Distributed network based vulnerability scanning via endpoint agent deployment

1. A method for passively scanning a network, the method comprising:

sniffing, by an endpoint passive scanner deployed on an endpoint device, network traffic traveling to and/or from the endpoint device, the network traffic comprising a plurality of packets;

detecting, by the endpoint passive scanner, information that facilitates discovery of one or more assets of the network and/or identification of one or more vulnerabilities in one or more network entities and/or one or more services based on the sniffed network traffic; and

performing, by an endpoint agent running on the endpoint device, a vulnerability scan of the endpoint device,

wherein the endpoint passive scanner is deployed as a passive scan library linked to the endpoint agent running on the endpoint device, and

wherein the endpoint passive scanner is configured to run when the endpoint agent calls the passive scan library.

2. The method of claim 1 , further comprising:

discovering, by the endpoint passive scanner, the one or more assets of the network and/or identifying the one or more vulnerabilities based on the detected information.

3. The method of claim 2 ,

wherein discovering the one or more assets includes discovering attributes of the one or more assets, and/or

wherein identifying the one or more vulnerabilities includes identifying attributes of the one or more vulnerabilities.

4. The method of claim 2 , further comprising:

providing, by the endpoint passive scanner, an asset-vulnerability report comprising the one or more discovered assets and/or the one or more identified vulnerabilities to a vulnerability manager (VM),

wherein the VM is external to the endpoint device.

5. The method of claim 4 , wherein the VM is configured to build a network topology of the network based on one or more asset-vulnerability reports from one or more endpoint passive scanners.

6. The method of claim 4 , further comprising:

correlating, by the endpoint agent and/or the endpoint passive scanner, the one or more discovered assets and/or the one or more identified vulnerabilities with the vulnerability scan; and

providing, by the endpoint agent and/or the endpoint passive scanner, a correlation report to the VM, the correlation report comprising a result of correlating the one or more discovered assets and/or the one or more identified vulnerabilities with the vulnerability scan.

7. The method of claim 4 , further comprising:

providing, by the endpoint agent, a vulnerability scan report to the VM, the vulnerability scan report comprising a result of performing the vulnerability scan.

8. The method of claim 7 , wherein the VM is configured to correlate the one or more discovered assets and/or the one or more identified vulnerabilities of the asset-vulnerability report with the vulnerability scan report.

9. The method of claim 1 , further comprising:

providing, by the endpoint passive scanner, a detection report comprising the detected information to a vulnerability manager (VM),

wherein the VM is external to the endpoint device.

10. The method of claim 9 , wherein the VM is configured to discover the one or more assets of the network and/or identify the one or more vulnerabilities in the one or more network entities and/or the one or more services based on one or more detection reports from one or more endpoint passive scanners.

11. The method of claim 9 , wherein the VM is configured to build a network topology of the network based on one or more detection reports from one or more endpoint passive scanners.

12. The method of claim 9 , further comprising:

providing, by the endpoint agent, a vulnerability scan report to the VM, the vulnerability scan report being a report of a result of performing the vulnerability scan.

13. The method of claim 12 , wherein the VM is configured to correlate the one or more discovered assets and/or the one or more identified vulnerabilities with the vulnerability scan report.

14. The method of claim 1 , further comprising:

calling, by the endpoint agent, the passive scan library upon startup of the endpoint device.

15. The method of claim 1 , wherein the one or more assets of the network include any combination of:

one or more network entities,

one or more applications and/or services running on the one or more network entities, and

operating systems running on the one or more network entities.

16. The method of claim 15 , wherein the one or more vulnerabilities of the network include one or both of:

one or more vulnerabilities associated with one or more applications running on one or more network entities, and

one or more vulnerabilities associated with one or more services running on the one or more network entities.

17. A method for passively scanning a network, the method comprising:

obtaining information that is detected based on network traffic traveling to and/or from an endpoint device that is sniffed by an endpoint passive scanner deployed on the endpoint device, the network traffic comprising a plurality of packets;

discovering one or more assets of the network and/or identifying one or more vulnerabilities in one or more network entities and/or one or more services based on the obtained information; and

performing, by an endpoint agent running on the endpoint device, a vulnerability scan of the endpoint device,

wherein the endpoint passive scanner is deployed as a passive scan library linked to the endpoint agent running on the endpoint device, and

wherein the endpoint passive scanner is configured to run when the endpoint agent calls the passive scan library.

18. The method of claim 17 ,

wherein discovering the one or more assets includes discovering attributes of the one or more assets, and/or

wherein identifying the one or more vulnerabilities includes identifying attributes of the one or more vulnerabilities.

19. The method of claim 17 ,

wherein obtaining is performed by the endpoint passive scanner, and

wherein discovering and/or identifying are performed by the endpoint passive scanner.

20. The method of claim 19 , further comprising:

correlating, by the endpoint agent and/or the endpoint passive scanner, the one or more discovered assets and/or the one or more identified vulnerabilities with the vulnerability scan.

21. The method of claim 19 , further comprising:

building, by a vulnerability manager (VM), a network topology of the network based on the one or more discovered assets and/or the one or more identified vulnerabilities,

wherein the VM is external to the endpoint device.

22. The method of claim 21 , further comprising:

correlating, by the VM, the one or more discovered assets and/or the one or more identified vulnerabilities with the vulnerability scan.

23. The method of claim 17 ,

wherein obtaining is performed by the endpoint passive scanner, and

wherein discovering and/or identifying are performed by a vulnerability manager (VM) based on the obtained information, the VM being external to the endpoint device.

24. The method of claim 23 , further comprising:

building, by a vulnerability manager (VM), a network topology of the network based on the obtained information.

25. The method of claim 23 , further comprising:

correlating, by the VM, the one or more discovered assets and/or the one or more identified vulnerabilities with the vulnerability scan.

26. The method of claim 17 ,

wherein the one or more assets of the network include any combination of:

one or more network entities,

one or more applications and/or services running on the one or more network entities, and

operating systems running on the one or more network entities, and

wherein the one or more vulnerabilities include one or both of:

one or more vulnerabilities associated with one or more applications running on one or more network entities, and

one or more vulnerabilities associated with one or more services running on the one or more network entities.

27. The method of claim 17 ,

obtaining, from a passive scanner deployed inside the network, other information that is detected based on other network traffic traveling to and/or from a plurality of assets of the network,

wherein the endpoint passive scanner is one of the plurality of assets.

28. An endpoint device configured to passively scan a network, comprising:

a memory; and

at least one processor coupled to the memory,

wherein when an endpoint passive scanner is deployed on the endpoint device, the at least one processor and the memory are configured to:

sniff network traffic traveling to and/or from the endpoint device, the network traffic comprising a plurality of packets; and

detect information that facilitates discovery of one or more assets of the network and/or identification of one or more vulnerabilities in one or more network entities and/or one or more services based on the sniffed network traffic, and

wherein when an endpoint agent is deployed on the endpoint device, the at least one processor and the memory are configured to:

perform a vulnerability scan of the endpoint device,

wherein the endpoint passive scanner is deployed as a passive scan library linked to the endpoint agent running on the endpoint device, and

wherein the endpoint passive scanner is configured to run when the endpoint agent calls the passive scan library.