Modular agentless scanning of cloud workloads
An illustrative method includes a scanning driver providing an interface between data included in a data structure located within a compute environment and one or more scan modules included in an unprivileged agentless workload scanning configuration executing within the compute environment, the one or more scan modules configured to concurrently analyze the data in accordance with one or more respective scan use cases; receiving a request to add a new scan module to the unprivileged agentless workload scanning configuration, the new scan module associated with a new scan use case different than the one or more respective scan use cases, and dynamically loading, based on the request and while the one or more scan modules are concurrently analyzing the data, the new scan module into the unprivileged agentless workload scanning configuration.
1. A method comprising:
providing, by a scanning driver associated with a data platform, an interface between data included in a data structure located within a compute environment and one or more scan modules included in an unprivileged agentless workload scanning configuration executing within the compute environment, the one or more scan modules configured to concurrently analyze the data in accordance with one or more respective scan use cases;
receiving, by the scanning driver, a request to add a new scan module to the unprivileged agentless workload scanning configuration, the new scan module associated with a new scan use case different than the one or more respective scan use cases; and
dynamically loading, by the scanning driver based on the request and while the one or more scan modules are concurrently analyzing the data, the new scan module into the unprivileged agentless workload scanning configuration, the dynamically loading allowing the new scan module to begin analyzing the data in accordance with the new scan use case concurrently with the analyzing performed by the one or more scan modules.
2. The method of claim 1 , wherein the providing the interface to a particular scan module included in the one or more scan modules comprises:
obtaining, from the data structure, a filename list identifying filenames of files included in the data;
receiving, from the particular scan module based on the filename list, a list of one or more required files included in the data that the particular scan module needs to analyze;
obtaining, from the data structure, the one or more required files; and
providing a copy of the one or more required files to the particular scan module for analysis.
3. The method of claim 1 , wherein the providing the interface comprises one or more of providing garbage collection or providing application programming interface (API) limit protection with respect to the one or more scan modules.
4. The method of claim 1 , wherein the receiving the request is performed while the one or more scan modules are concurrently analyzing the data.
5. The method of claim 1 , wherein the receiving the request comprises receiving data representative of the new scan module.
6. The method of claim 1 , wherein the data structure comprises one or more of a snapshot of a workload executing within the compute environment or a volume located within the compute environment.
7. The method of claim 1 , further comprising causing, by the data platform, the scanning driver to be installed within the compute environment, the compute environment associated with an entity that is a customer of the data platform.
8. The method of claim 1 , wherein the request is received from the data platform by way of a network.
9. The method of claim 1 , wherein the one or more scan modules and the new scan module are all configured to output analysis result data using a same schema.
10. The method of claim 9 , further comprising transmitting the analysis result data to the data platform.
11. The method of claim 1 , further comprising:
receiving, by the scanning driver, a request to remove a particular scan module from the unprivileged agentless workload scanning configuration; and
directing, by the scanning driver based on the request to remove the particular scan module, the particular scan module to abstain from analyzing the data.
12. The method of claim 1 , wherein a particular use case included in the one or more respective use cases or the new use case comprises malware detection.
13. The method of claim 1 , wherein a particular use case included in the one or more respective use cases or the new use case comprises malware detection with respect to the workload.
14. The method of claim 1 , wherein a particular use case included in the one or more respective use cases or the new use case comprises compliance checking with respect to the workload.
15. The method of claim 1 , wherein a particular use case included in the one or more respective use cases or the new use case comprises forensics file retention with respect to the workload.
16. The method of claim 1 , wherein a particular use case included in the one or more respective use cases or the new use case comprises data classification with respect to the workload.
17. The method of claim 1 , wherein a particular use case included in the one or more respective use cases or the new use case comprises secrets inventorying with respect to the workload.
18. The method of claim 1 , wherein a particular use case included in the one or more respective use cases or the new use case comprises package enumeration and software bill of materials (SBOM) generation with respect to the workload.
19. A system comprising:
a memory storing instructions; and
one or more processors communicatively coupled to the memory and configured to execute the instructions to perform a process comprising:
providing an interface between data included in a data structure located within a compute environment and one or more scan modules included in an unprivileged agentless workload scanning configuration executing within the compute environment, the one or more scan modules configured to concurrently analyze the data in accordance with one or more respective scan use cases;
receiving a request to add a new scan module to the unprivileged agentless workload scanning configuration, the new scan module associated with a new scan use case different than the one or more respective scan use cases; and
dynamically loading, based on the request and while the one or more scan modules are concurrently analyzing the data, the new scan module into the unprivileged agentless workload scanning configuration, the dynamically loading allowing the new scan module to begin analyzing the data in accordance with the new scan use case concurrently with the analyzing performed by the one or more scan modules.
20. A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
providing an interface between data included in a data structure located within a compute environment and one or more scan modules included in an unprivileged agentless workload scanning configuration executing within the compute environment, the one or more scan modules configured to concurrently analyze the data in accordance with one or more respective scan use cases;
receiving a request to add a new scan module to the unprivileged agentless workload scanning configuration, the new scan module associated with a new scan use case different than the one or more respective scan use cases; and
dynamically loading, based on the request and while the one or more scan modules are concurrently analyzing the data, the new scan module into the unprivileged agentless workload scanning configuration, the dynamically loading allowing the new scan module to begin analyzing the data in accordance with the new scan use case concurrently with the analyzing performed by the one or more scan modules.