Security
ThreatMapper versions v1.x are depreciated. Please upgrade to the latest version.
Deepfence ThreatMapper hunts for threats in your production platforms, and ranks these threats based on their risk-of-exploit. It uncovers vulnerable software components, exposed secrets and deviations from good security practice. ThreatMapper uses a combination of agent-based inspection and agent-less monitoring to provide the widest possible coverage to detect threats.
With ThreatMapper's ThreatGraph visualization, you can then identify the issues that present the greatest risk to the security of your applications, and prioritize these for planned protection or remediation.
Learn more about ThreatMapper in the product documentation.
See ThreatMapper running in the live demo sandbox.
ThreatMapper carries on the good 'shift left' security practices that you already employ in your development pipelines. It continues to monitor running applications against emerging software vulnerabilities, and monitors the host and cloud configuration against industry-expert benchmarks.
Use ThreatMapper to provide security observability for your production workloads and infrastructure, across cloud, kubernetes, serverless (Fargate) and on-prem platforms.
ThreatMapper consists of two components:
You deploy the Management Console first, on a suitable docker host or Kubernetes cluster. For example, on Docker:
# Docker installation process for ThreatMapper Management Console
wget https://github.com/deepfence/ThreatMapper/raw/release-2.3/deployment-scripts/docker-compose.yml
docker-compose -f docker-compose.yml up --detach
Once the Management Console is up and running, you can register an admin account and obtain an API key.
ThreatMapper Cloud Scanner tasks are responsible for querying the cloud provider APIs to gather configuration and identify deviations from compliance benchmarks.
The task is deployed using a Terraform module. The ThreatMapper Management Console will present a basic configuration that may be deployed with Terraform, or you can refer to the expert configurations to fine-tune the deployment (AWS, Azure, GCP).
Install the sensor agents on your production or development platforms. The sensors report to the Management Console; they tell it what services they discover, provide telemetry and generate manifests of software dependencies.
The following production platforms are supported by ThreatMapper sensor agents:
For example, run the following command to start the ThreatMapper sensor on a Docker host:
docker run -dit \
--cpus=".2" \
--name=deepfence-agent \
--restart on-failure \
--pid=host \
--net=host \
--log-driver json-file \
--log-opt max-size=50m \
--privileged=true \
-v /sys/kernel/debug:/sys/kernel/debug:rw \
-v /var/log/fenced \
-v /var/run/docker.sock:/var/run/docker.sock \
-v /:/fenced/mnt/host/:ro \
-e USER_DEFINED_TAGS="" \
-e MGMT_CONSOLE_URL="---CONSOLE-IP---" \
-e MGMT_CONSOLE_PORT="443" \
-e DEEPFENCE_KEY="---DEEPFENCE-API-KEY---" \
quay.io/deepfenceio/deepfence_agent_ce:2.3.0
Note: Image tag quay.io/deepfenceio/deepfence_agent_ce:2.3.0-multiarch
is supported in amd64 and arm64/v8 architectures.
On a Kubernetes platform, the sensors are installed using helm chart
Visit the Deepfence ThreatMapper Documentation, to learn how to get started and how to use ThreatMapper.
Thank you for using ThreatMapper. Please feel welcome to participate in the ThreatMapper Community.
ThreatStryker is the enterprise version of ThreatMapper, with additional features for enterprise security teams. ThreatStryker is available as a cloud service or for on-premises deployment.
For any security-related issues in the ThreatMapper project, contact productsecurity at deepfence dot io.
Please file GitHub issues as needed, and join the Deepfence Community Slack channel.
The Deepfence ThreatMapper project (this repository) is offered under the Apache2 license.
Contributions to Deepfence ThreatMapper project are similarly accepted under the Apache2 license, as per GitHub's inbound=outbound policy.