Deepfence ThreatMapper vs Tetragon

Deepfence ThreatMapper is a self-hosted security tool that discovers production workloads and ranks threats by exploit risk. It maps pods, containers, applications, and infrastructure, then generates runtime software bills of materials for running workloads and operating systems and checks them against multiple vulnerability feeds. It also detects exposed keys, tokens, and passwords in containers and host filesystems, and evaluates infrastructure settings against CIS, PCI-DSS, HIPAA, and other benchmarks. The Threat Graph links vulnerability, secret, and compliance findings with network flows, security groups, and live status. Its management console runs in containers on a Docker host or dedicated Kubernetes cluster, providing HTTPS administration and API automation. One console can manage different workload types across on-premise and cloud deployments. Documented integrations include Slack, PagerDuty, Jira, Splunk, ELK, Sumo Logic, and AWS S3; image-build scanning supports CircleCI, Jenkins, and GitLab. The project is free under the Apache 2 license. Windows Server support is experimental and not suitable for production use.

Tetragon is a Kubernetes-aware security observability and runtime enforcement tool for Linux, container, and Kubernetes workloads. It uses eBPF to monitor activity, filter events, and enforce policies in the kernel in real time. Process reports can include executed binaries, command-line arguments, user IDs, parent processes, and start times. Tetragon also monitors file access and changes, and can block unauthorized file operations at the kernel level. Kubernetes policies can filter activity by namespace, pod labels, and container fields, with support for containerd and CRI-O. Network visibility ties events to processes and workloads and tracks connections, socket lifecycle, and bytes sent or received. The tool also monitors credential changes, kernel module activity, and eBPF program loads and interactions. Findings are available as JSON logs or through gRPC. Installation options include Helm on Kubernetes, released Linux packages, and a container image. Tetragon is a Cilium sub-project and a CNCF project, and is available as an open-source project with no paid plans listed.