🔥 🔥 Open source cloud native security observability platform. Linux, K8s, AWS Fargate and more. 🔥 🔥

Last update: Jan 1, 2023

Overview

CVE-2021-44228 Log4J Vulnerability can be detected at runtime and attack paths can be visualized by ThreatMapper.

Live demo of Log4J Vulnerability here
More details here

ThreatMapper - Runtime Vulnerability Management and Attack Path Enumeration for Cloud Native

Deepfence ThreatMapper hunts for vulnerabilities in your production platforms, and ranks these vulnerabilities based on their risk-of-exploit. You can then prioritize the issues that present the greatest risk to the security of your applications - read more.

Learn the Topology

Identify Vulnerabilities

Discover Attack Paths

See ThreatMapper running with a live demo.

Getting Started with ThreatMapper

ThreatMapper.mp4

Planning your Deployment

The ThreatMapper console can be deployed on a single docker host or in a Kubernetes cluster.

ThreatMapper then monitors your development or production workloads using Sensor Agents. The sensors can be deployed on a wide range of platforms - Kubernetes, Docker, Fargate, Bare-Metal and Virtual Machines. Check the prerequisites before you proceed.

Install the Management Console

Installing the management console on a Docker host (4 cores, 16Gb) is as straightforward as:

wget https://github.com/deepfence/ThreatMapper/raw/master/deployment-scripts/docker-compose.yml
docker-compose -f docker-compose.yml up --detach

Once docker-compose has detached, allow 30 seconds or so for the console to complete its startup. Note that the console uses an untrusted self-signed TLS key by default (how to fix).

Installation on Kubernetes is performed with a Helm Chart:

# Install OpenEBS, and wait for it to start up
kubectl create ns openebs
helm install openebs --namespace openebs --repo "https://openebs.github.io/charts" openebs --set analytics.enabled=false
kubectl get pods -o wide --namespace openebs -w

# Install the Kubernetes metrics service (if not already installed)
kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/download/v0.5.0/components.yaml

# Configure the Deepfence ThreatMapper Helm Chart
helm repo add deepfence https://deepfence-helm-charts.s3.amazonaws.com/threatmapper

# Install the ThreatMapper console and wait for the pods to start up
helm install deepfence-console deepfence/deepfence-console
kubectl get pods -o wide -w

# Optionally, install the Deepfence Router service and wait for the platform to deploy a load balancer
helm install deepfence-router deepfence/deepfence-router
kubectl get --namespace default svc -w deepfence-router

More details are in the ThreatMapper documentation.

Initial Configuration

Once the Management Console is up and running, you can register an admin account and obtain an API key.

When the console first starts up, it will begin to acquire the Threat Intel feed data; this usually takes a few minutes, but can take up to an hour. You can install sensors and browse the topology of your applications, but you will not be able to perform vulnerability scans until the threat feeds have been fully acquired.

Install the ThreatMapper Sensor Agents

Install the Sensor Agents on your production or development platforms. The Sensor Agents report to the Management Console; they tell it what services they discover, provide telemetry and generate manifests of software dependencies.

The following production platforms are supported by ThreatMapper sensors:

Amazon ECS: ThreatMapper sensors are deployed as a daemon service using a task definition.
AWS Fargate: ThreatMapper sensors are deployed as a sidecar container, using a task definition.
Google Kubernetes Engine: ThreatMapper sensors are deployed as a daemonset in the GKE cluster.
Azure Kubernetes Service: ThreatMapper sensors are deployed as a daemonset in the AKS cluster.
Kubernetes: ThreatMapper sensors are deployed as a daemonset in the Kubernetes cluster, using a helm chart.
Docker: ThreatMapper sensors are deployed as a lightweight container.
Bare-Metal or Virtual Machines: ThreatMapper sensors are deployed within a lightweight Docker runtime.

For example, run the following command to start the Deepfence Sensor on the Docker host:

docker run -dit --cpus=".2" --name=deepfence-agent --restart on-failure --pid=host --net=host \
  --privileged=true -v /sys/kernel/debug:/sys/kernel/debug:rw -v /var/log/fenced \
  -v /var/run/docker.sock:/var/run/docker.sock -v /:/fenced/mnt/host/:ro \
  -e USER_DEFINED_TAGS="" -e MGMT_CONSOLE_URL="---CONSOLE-IP---" -e MGMT_CONSOLE_PORT="443" \
  -e DEEPFENCE_KEY="---DEEPFENCE-API-KEY---" \
  deepfenceio/deepfence_agent_ce:latest

On a Kubernetes platform, the sensors are installed using a Helm chart:

helm repo add deepfence https://deepfence-helm-charts.s3.amazonaws.com/threatmapper

# helm v2
helm install deepfence/deepfence-agent \
    --name=deepfence-agent \
    --set managementConsoleUrl=---CONSOLE-IP--- \
    --set deepfenceKey=---DEEPFENCE-API-KEY---

# helm v3
helm install deepfence-agent deepfence/deepfence-agent \
    --set managementConsoleUrl=---CONSOLE-IP--- \
    --set deepfenceKey=---DEEPFENCE-API-KEY---

Next Steps

Once the sensor agents have been installed, you can begin to explore the topology of your infrastructure and applications.

