[opensourcedex]

ThreatMapper is a free, open source compliance & risk management project written in TypeScript and released under Apache-2.0. It has 5,321 GitHub stars, 631 forks and 144 open issues, and was last pushed 4 months ago. On this registry it ranks #17 of 45 tracked projects in Compliance & Risk Management, with 5 head-to-head comparisons available.

What is ThreatMapper?

What it is

ThreatMapper is an open-source Cloud Native Application Protection Platform for runtime threat management and attack path enumeration. It operates in the cloud-native security ecosystem and targets containers, Kubernetes, serverless platforms, cloud infrastructure, and on-premises workloads. The project is Apache-2.0 licensed and written in TypeScript.

ThreatMapper addresses the difficulty of finding, ranking, and prioritizing security risks across running cloud-native systems. It uncovers vulnerable software components, exposed secrets, and deviations from good security practice, then ranks threats by risk of exploitation. It combines agent-based inspection and agentless monitoring, and its ThreatGraph visualization helps operators prioritize remediation.

Key capabilities

  • It detects vulnerable software components, exposed secrets, and security configuration deviations in cloud-native environments.
  • It ranks discovered threats by risk of exploitation, helping teams prioritize remediation.
  • It provides runtime threat management and attack path enumeration through ThreatGraph visualization.
  • It uses Sensor Agents for agent-based inspection and Cloud Scanner tasks for agentless monitoring.
  • It queries cloud provider APIs to gather configuration data and identify compliance benchmark deviations.
  • It monitors host and cloud configuration against industry-expert benchmarks and tracks emerging software vulnerabilities.
  • It supports container registry scanning, Kubernetes workloads, cloud security posture management, and workload protection.

Who uses it and how

  • Security and DevOps teams use ThreatMapper for security observability across cloud, Kubernetes, serverless, and on-premises platforms.
  • Operators deploy the Management Console first, register an admin account, and obtain an API key.
  • Teams use Cloud Scanner tasks to inspect cloud provider configuration through Terraform deployments for AWS, Azure, and Google Cloud.
  • Platform teams install Sensor Agents on production or development systems to report discovered services, telemetry, and software dependency manifests.
  • Organizations following shift-left security practices use ThreatMapper to monitor running applications and infrastructure.

Getting started

The typical installation path deploys the ThreatMapper Management Console on a Docker host or Kubernetes cluster using the provided Docker Compose file. Administrators then register an account, obtain an API key, deploy Cloud Scanner tasks with Terraform, and install Sensor Agents.

When to use it — and when not to

ThreatMapper suits teams that want an Apache-2.0 licensed CNAPP and can operate a self-hosted console, Terraform-based scanners, and agents. It is less suitable for users who need a hosted option, because no hosted option is listed. The repository lists 144 open issues and no contributor count, so operators should assess maintenance capacity before adoption.

project readme (upstream, from github) — read inline

Deepfence Logo

GitHub license GitHub stars GitHub issues Documentation Slack

deepfence%2FThreatMapper | Trendshift

ThreatMapper - Runtime Threat Management and Attack Path Enumeration for Cloud Native

[!NOTE] This project is maintained by https://threatmapper.org

Deepfence ThreatMapper hunts for threats in your production platforms, and ranks these threats based on their risk-of-exploit. It uncovers vulnerable software components, exposed secrets and deviations from good security practice. ThreatMapper uses a combination of agent-based inspection and agent-less monitoring to provide the widest possible coverage to detect threats.

With ThreatMapper's ThreatGraph visualization, you can then identify the issues that present the greatest risk to the security of your applications, and prioritize these for planned protection or remediation.

When to use ThreatMapper

ThreatMapper carries on the good 'shift left' security practices that you already employ in your development pipelines. It continues to monitor running applications against emerging software vulnerabilities, and monitors the host and cloud configuration against industry-expert benchmarks.

Use ThreatMapper to provide security observability for your production workloads and infrastructure, across cloud, kubernetes, serverless (Fargate) and on-prem platforms.

