Digital Europe Programme (DEP) · FETTA
Reference: 101128030
The April 2026 Plum announcement attributes development support to FETTA. This applies to the perimeter monitoring project and does not assign it the older D4 grant.
Exposure discovery CSIRT-led
Plum Island
Schedule distributed perimeter scans, retain observations over time and search changes in exposed services and technical metadata.
By CIRCL and project contributors · Luxembourg
CSIRT-led
Primary sources connect this project to an EU CSIRT as developer or lead.
At a glance
Recorded facts- Response workflow
- Exposure discovery
- Developer or maintainer
- CIRCL and project contributors
- Recorded country
- Luxembourg
- Product model
- Open source
- Deployment
- Self-hosted
- Software license
- AGPL-3.0
- Upstream status
- Experimental
- Evidence class
- CSIRT-led
What the sources establish
Origin noteThe CIRCL-led D4 project describes Plum as its project for monitoring Luxembourg’s perimeter and explains its development within FETTA.
Reported capabilities
- Orchestrates scan jobs across agents and target profiles.
- Searches retained observations and exports reports or CSV/JSON results.
Scope and limits
The upstream README labels it beta. It orchestrates discovery and exposure monitoring; it is not a standalone vulnerability-verdict engine.
Inspect the research evidence 5 source observations
identity / capabilities / deployment
Upstream documentation describes schedule distributed perimeter scans, retain observations over time and search changes in exposed services and technical metadata. It documents local installation.
Read sourceorigin / country
The CIRCL-led D4 project describes Plum as its project for monitoring Luxembourg’s perimeter and explains its development within FETTA.
Read sourcelicense
The upstream license file specifies AGPL-3.0.
Read sourcemaintenance
Repository is not archived; its last recorded push was 2026-10-08. This is an activity signal, not a support guarantee.
Read sourcemaintenance
The upstream README explicitly describes the software as beta or experimental.
Read source
This profile summarizes source material. It does not include hands-on security testing, procurement review, or an assessment of fit for your environment.
Capabilities & integrations
Tags record specific documented functions. They do not establish end-to-end interoperability; check the component, edition and version in the source.
No structured capability or integration evidence has been added for this tool in the current pass. This does not establish that a feature is unsupported. Send a documentation link.
Documented EU funding
Funding can be historical or component-specific. It does not imply EU certification, current funding or endorsement. Explore the funding collection.
Put the tool in context.
Scope exposure discovery, validate vulnerability findings, prioritize affected assets and verify remediation. Practical guidance with documented European tools.
From vulnerability finding to verified remediation