Deepfactor Support Matrix

With Deepfactor, you can:

1. Scan your artifacts (container images / filesystem) to generate SBOMs and find SCA vulnerabilities
2. Observe your running workloads (container instances / non-containerized applications) for runtime risks
3. Correlate findings from artifact scans and running workloads to prioritize vulnerability remediation based on runtime reachability.

The support matrix for each of the previous cases is described below.

Support Matrix For Artifact Scanning #

Deepfactor’s artifact scanner detects both OS packages and language specific application dependencies during the scan. It then retrieves vulnerability information from multiple data sources listed in the following document:

Deepfactor Scanner data sources

Support matrix for container scans #

Deepfactor detects official OS packages installed using the package manager and does not detect self-compiled packages/binaries. The following table shows the list of supported container image types.

An artifact scan can be initiated from any supported operating system listed above in addition to Windows (Windows 10 or later) or macOS hosts (macOS 12 or later).

Support matrix for language specific dependencies detection #

Deepfactor can detect language specific application dependencies in your filesystem and container images. It scans the files present in your artifact and looks for language specific dependencies files (for example, package-lock.json, Gemfile.lock, and so forth) to gather the list of application dependencies. Deepfactor then tabulates the vulnerabilities associated with them using data from the vulnerability sources listed here:

Deepfactor Scanner data sources

The following table provides the support matrix for language specific dependencies that are detected by the Deepfactor scanner.

OS Support Matrix For Runtime SCA & Runtime Security #

In addition to scanning artifacts, Deepfactor can also observe running workloads (whether running inside a container or not) to detect runtime security risks. While Deepfactor instrumentation technology is language agnostic and can observe applications written in any programming language, there are limitations on which OS distribution your application is running, as shown in the following table.

Distributions Not Listed Above

• Any Linux Distribution running glibc verison >= 2.17 (or musl >= 1.1.20-r5 for Alpine) is supported by Deepfactor, but telemetry data may be limited if the distribution doesn’t use rpm, dpkg or apk package management. (e.g. Arch Linux)

Kubernetes deployments

• For running kubernetes workloads with Deepfactor, we provide a mutating admission webhook. The minimum kubernetes version supported by Deepfactor’s mutating admission webhook is 1.23.

Which scenarios are not supported by Deepfactor for artifact scanning?

• Android and iOS applications/hosts
• Windows containers (eg, containers with Windows applications)

Which application types are not supported by Deepfactor for runtime SCA/runtime security?

• Android and iOS applications
• Windows applications
• macOS applications
• Statically linked applications (other than Go applications)

Serverless functions

Serverless functions can be scanned by the Deepfactor artifact scanner if any of the following scenarios apply:

• The function is deployed in a container using one of the supported language configurations listed above
• The function’s source code is available and uses one of the supported language configurations listed above

Network requirements

• In order to post artifact scan results and upload application telemetry, the product requires network connectivity to the Deepfactor SaaS management portal. Customers using airgapped environments may opt to install our self-managed on-premise version.

Other notes

• Deepfactor sets LD_PRELOAD to inject the Deepfactor runtime into your application. If you are using another tool that is setting LD_PRELOAD, Deepfactor will not be able to observe your running application