ThreatMapper

by deepfence

5.2Kstars

639forks

58watchers

Updated about 1 month ago

About

ThreatMapper is an open source cloud native application protection platform that detects and prioritizes runtime threats and vulnerabilities across cloud, Kubernetes, serverless, and on-prem environments.

Open Source Cloud Native Application Protection Platform (CNAPP)

Primary Use Case

ThreatMapper is used by security teams and DevOps engineers to continuously monitor production workloads for vulnerabilities, exposed secrets, and misconfigurations. It provides security observability and risk prioritization for cloud native applications and infrastructure, enabling proactive threat remediation and compliance with security best practices.

Key Features

Agent-based inspection combined with agentless cloud scanning for comprehensive threat detection
Runtime threat management with risk-of-exploit ranking
Attack path enumeration and ThreatGraph visualization for risk prioritization
Supports cloud, Kubernetes, serverless (Fargate), and on-prem platforms
Monitors software vulnerabilities, exposed secrets, and security configuration deviations
Management Console deployable via Docker or Kubernetes
Continuous monitoring aligned with 'shift left' security practices

Installation

Download the docker-compose.yml file from the release branch: wget https://github.com/deepfence/ThreatMapper/raw/release-2.5/deployment-scripts/docker-compose.yml
Deploy the Management Console on a suitable Docker host or Kubernetes cluster using docker-compose or Kubernetes manifests
Configure and start the ThreatMapper Management Console container
Deploy Sensor Agents on target infrastructure for agent-based monitoring
Schedule or run Cloud Scanner tasks for agentless scanning of cloud environments

Usage

>_ docker-compose -f docker-compose.yml up -d

Starts the ThreatMapper Management Console using Docker Compose

Security Frameworks

Reconnaissance

Discovery

Defense Evasion

Collection

Impact

Usage Insights

Integrate ThreatMapper with CI/CD pipelines to enable continuous vulnerability and misconfiguration scanning during development and production.
Use ThreatGraph visualization to prioritize remediation efforts based on attack path risk, improving resource allocation for security teams.
Leverage agent-based and agentless scanning modes to maximize coverage across hybrid cloud, Kubernetes, and serverless environments.
Combine ThreatMapper findings with SIEM and SOAR platforms for automated alerting and response workflows.
Employ ThreatMapper in purple team exercises to simulate realistic attack paths and validate detection and defense capabilities.