-
Notifications
You must be signed in to change notification settings - Fork 584
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
bb820d8
commit 96da75a
Showing
70 changed files
with
1,137 additions
and
1,219 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -4,25 +4,21 @@ | |
| [](https://github.com/deepfence/ThreatMapper/stargazers) | ||
| [](https://github.com/deepfence/ThreatMapper/issues) | ||
| [](https://github.com/deepfence/ThreatMapper/issues) | ||
| [](https://community.deepfence.io/threatmapper/docs/v3.0/) | ||
| [](https://community.deepfence.io/threatmapper/docs/v3.0/demo) | ||
| [](https://community.deepfence.io/threatmapper/docs/v2.5/) | ||
| [](https://community.deepfence.io/threatmapper/docs/v2.5/demo) | ||
| [](https://hub.docker.com/r/deepfenceio/deepfence_agent_ce) | ||
| [](https://join.slack.com/t/deepfence-community/shared_invite/zt-podmzle9-5X~qYx8wMaLt9bGWwkSdgQ) | ||
| [](https://twitter.com/intent/tweet?text=Wow:&url=https%3A%2F%2Fgithub.com%2Fdeepfence%2FThreatMapper) | ||
|
|
||
| ## :tada: Announcing ThreatMapper v2 | ||
|
|
||
| _ThreatMapper versions v1.x are depreciated. Please upgrade to the latest version._ | ||
|
|
||
| # ThreatMapper - Runtime Threat Management and Attack Path Enumeration for Cloud Native | ||
|
|
||
| Deepfence ThreatMapper hunts for threats in your production platforms, and ranks these threats based on their risk-of-exploit. It uncovers vulnerable software components, exposed secrets and deviations from good security practice. ThreatMapper uses a combination of agent-based inspection and agent-less monitoring to provide the widest possible coverage to detect threats. | ||
|
|
||
| With ThreatMapper's **ThreatGraph** visualization, you can then identify the issues that present the greatest risk to the security of your applications, and prioritize these for planned protection or remediation. | ||
|
|
||
| * [Learn more about ThreatMapper](https://community.deepfence.io/threatmapper/docs/v3.0/) in the product documentation. | ||
| * [Learn more about ThreatMapper](https://community.deepfence.io/threatmapper/docs/v2.5/) in the product documentation. | ||
|
|
||
| * [See ThreatMapper running](https://community.deepfence.io/threatmapper/docs/v3.0/demo) in the live demo sandbox. | ||
| * [See ThreatMapper running](https://community.deepfence.io/threatmapper/docs/v2.5/demo) in the live demo sandbox. | ||
|
|
||
| ## When to use ThreatMapper | ||
|
|
||
|
|
@@ -45,34 +41,34 @@ ThreatMapper consists of two components: | |
|
|
||
| ### The Management Console | ||
|
|
||
| You [deploy the Management Console first](https://community.deepfence.io/threatmapper/docs/v3.0/console/), on a suitable docker host or Kubernetes cluster. For example, on Docker: | ||
| You [deploy the Management Console first](https://community.deepfence.io/threatmapper/docs/v2.5/console/), on a suitable docker host or Kubernetes cluster. For example, on Docker: | ||
|
|
||
| ```shell script | ||
| # Docker installation process for ThreatMapper Management Console | ||
|
|
||
| wget https://github.com/deepfence/ThreatMapper/raw/release-3.0/deployment-scripts/docker-compose.yml | ||
| wget https://github.com/deepfence/ThreatMapper/raw/release-2.5/deployment-scripts/docker-compose.yml | ||
| docker-compose -f docker-compose.yml up --detach | ||
| ``` | ||
|
|
||
| Once the Management Console is up and running, you can [register an admin account and obtain an API key](https://community.deepfence.io/threatmapper/docs/v3.0/console/initial-configuration). | ||
| Once the Management Console is up and running, you can [register an admin account and obtain an API key](https://community.deepfence.io/threatmapper/docs/v2.5/console/initial-configuration). | ||
|
|
||
| ### Cloud Scanner tasks | ||
|
|
||