Subsequently, when the threat feeds have been acquired, you'll see a message on Settings -> Diagnosis. You can begin with your first Production Vulnerability Scan.

Check out the Deepfence ThreatMapper wiki for how to get started with using Deepfence ThreatMapper.

Get in touch

Got a question, need some help? Find the Deepfence team on Slack
https://github.com/deepfence/ThreatMapper/issues: Got a feature request or found a bug? Raise an issue
productsecurity at deepfence dot io: Found a security issue? Share it in confidence
Read the documentation in the Deepfence ThreatMapper wiki
Find out more at deepfence.io

Security and Support

For any security-related issues in the ThreatMapper project, contact productsecurity at deepfence dot io.

Please file GitHub issues as needed, and join the Deepfence Community Slack channel.

License

The Deepfence ThreatMapper project (this repository) is offered under the Apache2 license.

Contributions to Deepfence ThreatMapper project are similarly accepted under the Apache2 license, as per GitHub's inbound=outbound policy.

Comments

Scans failing to pick up RedHat RPMs
Describe the bug I'm scanning RH 7.7 machines with the Bare-Metal / Docker container configuration. I get results back for application code Java, Python, etc. But nothing about the RPMs and packages installed.

To Reproduce Steps to reproduce the behavior:

Install RH 7.7 - Might be tricky to find the ISO....

Docker Won't install on RH 7.7 so you'll need to add some Centos packages sudo yum -y install http://mirror.centos.org/centos/7/extras/x86_64/Packages/container-selinux-2.107-3.el7.noarch.rpm --nogpgcheck sudo yum -y install http://mirror.centos.org/centos/7/extras/x86_64/Packages/slirp4netns-0.4.3-4.el7_8.x86_64.rpm --nogpgcheck sudo yum -y install http://mirror.centos.org/centos/7/extras/x86_64/Packages/fuse3-libs-3.6.1-4.el7.x86_64.rpm --nogpgcheck sudo yum -y install http://mirror.centos.org/centos/7/extras/x86_64/Packages/fuse-overlayfs-0.7.2-6.el7_8.x86_64.rpm --nogpgcheck sudo yum -y install docker-ce docker-ce-cli containerd.io

Then start docker and run the Sensor Agent as per the documentation.

Run a scan with all options enabled.

Expected behavior I'd expect to see details of the RPMs with CVEs that need updating.

Components/Services affected

[ ] UI/Frontend

[ ] API/Backend

[ X] Agent

[ ] Deployment/YAMLs

[ ] CI/CD Integration

[ ] Other (specify)

Additional context Both the Agent and Management Console are running as virtual machines (Oracle Virtual Box) on my laptop. I wanted to do a scan of RH 7.7 before updating to RH 7.9 to see how many CVEs get fixed, and how many remain.
bug needs-triage
opened by sgreenslade 11
Unable to navigate from 'Topology'

Hi,

I've setup the management console on an AWS instance using the repository instructions. I've registered an account and accessed the console but I can't navigate to any other pages (registries, vulnerabilities, settings etc.). It seems to be in a loop of 'resuming the live state' and is stuck 'Optimizing hosts'.

I've given it over 60 minutes as the readme mentioned, but there's been no change.

I can't find any obvious problems looking through the various container logs. I wondered if someone here could offer any guidance?

opened by lwilliams1990 11
deepfence_agent_ce:latest on armv7 docker
Maybe this isn't really a bug, but maybe an configuration or compatibility issue. The sensor must be install on external chip set devices they are in a network comparison. Basic for this is armV7.

The package installation in dependencies was installing docker.io on armv7. Which image or where can find the armV7 deploy image for ?

try to deploy the deepfence_agent_ce:latest on armv7 with following script

See error

docker run -dit --cpus=".2" --name=deepfence-agent --restart on-failure --pid=host --net=host \ --privileged=true -v /sys/kernel/debug:/sys/kernel/debug:rw -v /var/log/fenced \ -v /var/run/docker.sock:/var/run/docker.sock -v /:/fenced/mnt/host/:ro \ -e USER_DEFINED_TAGS="" -e MGMT_CONSOLE_URL="XXX.XXX.XXX.XXX" -e MGMT_CONSOLE_PORT="443" \ -e DEEPFENCE_KEY="API-KEY" \ deepfenceio/deepfence_agent_ce:latest Result: WARNING: The requested image's platform (linux/amd64) does not match the detected host platform (linux/arm/v7) and no specific platform was requested Components/Services affected

[ ] UI/Frontend

[ ] API/Backend

[x] Agent

[ ] Deployment/YAMLs

[ ] CI/CD Integration

[ ] Other (specify)

bug needs-triage
opened by armorvx 10
Docker Issue : deepfenceio/deepfence_init_ce:1.4.1 Exit Errror

Dear team,

I would like to ask you about the following error I have.

