HOME/kj/admin_password" chmod 444 "$HOME/kj/admin_password" mkdir -p "$HOME/kj/imports" "$HOME/kj/retention-imports" docker volume create kj-suite-data

Copy the docker run command below. Replace IMAGE with the container image URI on this version (tag 0.1.0).

docker run -d --name kj-suite --restart unless-stopped
--read-only --cap-drop ALL --security-opt no-new-privileges:true
--tmpfs /tmp:size=64m,mode=1777
-p 127.0.0.1:8080:8080
-v kj-suite-data:/data
-v "$HOME/kj/imports:/imports:ro"
-v "$HOME/kj/retention-imports:/retention-imports"
-v "$HOME/kj/admin_password:/run/secrets/admin_password:ro"
-e KJ_PRODUCT=suite
-e KJ_ADMIN_EMAIL=admin@localhost
-e KJ_ADMIN_PASSWORD_FILE=/run/secrets/admin_password
-e KJ_COOKIE_SECURE=false
-e KJ_ALLOW_RETENTION_WRITES=false
IMAGE

Check that it is up:

curl -s http://127.0.0.1:8080/readyz 

Open http://127.0.0.1:8080/  in a browser. Pick a workspace from the list, or go directly to:

http://127.0.0.1:8080/discovery/  http://127.0.0.1:8080/auditor/  http://127.0.0.1:8080/retention/  http://127.0.0.1:8080/classification/  http://127.0.0.1:8080/residency/ 

Sign in with email admin@localhost and the password from $HOME/kj/admin_password. Each workspace has its own users and sessions. Sign in again if you switch workspaces. Change the password in Settings after the first login.

This is one process with five separate data directories under /data. Discovery, Access Auditor, Retention, Classification, and Residency do not share databases, keys, or logins.

For a first Discovery scan, copy a small CSV, JSON, or JSONL file into $HOME/kj/imports. The file must be readable by container user 10001. In Discovery open Connected sources, connect a files source, and set path to the filename only (for example customers.jsonl). Use Test, then Run. Wait for completed in Job history, then open Classification findings.

Access Auditor accepts normalized events with event_id, a timestamp that includes a timezone, actor, and dataset. Use a JSONL file under imports or POST to /auditor/api/events.

Retention supports local JSONL under $HOME/kj/retention-imports and PostgreSQL. Leave KJ_ALLOW_RETENTION_WRITES=false until the source is backed up. Approval mode requires an administrator to type APPROVE.

Classification uses the same content sources as Discovery. It does not write labels back into source databases.

Residency compares observed or declared locations (region, account, environment) with a policy you configure. Missing location data needs review.

For a public hostname, put TLS on a reverse proxy (ALB or Caddy) in front of 127.0.0.1:8080, keep the workspace path prefixes, and recreate the container with KJ_COOKIE_SECURE=true.

Stop with docker stop kj-suite. Start with docker start kj-suite. docker rm -v kj-suite and docker volume rm kj-suite-data delete all five workspaces.

Do not publish port 8080 on 0.0.0.0 without TLS. Do not put the admin password in the image or in git. Do not run more than one replica on the same volume. Findings and alerts are for review, not a compliance certificate.

Website: https://kathyjasonconsult.com/  Contact: https://kathyjasonconsult.com/contact