-
Notifications
You must be signed in to change notification settings - Fork 585
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
197b847
commit 3d7f2d8
Showing
329 changed files
with
11,235 additions
and
997 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
40 changes: 40 additions & 0 deletions
40
docs/versioned_docs/version-v2.3/architecture/cloudscanner.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| --- | ||
| title: Cloud Scanner task | ||
| --- | ||
|
|
||
| # Cloud Scanner Overview | ||
|
|
||
| ThreatMapper performs Compliance Posture Scanning to: | ||
|
|
||
| * Build an inventory of cloud assets, such as network security groups, storage objects, key management services. The types of assets discovered are specific to each cloud platform. | ||
| * Perform 'posture scanning', where ThreatMapper matches infrastructure configuration against a set of best-practice benchmarks, such as CIS, PCI-DSS and HIPAA. The benchmarks that are supported are specific to each cloud platform. | ||
|
|
||
| ThreatMapper then summarises the results in a 'Threat Graph' visualization, to help you to prioritize compliance issues that pose the greatest risk of exploit. | ||
|
|
||
| ## Implementation | ||
|
|
||
| * Compliance Posture Scanning for **Clouds** requires access (typically read-only) to the cloud platform APIs, and uses the Cloud Scanner task | ||
| * Compliance Posture Scanning for **Hosts** requires direct access to the host, and uses the Sensor Agent. | ||
|
|
||
| ### Compliance Posture Scanning for Clouds | ||
|
|
||
| The ThreatMapper Console does not access the cloud platform APIs directly; there is no need to open the APIs up for remote access. Instead, you deploy a 'Cloud Scanner' task which acts as a local relay, taking instructions from the remote ThreatMapper console and performing local API calls from within your cloud infrastructure. | ||
|
|
||
| Each Cloud Scanner task runs in your cloud environment, gathering inventory and compliance information for the assets deployed in that environment. It submits that information to your ThreatMapper console. You can deploy as many Cloud Scanner tasks as are required by your security policy and any restrictions in place that affect API access. | ||
|
|
||
| Cloud Scanner tasks are deployed using the appropriate Terraform module for each cloud, and are configured with the address and API key of your management console. They 'phone home' to your management console and take instructions on demand; they do not listen for remote connections or control. | ||
|
|
||
| :::info | ||
| Refer to the Installation Documentation to [Learn how to install Cloud Scanner tasks](/docs/cloudscanner) | ||
| ::: | ||
|
|
||
|
|
||
| ### Compliance Posture Scanning for Hosts | ||
|
|
||
| ThreatMapper can perform compliance posture scanning on linux hosts and Kubernetes master and worker nodes. | ||
|
|
||
| Scanning is done directly, using a local [Sensor Agent](sensors) rather than by using the Cloud Scanner task employed by the cloud platform integrations. | ||
|
|
||
|
|
||
|
|
||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,38 @@ | ||
| --- | ||
| title: Management Console | ||
| --- | ||
|
|
||
| # The ThreatMapper Management Console | ||
|
|
||
| The ThreatMapper Management Console ("Console") is a standalone application, implemented as a fleet of containers. It should be deployed on either a single docker host, or (for larger deployments) a dedicated Kubernetes cluster. The console is self-contained, and exposes an HTTPS interface for administration and API automation. | ||
|
|
||
| The console allows you to: | ||
|
|
||
| * Manage the users who can access the console. | ||
| * Configure Infrastructure API access and interrogate platform configurations. | ||
| * Visualize and drill down into Kubernetes clusters, virtual machines, containers and images, running processes, and network connections in near real time. | ||
| * Invoke vulnerability scans on running containers and applications and review the results, ranked by risk-of-exploit. | ||
| * Invoke compliance scans on infrastructure configuration ('agentless') and on infrastructure hosts ('agent-based'), manually or automatically when they are added to a cluster. | ||
| * Scan container registries for vulnerabilities, to review workloads before they are deployed. | ||
| * Scan image builds during the CI/CD pipeline, supporting CircleCI, Jenkins, and GitLab. | ||
| * Scan containers and host filesystems for unprotected secrets, including access tokens, keys and passwords. | ||
| * Configure integrations with external notification, SIEM and ticketing systems, including Slack, PagerDuty, Jira, Splunk, ELK, Sumo Logic, and AWS S3. | ||
| ThreatMapper supports multiple production deployments simultaneously, so that you can visualize and scan workloads across a large production estate. | ||
|
|
||
| ### ThreatMapper Compliance Posture Scanning | ||
|
|
||
| ThreatMapper performs compliance posture scanning for cloud platforms by querying the infrastructure APIs for these platforms. | ||
|
|
||
| This is achieved using a **cloud scanner** task that is deployed within each cloud instance using a terraform module. The cloud scanner is granted appropriate access to the local APIs, and operates under instruction from the remote ThreatMapper console. | ||
|
|
||
| ### ThreatMapper Registry Scanning | ||
|
|
||
| The ThreatMapper console can scan container images at rest in a wide range of supported registries. | ||
|
|
||
| This is achieved by providing appropriate credentials to the ThreatMapper console so that it can discover and download assets directly from these registries. | ||
|
|
||
| ### ThreatMapper Vulnerability, Secret and Local Compliance Scanning | ||
|
|
||
| ThreatMapper performs vulnerability and secret scanning directly on production and non-production hosts using a **sensor agent** container. | ||
|
|
||
| The sensor agent is also used for local compliance scanning (Kubernetes and Linux posture) where it has access to configuration and assets that are not exposed through an API. |
Oops, something went wrong.