The error happens after a zero installation by downloading the docker-compose file and running it.

I only modify in it the default port since I have in use the 443, but after that everything is the same.

The docker runs correctly but when I try to enter the port I get the following message in the browser: "secure connection failed" "PR_END_OF_FILE_ERRROR".

It doesn't seem to be a browser problem since I validated it with several ...

I run the command docker ps -a and I see that there is an instance with an error.

Error :

5f182a2d1de5 deepfenceio/deepfence_init_ce:1.4.1 "/usr/local/bin/entr…" 2 hours ago Exited (0) 2 seconds ago df-init-container

I really don't know what I could do... the instance has the capability to support docker and is on AWS EC2 which I understand is compatible with this solution.

thanks,
bug needs-triage

opened by jplopezy 8
Upload Vulnerabilty Database Issue
Describe the bug: Cannot upload the vulnerability database.

To Reproduce: Steps to reproduce the behavior:

Go to Settings > Vulnerability & Secret Management

Upload the vulnerability database with tar.gz file

Check Network tab on browser, it shows POST 404 Not Found with this URL: https://address/undefined/df-api/upload-vulnerability-db

Screenshots:

Additional context: Deepfence: 1.4.0
opened by wonhee0410 7
Threat Mapper Management Console does not show up when running on local server
Describe the bug Threat mapper downloaded from git URL, performed steps to run management console on local server but console does not show up on the local IP address and given PORT.

To Reproduce Steps to reproduce the behavior:

Go to 'https://github.com/deepfence/ThreatMapper'

Clone the repo.

Follow steps give on: https://github.com/deepfence/ThreatMapper/wiki/Building-Console-and-Sensors-from-Source to run Threat Mapper Management Console on local server.

Check if Threat Mapper Management Console came up on given IP and PORT.

Expected behavior Threat Mapper Management Console should come up on given IP and PORT.

Screenshots Attaching a PDF in comments section for detailed explanation and to show successful configuration steps.

Components/Services affected

Additional context OS Details: Ubuntu 20.04.4 LTS (64-bit) CPU/RAM/SSD: Intel Core i7 / 32 GB RAM / 512 GB SSD
bug waiting-for-feedback
opened by yashtw 7
Issue scanning Management node and registries

Unable to run vulnerability scans on management console node and registries. Vulnerability scans start but hang after a while with error "Scan was interrupted". There is no info in the docker-compose logs to investigate or viewable logs from the console itself.

opened by jrose1738 7
PDF report always shows "No vulnerabilities found for the applied filters"
Thanks for providing this tool!

Describe the bug When trying to generate a PDF report with vulnerabilities a PDF with the text "No vulnerabilities found for the applied filters" is always generated. Switching to the XLSX format returns thousands.

To Reproduce Steps to reproduce the behavior:

Go to 'Integrations > Reports / PDF/XLSX'

Select 'Vulnerabilities', 'container image', 'last 1 day' and PDF format.

Click Download.

Wait until report is generated and download it (a file without vulnerabilities is generated).

Switch to XLSX download type and click Download.

A XLSX file with thousand of vulnerabilities is shown.

Expected behavior I expected that the only difference would be the file format. The list of vulnerabilities should be the same.

Screenshots Filter settings and "Filters used" - Note the differences here.

Extract from XLSX:

PDF file downloaded:

Components/Services affected

Making a best effort guess here.

[X] UI/Frontend

[X] API/Backend

[ ] Agent

[ ] Deployment/YAMLs

[ ] CI/CD Integration

[ ] Other (specify)

I hope the above helps with tracking down the issue. Since the Filters Used are different depending on file format, I suspect the issue might lay there.

Thanks
bug pr/merged
opened by mustajarvi 6
Error when register: Console URL is not valid
Describe the bug I started with the getting started page with docker-compose. After starting the services, I can enter the portal and click on "Register". After I filled the form, I got the error "Console URL is not valid"

To Reproduce Steps to reproduce the behavior:

Go to this page: https://github.com/deepfence/ThreatMapper/wiki/Installing-the-Management-Console

Follow instruction in section: "Install the ThreatMapper Management Console - Single Docker Host"

Go to web-portal "https://localhost/"

Click on register

Enter your details

Click on button to submit form

Got the error "Console URL is not valid"

Expected behavior Registration should be successfull to be able to login into the web-ui.

