Techniques for cybersecurity inspection of multiple layer virtual workloads

1 . A method for cybersecurity inspection of a volume based on image layers, comprising:

generating an inspectable disk based on a volume of a virtual instance that is deployed in a production computing environment, the volume generated based on a plurality of images, each image corresponding to a unique layer of a plurality of layers;

parsing a manifest associated with the volume, the manifest including an identifier of each unique layer to determine an order of layers based on the manifest, wherein a first layer of the virtual instance is deployed prior to a second layer of the virtual instance;

initiating inspection for a cybersecurity object on a first layer of the plurality of layers;

inspecting the second layer for a second cybersecurity object, in response to detecting a cybersecurity object on the first layer;

initiating a mitigation action in response to detecting the cybersecurity object; and

deleting an instruction to inspect the second layer for a second cybersecurity object, in response to detecting that the first layer does not include a first cybersecurity object.

2 . The method of claim 1 , further comprising:

initiating inspection for the cybersecurity object on the second layer, in response to determining that inspection of the first layer is complete.

3 . The method of claim 1 , further comprising:

searching the manifest for a predetermined data field; and

extracting a value associated with the predetermined data field from the manifest.

4 . The method of claim 1 , further comprising:

generating a node representing the cybersecurity object on a security graph, wherein the security graph includes a representation of the production computing environment in which the virtual instance is deployed; and

connecting the node representing the cybersecurity object to a node representing the virtual instance in the security graph.

5 . The method of claim 1 , further comprising:

deprovisioning the virtual instance in response to detecting the cybersecurity object.

6 . The method of claim 1 , further comprising:

initiating the mitigation action further in response to detecting a plurality of cybersecurity objects.

7 . The method of claim 1 , wherein the cybersecurity object is any one of: an endpoint, an open port, a password, a certificate, a cryptographic key, an encryption key, a decryption key, a policy, a file, an application, an operating system, a registry file, a directory name, a hash value, a code object, a malware code, a malware signature, and any combination thereof.

8 . A non-transitory computer-readable medium storing a set of instructions for cybersecurity inspection of a volume based on image layers, the set of instructions comprising:

one or more instructions that, when executed by one or more processors of a device, cause the device to:

generate an inspectable disk based on a volume of a virtual instance that is deployed in a production computing environment, the volume generated based on a plurality of images, each image corresponding to a unique layer of a plurality of layers;

parse a manifest associated with the volume, the manifest including an identifier of each unique layer to determine an order of layers based on the manifest, wherein a first layer of the virtual instance is deployed prior to a second layer of the virtual instance;

initiate inspection for a cybersecurity object on a first layer of the plurality of layers;

inspect the second layer for a second cybersecurity object, in response to detecting a cybersecurity object on the first layer;

initiate a mitigation action in response to detecting the cybersecurity object; and

delete an instruction to inspect the second layer for a second cybersecurity object, in response to detecting that the first layer does not include a first cybersecurity object.

9 . A system for cybersecurity inspection of a volume based on image layers comprising:

a processing circuitry; and a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

generate an inspectable disk based on a volume of a virtual instance that is deployed in a production computing environment, the volume generated based on a plurality of images, each image corresponding to a unique layer of a plurality of layers; parse a manifest associated with the volume, the manifest including an identifier of each unique layer to determine an order of layers based on the manifest, wherein a first layer of the virtual instance is deployed prior to a second layer of the virtual instance;

initiate inspection for a cybersecurity object on a first layer of the plurality of layers;

inspect the second layer for a second cybersecurity object, in response to detecting a cybersecurity object on the first layer;

initiate a mitigation action in response to detecting the cybersecurity object; and

delete an instruction to inspect the second layer for a second cybersecurity object, in response to detecting that the first layer does not include a first cybersecurity object.

10 . The system of claim 9 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

initiate inspection for the cybersecurity object on the second layer, in response to determining that inspection of the first layer is complete.

11 . The system of claim 9 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

search the manifest for a predetermined data field; and

extract a value associated with the predetermined data field from the manifest.

12 . The system of claim 9 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

generate a node representing the cybersecurity object on a security graph, wherein the security graph includes a representation of the production computing environment in which the virtual instance is deployed; and

connect the node representing the cybersecurity object to a node representing the virtual instance in the security graph.

13 . The system of claim 9 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

deprovision the virtual instance in response to detecting the cybersecurity object.

14 . The system of claim 9 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

initiate the mitigation action further in response to detecting a plurality of cybersecurity objects.

15 . The system of claim 9 , wherein the cybersecurity object is any one of:

an endpoint, an open port, a password, a certificate, a cryptographic key, an encryption key, a decryption key, a policy, a file, an application, an operating system, a registry file, a directory name, a hash value, a code object, a malware code, a malware signature, and any combination thereof.