Planning your Deployment

ThreatMapper consists of two components:

  • The ThreatMapper Management Console is a container-based application that can be deployed on a single docker host or in a Kubernetes cluster.
  • ThreatMapper monitors running infrastructure using agentless Cloud Scanner tasks and agent-based Sensor Agents

The Management Console

You deploy the Management Console first, on a suitable docker host or Kubernetes cluster. For example, on Docker:

# Docker installation process for ThreatMapper Management Console

wget https://github.com/deepfence/ThreatMapper/raw/release-2.5/deployment-scripts/docker-compose.yml
docker-compose -f docker-compose.yml up --detach

Once the Management Console is up and running, you can register an admin account and obtain an API key.

Cloud Scanner tasks

ThreatMapper Cloud Scanner tasks are responsible for querying the cloud provider APIs to gather configuration and identify deviations from compliance benchmarks.

The task is deployed using a Terraform module. The ThreatMapper Management Console will present a basic configuration that may be deployed with Terraform, or you can refer to the expert configurations to fine-tune the deployment (AWS, Azure, GCP).

Sensor Agents

Install the sensor agents on your production or development platforms. The sensors report to the Management Console; they tell it what services they discover, provide telemetry and generate manifests of software dependencies.

The following production platforms are supported by ThreatMapper sensor agents:

  • Kubernetes: ThreatMapper sensors are deployed as a daemonset in the Kubernetes cluster, using a helm chart.
  • Docker: ThreatMapper sensors are deployed as a lightweight container.
  • Amazon ECS: ThreatMapper sensors are deployed as a daemon service using a task definition.
  • AWS Fargate: ThreatMapper sensors are deployed as a sidecar container, using a task definition.
  • Bare-Metal or Virtual Machines: ThreatMapper sensors are deployed within a lightweight Docker runtime.

For example, run the following command to start the ThreatMapper sensor on a Docker host:

docker run -dit \
    --cpus=".2" \
    --name=deepfence-agent \
    --restart on-failure \
    --pid=host \
    --net=host \
    --log-driver json-file \
    --log-opt max-size=50m \
    --privileged=true \
    -v /sys/kernel/debug:/sys/kernel/debug:rw \
    -v /var/log/fenced \
    -v /var/run/docker.sock:/var/run/docker.sock \
    -v /:/fenced/mnt/host/:ro \
    -e CUSTOM_TAGS="" \
    -e MGMT_CONSOLE_URL="---CONSOLE-IP---" \
    -e MGMT_CONSOLE_PORT="443" \
    -e DEEPFENCE_KEY="---DEEPFENCE-API-KEY---" \
    -e http_proxy="" \
    -e https_proxy="" \
    -e no_proxy="" \
    quay.io/deepfenceio/deepfence_agent_ce:2.5.8

Note: Image tag quay.io/deepfenceio/deepfence_agent_ce:2.5.8-multiarch is supported in amd64 and arm64/v8 architectures.

On a Kubernetes platform, the sensors are installed using helm chart

Next Steps

Visit the Deepfence ThreatMapper Documentation, to learn how to get started and how to use ThreatMapper.

Get in touch

Thank you for using ThreatMapper. Please feel welcome to participate in the ThreatMapper Community.

Get ThreatStryker for Enterprise

ThreatStryker is the enterprise version of ThreatMapper, with additional features for enterprise security teams. ThreatStryker is available as a cloud service or for on-premises deployment.

Security and Support

For any security-related issues in the ThreatMapper project, contact productsecurity at deepfence dot io.

Please file GitHub issues as needed, and join the Deepfence Community Slack channel.

License

The Deepfence ThreatMapper project (this repository) is offered under the Apache2 license.

Contributions to Deepfence ThreatMapper project are similarly accepted under the Apache2 license, as per GitHub's inbound=outbound policy.

Frequently asked questions

Is ThreatMapper free to use?

ThreatMapper is open source under the Apache-2.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does ThreatMapper do?

Open Source Cloud Native Application Protection Platform (CNAPP)

What is ThreatMapper written in?

ThreatMapper is primarily written in TypeScript. Its source is publicly available at https://github.com/deepfence/ThreatMapper, and it has 5,321 GitHub stars.