Screenshots

Components/Services affected

[X] UI/Frontend

[X] API/Backend

[ ] Agent

[ ] Deployment/YAMLs

[ ] CI/CD Integration

[ ] Other (specify)

Additional context None
bug waiting-for-feedback
opened by jonahbohlmann 6

Installation of Management Console Fails

Provided the docer-compose.yml file, when executing the following command:

docker-compose -f docker-compose.yml up -d

I am unable to browse to the management console as not all containers are started, specifically the deepfence-es-master container which presents the following errors:

Exception in thread "main" java.lang.RuntimeException: starting java failed with [137]
output:

error:
OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
	at org.elasticsearch.tools.launchers.JvmErgonomics.flagsFinal(JvmErgonomics.java:123)
	at org.elasticsearch.tools.launchers.JvmErgonomics.finalJvmOptions(JvmErgonomics.java:88)
	at org.elasticsearch.tools.launchers.JvmErgonomics.choose(JvmErgonomics.java:59)
	at org.elasticsearch.tools.launchers.JvmOptionsParser.main(JvmOptionsParser.java:95)

Would appreciate any guidance.

opened by derickrn 6

[K8s console] [vulnerability scan] scan failures
Setup a K8s cluster. Install management console on it.

Connect a regular vm agent. In this setup there is just one fsharp docker container running on the vm.

Scan both the fsharp container and the vm. Both scans run forever.

bug needs-triage
opened by jo19in1 5
[Graph integration] Add new deepfence CLI
As part of the ongoing effort to integrate with neo4j graph (https://github.com/deepfence/ThreatMapper/issues/692) we are adding a new CLI to allow headless interaction with the console.

[x] Topology API

[x] Threat API

[x] Authentication

[x] User API

[ ] Login API

[x] APIToken

[x] Register

[x] Scan API

[x] Secret scan

[ ] Compliance scan

[ ] Malware scan

[ ] Cloud scan

[ ] Ingesters API

enhancement needs-triage
opened by noboruma 0
Vulnerability and Secret scans - show differences between scan results for a host/image in UI
We currently provide an API that helps diffing (new vulnerabilities, fixed vulnerabilities, etc) between any two given scan IDs on any node (container images or a host). This feature should be provided in UI.

API exists for vulnerability scan, required for secret scan

https://deepfence.github.io/deepfence_runtime_api/#operation--deepfence-v1.5-vulnerability_scan_diff-get

enhancement
opened by ramanan-ravi 0
Kubernetes Sensor Agents do not run on ARM nodes
Describe the bug When the kubernetes sensor agent pods run on ARM64 (graviton2) worker nodes they crash with this error: exec /usr/local/bin/start_services: exec format error

To Reproduce Steps to reproduce the behavior:

Deploy https://github.com/deepfence/ThreatMapper/tree/master/deployment-scripts/helm-charts/deepfence-agent to a k8s cluster that is running ARM worker nodes.

Pods from the daemonset that try to run on ARM nodes error out: exec /usr/local/bin/start_services: exec format error

[ ] UI/Frontend

[ ] API/Backend

[x] Agent

[ ] Deployment/YAMLs

[ ] CI/CD Integration

[ ] Other (specify)

enhancement kubernetes
opened by j771 0
[Graph integration] Improvement unified package-scanner code

merge vulnerability mapper from ThreatMapper to package-scanner making it easier to run vulnerability scans using syft and grype from a single place

add option to run only sbom generation(syft) on agent and run grype on threatmapper console using command line flags
enhancement v2

opened by gnmahanth 0
Unable to change the Deepfence console url as my top level domain is engineering

Describe the bug My top level domain is engineering ex; xxx.xxx.engineering since engineering is a large alphabet, the console URL is not accepting it

bug

opened by namanjain-coditas 0
Missing 'Severity' filter in notification for vulnerabilities
Describe the bug Earlier we used to have a filter called 'severity' in notification, which helped to filter only selected severity vuln. to be pushed as notification to slack, teams, etc. It's not present now.

Screenshots

Components/Services affected

[x] UI/Frontend

[ ] API/Backend

[ ] Agent

[ ] Deployment/YAMLs

[ ] CI/CD Integration

[ ] Other (specify)

Additional context Add any other context about the problem here.
bug p0
opened by ibreakthecloud 0

Releases(threatintel-yara-2022-12-31_00-06-37)

threatintel-yara-2022-12-31_00-06-37(Dec 31, 2022)

Source code(tar.gz)
Source code(zip)
threatintel-yara-rules-2022-12-31_00-06-37.tar.gz(1009.13 KB)
threatintel-2022-12-31_00-15-22(Dec 31, 2022)

Source code(tar.gz)
Source code(zip)
threatintel-vuln-2022-12-31_00-15-22.tar.gz(79.86 MB)
threatintel-yara-2022-12-30_00-07-07(Dec 30, 2022)

Source code(tar.gz)
Source code(zip)
threatintel-yara-rules-2022-12-30_00-07-07.tar.gz(1009.16 KB)
threatintel-2022-12-30_00-16-02(Dec 30, 2022)

