Deepfence ThreatMapper Documentation

The deepfence_frontend is a JavaScript monorepo managed with Turborepo and PNPM. It contains the following core components:

Apps and Packages

• dashboard: The main deepfence dashboard application, built with Vite, React, and TypeScript.
• ui-components: A React UI Component library featuring deepfence branding, used across all deepfence applications.
• tailwind-preset: Tailwind CSS configurations used by all UI apps and packages.

Utilities

• TypeScript: For static type checking.
• ESLint: For code linting.
• Prettier: For code formatting.

ThreatMapper Sensors are lightweight, privileged containers used to manage production workloads. They perform the following functions:

• Monitor activity
• Discover workloads
• Retrieve manifests

Sensors communicate with the ThreatMapper Management Console over TLS using a specific Management Console URL and an API key. A single Management Console can manage multiple workload types, as well as simultaneous on-premise and cloud deployments.

Developers looking to extend or integrate with Deepfence ThreatMapper can access the following primary resources:

• Build Guides: Instructions on how to build Deepfence ThreatMapper.
• REST API Reference: Detailed documentation for interacting with the ThreatMapper REST API.
• Python SDK: Guides and documentation on how to use the official Python SDK for programmatic interaction.

Cloud Compliance posture scanning is performed by a Compliance Scanner task installed directly within your monitored cloud instances.

Instead of the remote management console accessing your cloud APIs directly over the internet, the local Compliance Scanner task interacts with local cloud APIs under instructions from the management console. This architecture improves security by eliminating the need to expose cloud APIs to remote clients.

ThreatMapper performs compliance scans using a library of controls (specific requirements and matching tests, such as verifying TLS is enabled). These controls are organized into benchmarks.

When running a compliance scan, you select specific benchmarks to measure against. ThreatMapper evaluates the associated controls and presents results categorized by benchmark once the scan is complete.

ThreatMapper performs compliance scans using a library of controls (specific requirements and matching tests, such as verifying TLS access or blocking plain-text HTTP).

These controls are organized into benchmarks. When running a compliance scan, you select specific benchmarks to measure against. ThreatMapper evaluates the associated controls and presents the results categorized by benchmark once the scan is complete.

Deepfence ThreatMapper architecture is composed of a central Management Console and distributed Sensors/Scanners:

• ThreatMapper Management Console: The central hub that receives data from sensors and uses infrastructure APIs to detect configuration errors and compliance weaknesses.
• Cloud Scanner Tasks: Reside within each platform and use local cloud APIs to handle infrastructure-level scanning.
• ThreatMapper Sensor Agents: Deployed on each production host. They collect on-host data, generate SBOMs, and forward telemetry and SBOMs securely to the Management Console.

The Cloud Scanner task is used by ThreatMapper to perform Compliance Posture Scanning for cloud environments. It accomplishes two main goals:

1. Asset Inventory: Builds an inventory of cloud assets (e.g., network security groups, storage objects, key management services) specific to your cloud platform.
2. Posture Scanning: Matches infrastructure configurations against best-practice benchmarks such as CIS, PCI-DSS, and HIPAA.

Results are summarized in a 'Threat Graph' visualization to help prioritize compliance issues based on exploit risk.

ThreatMapper Sensor Agents are deployed as privileged containers directly on production hosts to retrieve SBOMs, run scans, and forward telemetry data to the ThreatMapper Management Console. The supported deployment models are:

• Kubernetes: Deployed as a daemonset.
• Docker: Deployed as a container on each Docker host.
• Bare metal and VM-based platforms: Deployed as a Docker container on Linux operating system instances (Windows Server is not supported, except for an experimental implementation).
• AWS Fargate: Deployed as a daemon service alongside each serverless instance.

ThreatMapper sensor agents can be deployed across various production and development environments using different methods:

• Kubernetes: Deployed as a daemonset using a Helm chart.
• Docker: Deployed as a lightweight container.
• Amazon ECS: Deployed as a daemon service using a task definition.
• AWS Fargate: Deployed as a sidecar container using a task definition.
• Bare-Metal or Virtual Machines: Deployed within a lightweight Docker runtime.