| ThreatMapper [Cloud Scanner tasks](https://community.deepfence.io/threatmapper/docs/v3.0/cloudscanner/) are responsible for querying the cloud provider APIs to gather configuration and identify deviations from compliance benchmarks. | ||
| ThreatMapper [Cloud Scanner tasks](https://community.deepfence.io/threatmapper/docs/v2.5/cloudscanner/) are responsible for querying the cloud provider APIs to gather configuration and identify deviations from compliance benchmarks. | ||
|
|
||
| The task is deployed using a Terraform module. The ThreatMapper Management Console will present a basic configuration that may be deployed with Terraform, or you can refer to the expert configurations to fine-tune the deployment ([AWS](https://community.deepfence.io/threatmapper/docs/cloudscanner/aws), [Azure](https://community.deepfence.io/threatmapper/docs/cloudscanner/azure), [GCP](https://community.deepfence.io/threatmapper/docs/cloudscanner/gcp)). | ||
|
|
||
| ### Sensor Agents | ||
|
|
||
| Install the [sensor agents](https://community.deepfence.io/threatmapper/docs/v3.0/sensors/) on your production or development platforms. The sensors report to the Management Console; they tell it what services they discover, provide telemetry and generate manifests of software dependencies. | ||
| Install the [sensor agents](https://community.deepfence.io/threatmapper/docs/v2.5/sensors/) on your production or development platforms. The sensors report to the Management Console; they tell it what services they discover, provide telemetry and generate manifests of software dependencies. | ||
|
|
||
| The following production platforms are supported by ThreatMapper sensor agents: | ||
|
|
||
| * [Kubernetes](https://community.deepfence.io/threatmapper/docs/v3.0/sensors/kubernetes/): ThreatMapper sensors are deployed as a daemonset in the Kubernetes cluster, using a helm chart. | ||
| * [Docker](https://community.deepfence.io/threatmapper/docs/v3.0/sensors/docker/): ThreatMapper sensors are deployed as a lightweight container. | ||
| * [Amazon ECS](https://community.deepfence.io/threatmapper/docs/v3.0/sensors/aws-ecs): ThreatMapper sensors are deployed as a daemon service using a task definition. | ||
| * [AWS Fargate](https://community.deepfence.io/threatmapper/docs/v3.0/sensors/aws-fargate): ThreatMapper sensors are deployed as a sidecar container, using a task definition. | ||
| * [Bare-Metal or Virtual Machines](https://community.deepfence.io/threatmapper/docs/v3.0/sensors/linux-host/): ThreatMapper sensors are deployed within a lightweight Docker runtime. | ||
| * [Kubernetes](https://community.deepfence.io/threatmapper/docs/v2.5/sensors/kubernetes/): ThreatMapper sensors are deployed as a daemonset in the Kubernetes cluster, using a helm chart. | ||
| * [Docker](https://community.deepfence.io/threatmapper/docs/v2.5/sensors/docker/): ThreatMapper sensors are deployed as a lightweight container. | ||
| * [Amazon ECS](https://community.deepfence.io/threatmapper/docs/v2.5/sensors/aws-ecs): ThreatMapper sensors are deployed as a daemon service using a task definition. | ||
| * [AWS Fargate](https://community.deepfence.io/threatmapper/docs/v2.5/sensors/aws-fargate): ThreatMapper sensors are deployed as a sidecar container, using a task definition. | ||
| * [Bare-Metal or Virtual Machines](https://community.deepfence.io/threatmapper/docs/v2.5/sensors/linux-host/): ThreatMapper sensors are deployed within a lightweight Docker runtime. | ||
|
|
||
| For example, run the following command to start the ThreatMapper sensor on a Docker host: | ||
|
|
||
|
|
@@ -97,16 +93,16 @@ docker run -dit \ | |
| -e http_proxy="" \ | ||
| -e https_proxy="" \ | ||
| -e no_proxy="" \ | ||
| quay.io/deepfenceio/deepfence_agent_ce:3.0.0 | ||
| quay.io/deepfenceio/deepfence_agent_ce:2.5.0 | ||
| ``` | ||
|
|
||
| Note: Image tag `quay.io/deepfenceio/deepfence_agent_ce:3.0.0-multiarch` is supported in amd64 and arm64/v8 architectures. | ||