Source code(tar.gz)
Source code(zip)
threatintel-vuln-2022-12-30_00-16-02.tar.gz(79.82 MB)
threatintel-yara-2022-12-29_00-07-09(Dec 29, 2022)

Source code(tar.gz)
Source code(zip)
threatintel-yara-rules-2022-12-29_00-07-09.tar.gz(1009.14 KB)
threatintel-2022-12-29_00-16-42(Dec 29, 2022)

Source code(tar.gz)
Source code(zip)
threatintel-vuln-2022-12-29_00-16-42.tar.gz(79.82 MB)
v1.4.1(Oct 3, 2022)
What's Changed

reset check type on changing compliance provider by @manV in https://github.com/deepfence/ThreatMapper/pull/522

Add ThreatGraph missing icons by @manV in https://github.com/deepfence/ThreatMapper/pull/524

Remove UI resolver in router config #523 by @ramanan-ravi in https://github.com/deepfence/ThreatMapper/pull/525

Cloud stats by @ramanan-ravi in https://github.com/deepfence/ThreatMapper/pull/528

Update documentation by @ramanan-ravi in https://github.com/deepfence/ThreatMapper/pull/529

changed cve-links to show as actual links in popup by @saiprasanth1303 in https://github.com/deepfence/ThreatMapper/pull/527

Bugfix/remove phone input arrows by @MilanRajkumar in https://github.com/deepfence/ThreatMapper/pull/515

Updated API params for report generation by @saiprasanth1303 in https://github.com/deepfence/ThreatMapper/pull/531

Update README.md by @fferrann in https://github.com/deepfence/ThreatMapper/pull/532

New Helm chart version by @ramanan-ravi in https://github.com/deepfence/ThreatMapper/pull/537

Discrepancy in the results while we select container image in report download by @mukuldeepfence in https://github.com/deepfence/ThreatMapper/pull/536

fix the condition toenable schedule compliance scans by @ibreakthecloud in https://github.com/deepfence/ThreatMapper/pull/534

UI: Reset page index on filter on registry image list by @manV in https://github.com/deepfence/ThreatMapper/pull/542

UI: Show checkbox for only relevant node types on topology table by @manV in https://github.com/deepfence/ThreatMapper/pull/544

fix: empty response of search filter must update severity counts by @milan-deepfence in https://github.com/deepfence/ThreatMapper/pull/543

Fixed the CSS for status pills in topology table by @saiprasanth1303 in https://github.com/deepfence/ThreatMapper/pull/546

Schedule Scan for compliance issue is fixed by @mukuldeepfence in https://github.com/deepfence/ThreatMapper/pull/547

Enable haproxy logs by @gnmahanth in https://github.com/deepfence/ThreatMapper/pull/552

Enable haproxy logs by @gnmahanth in https://github.com/deepfence/ThreatMapper/pull/553

Fix user-sent notifications by @ramanan-ravi in https://github.com/deepfence/ThreatMapper/pull/555

fix/538-add compliance menu for integration by @milan-deepfence in https://github.com/deepfence/ThreatMapper/pull/539

Fix api path for vulnerability db upload by @manV in https://github.com/deepfence/ThreatMapper/pull/558

Made changes to ecr registry by @saiprasanth1303 in https://github.com/deepfence/ThreatMapper/pull/564

Cloudtrail logs processing by @jatin-baweja in https://github.com/deepfence/ThreatMapper/pull/561

Cloudtrail alerts UI by @saiprasanth1303 in https://github.com/deepfence/ThreatMapper/pull/562

add compliance percentage for linux (fix: issue 1601) by @gnmahanth in https://github.com/deepfence/ThreatMapper/pull/568

Support custom file path for docker/containerd socket by @ramanan-ravi in https://github.com/deepfence/ThreatMapper/pull/572

Fix compliance scan summary issues by @manV in https://github.com/deepfence/ThreatMapper/pull/570

#565 Api and UI changes for KSPM by @saurabh2253 in https://github.com/deepfence/ThreatMapper/pull/575

Update README.md by @Bentipe in https://github.com/deepfence/ThreatMapper/pull/576

#577 trigger scheduled scan action by @saurabh2253 in https://github.com/deepfence/ThreatMapper/pull/578

#565 adding kspm dependency in helm chart by @saurabh2253 in https://github.com/deepfence/ThreatMapper/pull/581

Kubernetes scanner - docs by @ramanan-ravi in https://github.com/deepfence/ThreatMapper/pull/583

Added cloudformation template for AWS cloud in posture page by @saiprasanth1303 in https://github.com/deepfence/ThreatMapper/pull/580

#565 Kspm cis check type to nsa-cisa by @saurabh2253 in https://github.com/deepfence/ThreatMapper/pull/584

fix:to have info icon for an error case by @milan-deepfence in https://github.com/deepfence/ThreatMapper/pull/586

Fixed UI masking and unmasking on compliance by @saiprasanth1303 in https://github.com/deepfence/ThreatMapper/pull/588

