Mondoo : Native Security & Vulnerability Risk Management

Mondoo Cloud is a native security & vulnerability risk management.

Quick Start

Installing

Workstation

export MONDOO_REGISTRATION_TOKEN=’changeme’
curl -sSL http://mondoo.io/download.sh | bash

Service

export MONDOO_REGISTRATION_TOKEN=’changeme’
curl -sSL http://mondoo.io/install.sh | bash

For other installation methods, have a look at our documentation.

Run a scan:

# scan a docker image from remote registry
mondoo vuln -t docker://centos:7

# scan docker container (get ids from docker ps)
mondoo vuln -t docker://00fa961d6b6a

# scan a ssh instance
mondoo vuln -t ssh://ec2-user@54.76.229.223

Also Read – Ehtools : Penetration Tools That Can Be Explored Easily

Repository Structure

Deployment

• ansible – Ansible role for the tool
• chef – Chef cookbook for the tool
• install.sh – The tool Agent Bash Installer for Servers
• download.sh – The tool Agent Bash Downloader for Workstation
• Dockerfile – Build script for official the tool container

Integration

• packer-provisioner – The tool Packer Provisioner
• terraform-provisioner – The tool Terrafrom Provisioner

Examples

• ansible-aws-ec2 – Ansible Playbook to deploy the tool Agents
• chef-aws-ec2 – Chef Wrapper Cookbook to deploy the tool Agents
• cloudinit – Lauch instance on AWS with the tool Agent
• docker – Play with Docker & the tool
• packer-aws – Build & Scan AMI on AWS
• packer-digitalocean – Build & Scan image on Digitalocean
• terraform-aws – Launch & Scan instance on AWS
• terraform-digitalocean – Launch & Scan instance on Digitalocean
• vagrant – Spin-up the tool agents in Vagrant

Docs

• docs – Source for the tool documentation (uses docsify)