| Note: Image tag `quay.io/deepfenceio/deepfence_agent_ce:2.5.0-multiarch` is supported in amd64 and arm64/v8 architectures. | ||
|
|
||
| On a Kubernetes platform, the sensors are installed using [helm chart](https://community.deepfence.io/threatmapper/docs/v3.0/sensors/kubernetes/) | ||
| On a Kubernetes platform, the sensors are installed using [helm chart](https://community.deepfence.io/threatmapper/docs/v2.5/sensors/kubernetes/) | ||
|
|
||
| ### Next Steps | ||
|
|
||
| Visit the [Deepfence ThreatMapper Documentation](https://community.deepfence.io/threatmapper/docs/v3.0/), to learn how to get started and how to use ThreatMapper. | ||
| Visit the [Deepfence ThreatMapper Documentation](https://community.deepfence.io/threatmapper/docs/v2.5/), to learn how to get started and how to use ThreatMapper. | ||
|
|
||
|
|
||
| # Get in touch | ||
|
|
@@ -116,7 +112,7 @@ Thank you for using ThreatMapper. Please feel welcome to participate in the [Th | |
| * [Deepfence Community Website](https://community.deepfence.io) | ||
| * [<img src="https://img.shields.io/badge/[email protected]?logo=slack">](https://join.slack.com/t/deepfence-community/shared_invite/zt-podmzle9-5X~qYx8wMaLt9bGWwkSdgQ) Got a question, need some help? Find the Deepfence team on Slack | ||
| * [](https://github.com/deepfence/ThreatMapper/issues) Got a feature request or found a bug? Raise an issue | ||
| * [](https://community.deepfence.io/threatmapper/docs/v3.0/) Read the documentation in the [Deepfence ThreatMapper Documentation](https://community.deepfence.io/threatmapper/docs/v3.0/) | ||
| * [](https://community.deepfence.io/threatmapper/docs/v2.5/) Read the documentation in the [Deepfence ThreatMapper Documentation](https://community.deepfence.io/threatmapper/docs/v2.5/) | ||
| * [productsecurity at deepfence dot io](SECURITY.md): Found a security issue? Share it in confidence | ||
| * Find out more at [deepfence.io](https://deepfence.io/) | ||
|
|
||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Submodule SecretScanner
updated
17 files
| +3 −3 | Dockerfile | |
| +2 −2 | Makefile | |
| +34 −6 | README.md | |
| +1 −1 | agent-plugins-grpc | |
| +12 −1 | core/options.go | |
| +1 −16 | docs/docs/secretscanner/configure/cli.md | |
| +3 −1 | docs/docs/secretscanner/configure/output.md | |
| +1 −1 | docs/docs/secretscanner/img/secretscanner.svg | |
| +27 −3 | docs/docs/secretscanner/quickstart.md | |
| +3 −3 | docs/docs/secretscanner/using/build.md | |
| +0 −56 | docs/docs/secretscanner/using/grpc.md | |
| +6 −2 | docs/docs/secretscanner/using/scan.md | |
| +6 −6 | docs/docs/secretscanner/using/standalone.md | |
| +1 −2 | docs/sidebars.js | |
| +38 −36 | go.mod | |
| +90 −78 | go.sum | |
| +77 −1 | main.go |
Submodule YaraHunter
updated
22 files
| +8 −12 | Dockerfile | |
| +2 −2 | Makefile | |
| +31 −2 | README.md | |
| +1 −1 | agent-plugins-grpc | |
| +2 −2 | docs/docs/yarahunter/configure/cli.md | |
| +4 −2 | docs/docs/yarahunter/configure/output.md | |
| +3 −1 | docs/docs/yarahunter/configure/rules.md | |
| +1 −1 | docs/docs/yarahunter/img/yarahunter.svg | |
| +23 −1 | docs/docs/yarahunter/index.md | |
| +14 −3 | docs/docs/yarahunter/quickstart.md | |
| +3 −3 | docs/docs/yarahunter/using/build.md | |
| +1 −1 | docs/docs/yarahunter/using/grpc.md | |
| +9 −3 | docs/docs/yarahunter/using/scan.md | |
| +38 −35 | go.mod | |
| +89 −72 | go.sum | |
| +79 −0 | main.go | |
| +14 −0 | pkg/config/options.go | |
| +38 −0 | pkg/threatintel/feeds.go | |
| +61 −0 | pkg/threatintel/listing.go | |
| +79 −0 | pkg/threatintel/threatintel.go | |
| +137 −0 | pkg/threatintel/utils.go | |
| +8 −0 | utils/utils.go |
Submodule cloud-scanner
updated
15 files
Submodule compliance
updated
4 files
| +5 −5 | .github/workflows/golang-linter.yaml | |
| +2 −2 | Dockerfile | |
| +15 −15 | go.mod | |
| +40 −38 | go.sum |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.