EcomScan combines a host-resident Go agent with a tenant-isolated API and dashboard. It detects suspicious files and host conditions, records the evidence, and gives operators a place to investigate. Browser-side checkout monitoring is not part of the current product.
The Go agent walks the configured store path and combines pattern signatures, known hashes, heuristics, threat-intelligence matches, delta evidence, and optional YARA rules into normalized findings.
The agent evaluates files and optional platform data, then uploads a structured result.
The API stores findings, updates store risk, and creates alerts or incidents from qualifying results.
Operators review evidence, MITRE mappings, notes, status, priority, and generated runbook checklists.
Containment is performed through the operator's host controls, then documented and resolved in EcomScan.