ThreatMapper – Identify Vulnerabilities In Running Containers, Images, Hosts And Repositories

The Deepfence Runtime Threat Mapper is a subset of the Deepfence cloud native workload protection platform, released as a community edition. This community edition empowers the users with following features:

1. Visualization: Visualize kubernetes clusters, virtual machines, containers and images, running processes, and network connections in near real time.

2. Runtime Vulnerability Management: Perform vulnerability scans on running containers & hosts as well as container images.

3. Container Registry Scanning: Check for vulnerabilities in images stored on AWS ECR, Azure Container Registry, Google Container Registry, Docker Hub, Docker Self-Hosted Private Registry, Quay, Harbor, Gitlab and JFrog registries.

4. CI/CD Scanning: Scan images as part of existing CI/CD Pipelines like CircleCI, Jenkins & GitLab.

5. Integrations with SIEM, Notification Channels & Ticketing: Ready to use integrations with Slack, PagerDuty, HTTP endpoint, Jira, Splunk, ELK, Sumo Logic and Amazon S3.

Live Demo

https://deepfence.io/community-demo-form/

Architecture

A pictorial depiction of the Deepfence Architecture is below

Feature Availability

Getting Started

The Deepfence Management Console is first installed on a separate system. The Deepfence agents are then installed onto bare-metal servers, Virtual Machines, or Kubernetes clusters where the application workloads are deployed, so that the host systems, or the application workloads, can be scanned for vulnerabilities.

A pictorial depiction of the Deepfence security platform is as follows:

Deepfence Management Console

Pre-Requisites for Management Console

Following table gives the number of nodes that can be supported with different console machine configurations assuming a single node deployment of console. Memory optimised instances are shown to perform better.

In order to support higher numbers of nodes (i.e. hosts as number of containers can be unlimited theoretically based on their life times) ThreatMapper needs to be deployed as a 3 node k8s cluster to scale up to 10000 nodes, instructions to follow.

Installation of Deepfence Management Console

Installing the Management Console is as easy as:

1. Download the file docker-compose.yml to the desired system.
2. Execute the following command

   docker-compose -f docker-compose.yml up -d

3. Open management console ip address / domain in the browser (https://x.x.x.x) and register a new account. Steps: Register a User
4. Get Deepfence api key from UI: Goto Settings -> User Management, copy api key. In the following docker run command, replace C8TtyEtNB0gBo1wGhpeAZICNSAaGWw71BSdS2kLELY0 with api Key. Steps: Deepfence API Key

   docker run -dit --cpus=".2" --name=deepfence-agent --restart on-failure --pid=host --net=host --privileged=true -v /sys/kernel/debug:/sys/kernel/debug:rw -v /var/log/fenced -v /var/run/docker.sock:/var/run/docker.sock -v /:/fenced/mnt/host/:ro -e USER_DEFINED_TAGS="" -e DF_BACKEND_IP="127.0.0.1" -e DEEPFENCE_KEY="C8TtyEtNB0gBo1wGhpeAZICNSAaGWw71BSdS2kLELY0" deepfenceio/deepfence_agent_ce:latest

This is the minimal installation required to quickly get started on scanning various container images. The necessary images may now be downloaded onto this Management Console and scanned for vulnerabilities.

Terraform

• Terraform module to provision Deepfence ThreatMapper on GCP Compute Engine

Installation with custom TLS certificates

Custom TLS certificates are supported for the web application hosted on the console machine. On the console machine users have to place the certificate and private key on /etc/deepfence/certs folder. Deepfence looks for the file with .key and .crt extentions on the specified location on the host.

Deepfence Agent

In order to check a host for vulnerabilities, or if docker images or containers that have to be checked for vulnerabilities are saved on different hosts, then the Deepfence agent needs to be installed on those hosts.

Pre-Requisites for Deepfence Agent

Installation of Deepfence Agent

Installation procedure for the Deepfence agent depends on the environment that is being used. Instructions for installing Deepfence agent on some of the common platforms are given in detail below:

Deepfence Agent on Standalone VM or Host

Installing the Deepfence Agent is now as easy as:

1. Get Deepfence api key from UI: Goto Settings -> User Management, copy api key
2. In the following docker run command, replace x.x.x.x with the IP address of the Management Console and replace C8TtyEtNB0gBo1wGhpeAZICNSAaGWw71BSdS2kLELY0 with api Key

   docker run -dit --cpus=".2" --name=deepfence-agent --restart on-failure --pid=host --net=host --privileged=true -v /sys/kernel/debug:/sys/kernel/debug:rw -v /var/log/fenced -v /var/run/docker.sock:/var/run/docker.sock -v /:/fenced/mnt/host/:ro -e USER_DEFINED_TAGS="" -e DF_BACKEND_IP="x.x.x.x" -e DEEPFENCE_KEY="C8TtyEtNB0gBo1wGhpeAZICNSAaGWw71BSdS2kLELY0" deepfenceio/deepfence_agent_ce:latest

3. Optionally the agent node can be tagged using USER_DEFINED_TAGS="" in the above command. Tags should be comma separated. Example: “dev,front-end”

Deepfence Agent on Amazon ECS

For detailed instructions to deploy agents on Amazon ECS, please refer to our Amazon ECS wiki page.

Deepfence Agent Helm chart for Kubernetes

• Start deepfence agent (replace x.x.x.x with the IP address of the Management Console and C8TtyEtNB0gBo1wGhpeAZICNSAaGWw71BSdS2kLELY0 with api key)

# helm v2
helm install --repo https://deepfence.github.io/ThreatMapper/files/helm-chart deepfence-agent 
    --name=deepfence-agent 
    --set managementConsoleIp=x.x.x.x 
    --set deepfenceKey=C8TtyEtNB0gBo1wGhpeAZICNSAaGWw71BSdS2kLELY0
# helm v3
helm install deepfence-agent --repo https://deepfence.github.io/ThreatMapper/files/helm-chart deepfence-agent 
    --set managementConsoleIp=x.x.x.x 
    --set deepfenceKey=C8TtyEtNB0gBo1wGhpeAZICNSAaGWw71BSdS2kLELY0

• Delete deepfence agent

# helm v2
helm delete --purge deepfence-agent
# helm v3
helm delete deepfence-agent

Deepfence Agent on Google GKE

For detailed instructions to deploy agents on Google GKE, please refer to our Google GKE wiki page.

Deepfence Agent on Azure AKS

For detailed instructions to deploy agents on Azure Kubernetes Service, please refer to our Azure AKS wiki page.

Deepfence Agent on self-managed / on-premise Kubernetes

For detailed instructions to deploy agents on a Kubernetes cluster, please refer to our Self-managed/On-premise Kubernetes wiki page.