Awesome Cybersecurity Blue Team
Section: DevSecOps · Static analysis for Terraform (infrastructure as code) to help detect CIS policy violations and prevent cloud security misconfiguration.
StaleScore 55
Entry
Checkov
Appears in 4 awesome lists
Static code analysis tool for scanning Infrastructure as Code (IaC) files for misconfigurations, with 750+ predefined policies covering Terraform, CloudFormation, Kubernetes, Docker, and Helm charts, plus CIS and AWS Foundations Benchmark compliance.
Found in these lists
Awesome Cybersecurity Blue Team - CN
Section: 云平台安全 · 对于Terraform（在DevOps实践中，代码即基础设施概念）的静态分析器。可以帮助检测CIS策略违规行为，并防止云安全策略配置错误; 补充：Terraform是一种安全有效地构建、更改和版本控制基础设施的工具(基础架构自动化的编排工具)[1]; 补充：CIS基准是安全配置系统的配置基线和最佳做法[2]
StaleScore 49
Hacking Tools
Section: Cloud Security · Static code analysis tool for scanning Infrastructure as Code (IaC) files for misconfigurations, with 750+ predefined policies covering Terraform, CloudFormation, Kubernetes, Docker, and Helm charts, plus CIS and AWS Foundations Benchmark compliance.
FreshScore 91
Static Analysis
Section: General · Static analysis tool for Terraform files (tf>=v0.12), preventing cloud misconfigs at build time.
FreshScore 95
Often listed next to it
Snyk
copyright: — Snyk Code finds security vulnerabilities based on AI. Its speed of analysis allow us to analyse your code in real time and deliver results when you hit the save button in your IDE. Supported languages are Java, JavaScript, Python, PHP, C#, Go and TypeScript. Integrations with GitHub,…
In 14 listsDetails
Trivy
A Simple and Comprehensive Vulnerability Scanner for Containers and other Artifacts, Suitable for CI. Trivy detects vulnerabilities of OS packages (Alpine, RHEL, CentOS, etc.) and application dependencies (Bundler, Composer, npm, yarn, etc.). Checks containers and filesystems.
In 10 listsDetails
blackbox
Safely store secrets in Git/Mercurial. Provides tooling to automatically encrypt secrets like passwords.
In 8 listsDetails
gVisor
gVisor is a user-space kernel, written in Go, that implements a substantial portion of the Linux system surface. It includes an Open Container Initiative (OCI) runtime called runsc that provides an isolation boundary between the application and the host kernel. The runsc runtime integrates with…
In 7 listsDetails
Falco
CNCF graduated runtime security standard originally created by Sysdig, monitoring syscalls and Kubernetes audit events in real time using eBPF to detect suspicious behaviors like shells spawned inside containers, privileged container creation, and unexpected outbound connections.
In 7 listsDetails
SonarQube
SonarQube empowers development teams with a code quality and security solution that deeply integrates into your enterprise environment; enabling you to deploy clean code consistently and reliably. SonarQube provides a free and open source Community Build.
In 6 listsDetails