deepfence / deepfence/ThreatMapper

Runtime SBOM - eBPF plugin to track dependency loads

Open
#165 2 comments 0 reactions 3 assignees Claimed by @noboruma View on GitHub
enhancement needs-triage
Dominant language
TypeScript
Stars
5.3k
Forks
631
PR merge metrics
No merged PRs in 30d

Description

Add a plugin which speaks to discovery process over GRPC (with auth) and shares a list of runtime dependency loads by tracking open/close. This could get super noisy due to frequency of open/close so this could be done as follows:

a) Add a cmd line option on agent side --track-deploads=true, only upon enabling this we should deploy this plugin (atleast initially), to be switched off by default. The dependency loads should be tracked only for scanned vms and containers, not otherwise!

b) Initially lets just focus on all the languages we support for scanning, we can expand as we keep adding more scanning targets

c) Once this is ready, we can start showing actual processes which could be under attack instead of stopping our attack paths at VMs and containers.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.