Updating security controls or policies based on analysis of collected or created metadata

1. A computer-implemented method comprising:

collecting, by at least one computing device, metadata, the metadata comprising attributes of one or more platforms;

evaluating, based on the collected metadata, at least one lifecycle policy, the lifecycle policy controlling at least one of the collecting of the metadata or a transformation of the metadata;

providing derived metadata based on the evaluating of the at least one lifecycle policy, the derived metadata determined based on the lifecycle policy;

analyzing, by the at least one computing device, the derived metadata; and

based on analyzing the derived metadata, performing at least one action;

wherein the at least one action comprises updating or implementing at least one of a security policy or a control for at least one object, wherein the at least one object is on at least one platform, wherein the derived metadata includes metadata collected from the at least one platform, and wherein the at least one object comprises a virtual machine.

2. The method of claim 1 , wherein the derived metadata includes metadata collected from at least two platforms.

3. The method of claim 1 , wherein the at least one action further comprises reporting network communication flows to a computing device.

4. The method of claim 3 , wherein reporting the network communication flows comprises presenting, based on the derived metadata, a display to a user of the computing device, and wherein the display includes a graphical representation of relationships between objects on the at least one platform.

5. The method of claim 1 , wherein analyzing the derived metadata comprises evaluating, based on the derived metadata, at least one security and analytics policy.

6. The method of claim 5 , wherein the at least one action further comprises performing, based on evaluating the at least one security and analytics policy, at least one security action.

7. The method of claim 6 , wherein the at least one security action is at least one of modifying at least one firewall rule for at least one object, sending a communication to a computing device, presenting a display to a user, implementing at least one security control, or updating at least one security control.

8. The method of claim 5 , wherein evaluating at least one security and analytics policy comprises evaluating a presence or absence of metadata on at least one object in inventory, and wherein the at least one action further comprises invoking at least one security action associated with the at least one object.

9. The method of claim 8 , further comprising, after completing the at least one security action, adding metadata to the at least one object, or removing metadata from the at least one object.

10. The method of claim 1 , further comprising applying the derived metadata to inventory on the at least one platform.

11. The method of claim 1 , further comprising detecting a threat associated with at least one identified asset, wherein performing at least one of collecting or creating metadata comprises creating a tag associated with the detected threat, and the method further comprising applying the tag to the at least one identified asset.

12. The method of claim 1 , wherein the collecting metadata comprises collecting the metadata from the one or more platforms, and wherein the one or more platforms are selected from the group consisting of: a virtual machine (VM), a hypervisor, a cloud, and a container platform.

13. A system comprising:

at least one processor; and

memory in communication with the at least one processor and storing instructions that, when executed by the at least one processor, cause the system to:

collect metadata from objects on at least one platform;

evaluate, based on the collected metadata, at least one lifecycle policy to provide derived metadata, the lifecycle policy controlling at least one of the collecting of the metadata or a transformation of the metadata, the derived metadata determined based on the lifecycle policy;

evaluate, based on the derived metadata, at least one security and analytics policy; and

based on evaluation of the at least one security and analytics policy, perform at least one action on at least one first object, wherein the at least one first object is on the at least one platform;

wherein the at least one action comprises updating or implementing at least one of a security policy or a control for the at least one first object, wherein the derived metadata includes metadata collected from the at least one platform, and wherein the at least one first object comprises a virtual machine.

14. The system of claim 13 , wherein the instructions further cause the system to:

collect, from the at least one platform using an API query, inventory data regarding each of the objects, wherein the inventory data uniquely identifies each object on the at least one platform; and

based on the at least one lifecycle policy, apply the derived metadata to each of the objects, wherein applying the derived metadata comprises updating the inventory data for each object.

15. The system of claim 14 , wherein the instructions further cause the system to transmit, based on evaluation of the at least one security and analytics policy, an alert, wherein the alert includes an identification of a detected threat and an associated object.

16. The system of claim 13 , wherein the instructions further cause the system to:

receive a first control policy from a security control on a first platform; and

update the at least one security and analytics policy to include the first control policy.

17. The system of claim 13 , wherein the collected metadata includes data inventory attributes, a state, or data received over a network from at least one computing device.

18. The system of claim 13 , wherein evaluating the at least one lifecycle policy comprises determining whether a condition is satisfied by a second object, and wherein providing the derived metadata includes creating the metadata for the second object in response to satisfying the condition.