threatmapper.org

What It Is

Deepfence ThreatMapper is an open-source CNAPP designed to extend security capabilities into production environments. It discovers assets and running workloads across cloud, serverless, containers, applications, and operating systems, generates runtime SBOMs, and combines multiple vulnerability sources to identify vulnerable components. The Deepfence community also provides tools such as SecretScanner, YaraHunter, PacketStreamer, and FlowMeter, covering use cases including secret scanning, malware IOC scanning, distributed packet capture, and traffic classification.

Core Capabilities and Deployment

In terms of protection focus, ThreatMapper is more about cloud-native security posture and risk discovery than a traditional perimeter firewall. Its core capabilities include vulnerability discovery, exposed secret detection, configuration and compliance weakness checks, and prioritization by exploitability risk. Risk ranking takes into account CVSS, severity, exploit methods, and proximity to the attack surface, helping reduce the noise of queues based only on vulnerability scores. For deployment, it consists of a Management Console, Sensors, and Cloud Scanner tasks: the console checks configuration and compliance issues through infrastructure APIs, sensors are deployed on production hosts to collect SBOMs and telemetry, and cloud scanning tasks access local cloud APIs. This model is well suited to Kubernetes, container, and cloud host environments, but it also requires a certain level of operational capability.

Compliance, Integrations, and Management

For compliance, the main documentation explicitly mentions assessment of weak configurations against benchmarks such as CIS, PCI-DSS, and HIPAA, but does not provide compliance certifications for the product itself. Its integration capabilities are relatively open: YaraHunter can be used for CI/CD, image, running container, and file system scanning; SecretScanner outputs JSON; PacketStreamer can aggregate raw packets from multiple hosts into pcap files and hand them off to Zeek, Wireshark, Suricata, or machine learning models for analysis. On the management side, the console can generate topology maps and aggregate sensor data, but the reviewed materials do not specify details around alerting channels, ticketing systems, or SIEM integrations.

Pricing, Pros, and Cons

The materials emphasize that Deepfence open-source projects are 100% Open Source, with no phone-home, no restrictions, and no hidden features, making the value proposition strong. However, Enterprise pricing, SLA, and commercial support are not disclosed. Its strengths are broad coverage, open-source transparency, suitability for automation, and the ability to prioritize production-environment risks by exploitability. Limitations include a relatively complex deployment path, FlowMeter still being marked as an experimental tool, and Ebpfguard documentation still under development.

Who It’s For and Access from China

It is best suited for DevSecOps, security operations, and platform engineering teams with cloud-native infrastructure that want to build their own security capabilities. If a team needs ready-to-use SaaS, strong commercial support, or local compliance services, it may also need to evaluate Wiz, Prisma Cloud, Aqua Security, Sysdig Secure, or open-source alternatives such as Trivy, Grype, and Falco. Access from mainland China, payment methods, and localization support are not covered in the source text, so china_access can only be rated as unknown.