Helm chart - add resources per pod in values.yaml by @ramanan-ravi in https://github.com/deepfence/ThreatMapper/pull/589

fix for fetching images from amazon public ECR deepfence/ThreatMapper… by @mukuldeepfence in https://github.com/deepfence/ThreatMapper/pull/559

fix threat graph not generated by @gnmahanth in https://github.com/deepfence/ThreatMapper/pull/595

FIxed empty xlsx report generation by @saiprasanth1303 in https://github.com/deepfence/ThreatMapper/pull/596

changed the params which caused empty xlsx report generation by @saiprasanth1303 in https://github.com/deepfence/ThreatMapper/pull/597

Version upgrade - v1.4.1 by @ramanan-ravi in https://github.com/deepfence/ThreatMapper/pull/598

fix:controls button misalignment on details pop up by @milan-deepfence in https://github.com/deepfence/ThreatMapper/pull/599

FIxed integration table data mismatch by @saiprasanth1303 in https://github.com/deepfence/ThreatMapper/pull/600

add missing internal port on api pod by @gnmahanth in https://github.com/deepfence/ThreatMapper/pull/602

now we can assign the issue to assignee deepfence/ThreatMapper#445 by @mukuldeepfence in https://github.com/deepfence/ThreatMapper/pull/601

Upload vulnerability database issue #557 by @ramanan-ravi in https://github.com/deepfence/ThreatMapper/pull/605

New Contributors

@MilanRajkumar made their first contribution in https://github.com/deepfence/ThreatMapper/pull/515

@fferrann made their first contribution in https://github.com/deepfence/ThreatMapper/pull/532

@Bentipe made their first contribution in https://github.com/deepfence/ThreatMapper/pull/576

Full Changelog: https://github.com/deepfence/ThreatMapper/compare/v1.4.0...v1.4.1
Source code(tar.gz)
Source code(zip)
v1.4.0(Aug 10, 2022)
What's Changed

Render custom dropdown in a portal to avoid overflow clipping by @manV in https://github.com/deepfence/ThreatMapper/pull/504

Cloud Security Posture Analysis and Threat Graph by @ramanan-ravi in https://github.com/deepfence/ThreatMapper/pull/518

1.4 docs update by @ogarrett in https://github.com/deepfence/ThreatMapper/pull/517

Full Changelog: https://github.com/deepfence/ThreatMapper/compare/v1.3.1...v1.4.0
Source code(tar.gz)
Source code(zip)
v1.3.1(Jul 29, 2022)
What's Changed

#336 Mounting containerd directories in write mode by @saurabh2253 in https://github.com/deepfence/ThreatMapper/pull/350

Sorting support for RBOM tables by @manV in https://github.com/deepfence/ThreatMapper/pull/349

show scan status beside the scan button by @pandyamarut in https://github.com/deepfence/ThreatMapper/pull/354

diagnosis timestamp change to local time by @pandyamarut in https://github.com/deepfence/ThreatMapper/pull/351

Ci/cd changes for v1.3 by @mukuldeepfence in https://github.com/deepfence/ThreatMapper/pull/352

donut modal popup severity sorting fix by @pandyamarut in https://github.com/deepfence/ThreatMapper/pull/357

add pagination to the runtime bom table by @pandyamarut in https://github.com/deepfence/ThreatMapper/pull/362

Add user menu to settings screen by @manV in https://github.com/deepfence/ThreatMapper/pull/360

Runtime bom query optimisation and pagination by @saurabh2253 in https://github.com/deepfence/ThreatMapper/pull/364

Upgrade golang version by @ramanan-ravi in https://github.com/deepfence/ThreatMapper/pull/365

Add wait for secret scan process to restart by @saurabh2253 in https://github.com/deepfence/ThreatMapper/pull/368

Enhance the vulnerability database by @ramanan-ravi in https://github.com/deepfence/ThreatMapper/pull/369

Containerd reporter in discovery pod by @ramanan-ravi in https://github.com/deepfence/ThreatMapper/pull/375

Make es index names, url scheme configurable by @ramanan-ravi in https://github.com/deepfence/ThreatMapper/pull/378

issue-376: Support setting a temporary password by @shahpratikr in https://github.com/deepfence/ThreatMapper/pull/379

Harbor Registry by @mukuldeepfence in https://github.com/deepfence/ThreatMapper/pull/383

Make console url domain resolution optional in probe by @ramanan-ravi in https://github.com/deepfence/ThreatMapper/pull/386

Fix interrupted secret scans status by @ramanan-ravi in https://github.com/deepfence/ThreatMapper/pull/388

Ignore management console port in the url if 443 by @ramanan-ravi in https://github.com/deepfence/ThreatMapper/pull/391

Excel and PDF report has been added for the Secret Scans' results by @mukuldeepfence in https://github.com/deepfence/ThreatMapper/pull/382

