Container vulnerability management by a data platform

1. A method comprising:

accessing, by a data platform, an alert generation policy associated with an entity that deploys containers in a cloud environment, the alert generation policy modifiable by the entity and specifying criteria for providing alerts associated with one or more vulnerabilities associated with the containers;

detecting, by the data platform based on a scan of a container included in the containers, a vulnerability associated with the container;

determining, by the data platform, an attribute of the vulnerability;

determining a severity score of the vulnerability;

determining a time duration between a detection of the vulnerability by scan and a detection of the vulnerability in the depository; and

generating an alert if the severity score and the time duration meets a threshold specified in the alert policy.

2. The method of claim 1 , further comprising abstaining, by the data platform, from generating the alert when the attribute does not meet the criteria specified in the alert generation policy.

3. The method of claim 1 , further comprising:

receiving, by the data platform, data representative of a request by the entity to update the alert generation policy; and

updating, by the data platform based on the request, one or more of the criteria of the alert generation policy.

4. The method of claim 1 , further comprising presenting the alert via a graphical user interface displayed by a computing device associated with one or more of the entity or the data platform.

5. The method of claim 1 , wherein the scan of the container is performed using an agentless scan operation with respect to the container.

6. The method of claim 5 , wherein the agentless scan operation is performed, prior to the container being deployed in the cloud environment, by an inline scanner located in a software supply chain computing environment.

7. The method of claim 1 , wherein the scan of the container is performed by an agent in the cloud environment while the container is in a deployed state in the cloud environment.

8. The method of claim 1 , wherein the scan of the container is performed by scanning one or more of a container image associated with the container, a repository associated with the container image, or a deployed container instance of the container image.

9. The method of claim 1 , wherein the severity score comprises a Common Vulnerability Scoring System (CVSS) score.

10. The method of claim 1 , wherein:

the determining the attribute of the vulnerability comprises determining a whitelist status of the vulnerability; and

the generating the alert comprises generating the alert when the whitelist status indicates that the vulnerability is whitelisted.

11. The method of claim 1 , wherein:

the determining the attribute of the vulnerability comprises determining a whitelist status of the container; and

the generating the alert comprises generating the alert when the whitelist status indicates that the container is whitelisted.

12. The method of claim 1 , wherein:

the detecting the vulnerability based on the scan of the container comprises detecting a plurality of vulnerabilities associated with the container;

the determining the attribute of the vulnerability comprises determining a total number of the plurality of vulnerabilities;

the generating the alert comprises

determining that the alert generation policy specifies a total vulnerability threshold, and

generating the alert when the total number meets the total vulnerability threshold.

13. The method of claim 1 , wherein:

the determining the attribute of the vulnerability comprises determining that the vulnerability has not previously been detected within a repository associated with the container; and

the generating the alert comprises generating the alert when the alert generation policy specifies that the alert is to be generated a first time that the vulnerability is detected within the repository.

14. The method of claim 1 , further comprising:

determining a first condition by determining that a container image associated with the container is not part of an official registry associated with the entity;

determining a second condition by determining that the vulnerability has a severity score above a threshold; and

determining a third condition by determining that one or more container instances of the container image are executing in the cloud environment;

wherein the generating the alert comprises generating the alert based on the determining of the first condition, the second condition, and the third condition.

15. The method of claim 1 , wherein:

the detecting the vulnerability based on the scan of the container comprises detecting a vulnerability of a container image associated with the container;

the determining the attribute of the vulnerability comprises determining a severity score for the vulnerability of the container image;

the method further comprises determining that one or more container instances of the container image are executing in the cloud environment; and

the generating the alert comprises generating, in accordance with the alert generation policy, the alert based on the severity score of the vulnerability of the container image meeting a severity score threshold and the determining that the one or more container instances of the container image are executing in the cloud environment.

16. The method of claim 15 , further comprising:

determining that the one or more container instances are executing as privileged containers; and

the generating the alert is further based on the determining that the one or more container instances are executing as the privileged containers.

17. A system comprising:

a memory storing instructions; and

one or more processors communicatively coupled to the memory and configured to execute the instructions to perform a process comprising:

accessing an alert generation policy associated with an entity that deploys containers in a cloud environment, the alert generation policy modifiable by the entity and specifying criteria for providing alerts associated with one or more vulnerabilities associated with the containers;

detecting, based on a scan of a container included in the containers, a vulnerability associated with the container;

determining an attribute of the vulnerability;

determining a severity score of the vulnerability;

determining a time duration between a detection of the vulnerability by scan and a detection of the vulnerability in the depository;

and

generating an alert if the severity score and the time duration meets a threshold specified in the alert policy.

18. A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

accessing an alert generation policy associated with an entity that deploys containers in a cloud environment, the alert generation policy modifiable by the entity and specifying criteria for providing alerts associated with one or more vulnerabilities associated with the containers;

detecting, based on a scan of a container included in the containers, a vulnerability associated with the container;

determining an attribute of the vulnerability;

determining a severity score of the vulnerability:

determining a time duration between a detection of the vulnerability by scan and a detection of the vulnerability in the depository; and

generating an alert if the severity score and the time duration meets a threshold specified in the alert policy.