Quick Start
Fleetfolio Threat Exposure Module setup and execution guide
Quick Start Guide
This guide explains how to set up and run the Fleetfolio Threat Exposure Module via Docker to operationally validate security findings and assess real-world threat exposure through Operational Acceptance Testing (OAT). The module consumes outputs from Fleetfolio Pentest and completes the OAT process by validating real-world risk, prioritization, and remediation workflows.
Install Docker
Ensure Docker is installed and running on your system.
sudo apt update && sudo apt install docker.io -y && sudo systemctl enable docker --nowError Fix
If the update fails, run:
sudo sed -i 's|http://http.kali.org|https://http.kali.org|' /etc/apt/sources.list && sudo apt-get clean && sudo apt-get update --fix-missingBefore running the Docker container, ensure you have the generated *.sqlite.db file from Fleetfolio Pentest. The container requires this file to be present in your current working directory to successfully bootstrap the web interface.
Docker Run
Launch the container.
sudo docker run --rm -it -p 9228:9228 -v "$PWD:/data" fleetfolio/threat-exposureIf multiple databases are detected in your current directory, the container will interactively prompt you to select the correct one via terminal input.
Custom Setup
If you want to import any results into the *.sqlite.db, create a new folder under the timestamps directory with the name of the tool that identified the issue and paste the results in JSON/JSONL/TXT/MD format.
Then, re-generate the *sqlite.db manually using the surveilr command shown below:
surveilr ingest files -r . --tenant-id NET1234 --tenant-name "Netspective" &&
sudo mv resource-surveillance.sqlite.db NET1234-2026-04-09-23-49-44.opsfolio-eaa-rssd.sqlite.dbCustom
Make sure you run this step inside the timestamps directory.
If you want to merge multiple *sqlite.db files into a single *sqlite.db, after creating interpretations, copy and paste the databases into a single folder and use the following command:
surveilr admin merge -p "interpretation_task_master" -p "tool_description"Merged Database
This will create a new merged database called resource-surveillance-aggregated.sqlite.db. Run the Fleetfolio Threat Exposure Docker image again to visualize the results.
How is this guide?
Last updated on