Issue-381: ES changes to support multi-tenancy by @shubhamjain32 in https://github.com/deepfence/ThreatMapper/pull/390

Add the secret scan report download by @pandyamarut in https://github.com/deepfence/ThreatMapper/pull/372

Modified notification related APIs #394 by @ramanan-ravi in https://github.com/deepfence/ThreatMapper/pull/395

Management Console diagnosis logs - limit kubernetes namespace by @ramanan-ravi in https://github.com/deepfence/ThreatMapper/pull/398

Temporary password change ui by @manV in https://github.com/deepfence/ThreatMapper/pull/401

Changes required in fetcher service by @shubhamjain32 in https://github.com/deepfence/ThreatMapper/pull/400

Xlpdf 2 by @mukuldeepfence in https://github.com/deepfence/ThreatMapper/pull/399

Added separate node type options for secret scan reports & changed re… by @saiprasanth1303 in https://github.com/deepfence/ThreatMapper/pull/402

Upgrade dependencies by @ramanan-ravi in https://github.com/deepfence/ThreatMapper/pull/404

Fix minor issue where empty maps are created by @ramanan-ravi in https://github.com/deepfence/ThreatMapper/pull/407

Update fargate sensors to v1.3.0 by @jatin-baweja in https://github.com/deepfence/ThreatMapper/pull/392

add external-sources to enhance java results by @ibreakthecloud in https://github.com/deepfence/ThreatMapper/pull/408

Cache topology data in redis by @ramanan-ravi in https://github.com/deepfence/ThreatMapper/pull/409

Use pg_isready command to check if postgresql by @ramanan-ravi in https://github.com/deepfence/ThreatMapper/pull/413

Remove open-tracer by @ramanan-ravi in https://github.com/deepfence/ThreatMapper/pull/414

(feat). API to upload vulnerability db in airgapped env by @ibreakthecloud in https://github.com/deepfence/ThreatMapper/pull/412

Add nginx ingress controller as type for router service installation by @jatin-baweja in https://github.com/deepfence/ThreatMapper/pull/418

Add support to upload db files in airgapped enviornment by @pandyamarut in https://github.com/deepfence/ThreatMapper/pull/411

Add support for ui runtime env variables by @manV in https://github.com/deepfence/ThreatMapper/pull/410

Secret scanner added to agent supervisor by @saurabh2253 in https://github.com/deepfence/ThreatMapper/pull/416

add exploit poc url in cve scan report by @ibreakthecloud in https://github.com/deepfence/ThreatMapper/pull/422

Fixed styling of input and delete button in vuln. management page by @saiprasanth1303 in https://github.com/deepfence/ThreatMapper/pull/427

Fix error in api container init script deepfence/ThreatMapper#424 by @ramanan-ravi in https://github.com/deepfence/ThreatMapper/pull/429

Fix registry table bulk actions by @manV in https://github.com/deepfence/ThreatMapper/pull/438

Fixed masked filter not being sent to the API when generating reports… by @saiprasanth1303 in https://github.com/deepfence/ThreatMapper/pull/440

[Iss1503] Filtering on Runtime BOM page yields 0 results by @mukuldeepfence in https://github.com/deepfence/ThreatMapper/pull/448

[Iss1510] Data under Sbom is not shown right by @mukuldeepfence in https://github.com/deepfence/ThreatMapper/pull/449

Reworked helm chart for ThreatMapper by @runitmisra in https://github.com/deepfence/ThreatMapper/pull/425

Issue275 severity type parameter cicd by @sidd0529 in https://github.com/deepfence/ThreatMapper/pull/452

Consider presence of exploit when sorting most exploitable vulnerabilities by @ramanan-ravi in https://github.com/deepfence/ThreatMapper/pull/444

Add exploit link column for cve table by @manV in https://github.com/deepfence/ThreatMapper/pull/454

add agent set up instructions to console by @manV in https://github.com/deepfence/ThreatMapper/pull/437

Dependency upgrade by @ramanan-ravi in https://github.com/deepfence/ThreatMapper/pull/455

Add secret scanner binary and config in separate folder by @ramanan-ravi in https://github.com/deepfence/ThreatMapper/pull/456

Made minor improovement in runtime_sbom API by @mukuldeepfence in https://github.com/deepfence/ThreatMapper/pull/459

Trimmed leading and trailing white spaces of a string in forms by @mukuldeepfence in https://github.com/deepfence/ThreatMapper/pull/460

Changes in package scanner build by @ramanan-ravi in https://github.com/deepfence/ThreatMapper/pull/464

minor change in resource filter api response deepfence/ThreatMapper#428 by @mukuldeepfence in https://github.com/deepfence/ThreatMapper/pull/435

Docker Hub Registry not listing any images #465 by @ramanan-ravi in https://github.com/deepfence/ThreatMapper/pull/466

Fix scroll issues with agent instructions pages by @manV in https://github.com/deepfence/ThreatMapper/pull/461

fix diagnosis dropdown issues by @manV in https://github.com/deepfence/ThreatMapper/pull/468

Upgrade dependency by @ramanan-ravi in https://github.com/deepfence/ThreatMapper/pull/470

Add option to update postgres configuration and add cluster domain fo… by @jatin-baweja in https://github.com/deepfence/ThreatMapper/pull/471

Disable vulnerability db validity check to support air-gapped environments by @ramanan-ravi in https://github.com/deepfence/ThreatMapper/pull/475

Update ci/cd instructions by @ramanan-ravi in https://github.com/deepfence/ThreatMapper/pull/477

Fix connections report by @noboruma in https://github.com/deepfence/ThreatMapper/pull/478

Modified haproxy config to update dns cache of ui pod by @usandeepc in https://github.com/deepfence/ThreatMapper/pull/485

Upgrade elasticsearch version by @sidd0529 in https://github.com/deepfence/ThreatMapper/pull/481

make changes to reaper_task to handle es scan status being idle issues by @deviprasad303 in https://github.com/deepfence/ThreatMapper/pull/486

Fixed issue-462: Console not available by @shahpratikr in https://github.com/deepfence/ThreatMapper/pull/488

Update dropdown overflows on pop ups by @manV in https://github.com/deepfence/ThreatMapper/pull/493

Fresh product documentation by @ogarrett in https://github.com/deepfence/ThreatMapper/pull/487

Fix error in case of missing container tag by @manV in https://github.com/deepfence/ThreatMapper/pull/501

Use codec.NewDecoder instead of json.Unmarshal for scope NodeSummaries by @ramanan-ravi in https://github.com/deepfence/ThreatMapper/pull/503

New Contributors

@shahpratikr made their first contribution in https://github.com/deepfence/ThreatMapper/pull/379

@shubhamjain32 made their first contribution in https://github.com/deepfence/ThreatMapper/pull/390

@runitmisra made their first contribution in https://github.com/deepfence/ThreatMapper/pull/425

@sidd0529 made their first contribution in https://github.com/deepfence/ThreatMapper/pull/452

@noboruma made their first contribution in https://github.com/deepfence/ThreatMapper/pull/478

@usandeepc made their first contribution in https://github.com/deepfence/ThreatMapper/pull/485

@deviprasad303 made their first contribution in https://github.com/deepfence/ThreatMapper/pull/486

Full Changelog: https://github.com/deepfence/ThreatMapper/compare/v1.3.0...v1.3.1
Source code(tar.gz)
Source code(zip)
v1.3.0(Mar 15, 2022)
ThreatMapper 1.3.0 Release

ThreatMapper 1.3.0 is a feature release, with a number of enhancements and fixes:

New Features

Secret Scanning: Scan containers and host filesystems, looking for possible unprotected secrets such as access tokens, keys and passwords.

SBOM Generation: Generate and export runtime SBOMs (Software Bill of Materials) from running workloads and hosts.

Updated Vulnerability Scanning: using Anchore syft and grype.

Attack Path Visualization: improved visualization identifes and classifies more attack path types

Upgrading to ThreatMapper 1.3

Please note that versions of the sensor agent prior to the 1.3 release will not interoperate with the ThreatMapper 1.3 management console, due to the architectural changes in SBOM generation and vulnerability scanning. To upgrade from an earlier ThreatMapper release:

Update the Management Console to version 1.3.0

Update sensor deployments to version 1.3.0

Please see the documentation for more information.

Full Changelog: https://github.com/deepfence/ThreatMapper/commits/v1.3.0
Source code(tar.gz)
Source code(zip)
v1.2.0(Mar 8, 2022)
ThreatMapper 1.2.0 Release

ThreatMapper 1.2.0 is a feature release, with a number of enhancements and fixes:

New Features

Attack Path visualization: using analysis of network traffic, the Attack Path visualisation identifies vulnerable workloads that are open to internet traffic, even when they are behind multiple layers of proxies.

Support for AWS Fargate workloads: ThreatMapper sensor agents may be deployed as sidecars to AWS Fargate workloads.

Integration with Google Chronicle: push events, alerts and scan results to Google Chronicle for archiving and analysis.

Major Enhancements

Improved 'most exploitable vulnerability' calculation: applying more weight to proximity to the attack surface and to active network connections, to better prioritize workloads at greater risk.

Broader support for Kubernetes and containerd: a number of updates addresses issues where manual and automated scans of Kubernetes/containerd-hosted containers would fail.

Enhancements to registry scans: including support for AWS ECR target account role ARN, better feedback on progress, and support for tag-based filtering of artifacts.

Multiple UI and user experience improvements: the ability to invite users to the Management Console without the need to configure an email relay, and more metadata reported against containers and other workloads so you can more easily identify them.

Full Changelog: https://github.com/deepfence/ThreatMapper/commits/v1.2.0
Source code(tar.gz)
Source code(zip)