Leveraging information gathered using static analysis for remediating detected issues in a monitored deployment
Leveraging information gathered using static analysis for remediating detected issues in a monitored deployment, including: inspecting, using static code analysis, a non-executable representation of an application to identify one or more vulnerabilities in the application; detecting one more conditions in the monitored deployment; and initiating, based on information describing the one or more vulnerabilities in the application that were identified using static code analysis, a remediation workflow.
1 . A method of leveraging information gathered using static analysis for remediating detected issues in a monitored deployment, the method comprising:
inspecting, using static code analysis, a non-executable representation of an application to
identify one or more points for monitoring during execution of the application including one or more vulnerabilities in the application;
generating a customized monitoring program based on the static code analysis and inserting into an executable representation of the application, the customized monitoring program at each location in the executable representation of the application that corresponds to the identified one or more points in the application;
detecting during dynamic analysis of the application one or more exploitable conditions in the monitored deployment based on monitoring with the customized monitoring program the identified one or more points during execution of the application; and
initiating, based on information describing the one or more vulnerabilities in the application that were identified using static code analysis, a remediation workflow associated with the one or more exploitable conditions detected during dynamic analysis of the application.
2 . The method of claim 1 , further comprising:
modifying, based on detecting the one or more exploitable conditions, one or more static code analysis techniques of the static code analysis for the application.
3 . The method of claim 2 , wherein the static code analysis includes a taint analysis, wherein the taint analysis is based on one or more of symbolic execution or incorrectness logic.
4 . The method of claim 1 , wherein initiating a remediation workflow further comprises initiating a pull request to incorporate a modified version of the application into the monitored deployment.
5 . The method of claim 1 , wherein initiating a remediation workflow further comprises initiating a request to modify the monitored deployment based on an updated Infrastructure-as-Code (‘IaC’) template.
6 . The method of claim 1 further comprising updating, based on information describing the one or more vulnerabilities in the application that were identified using static code analysis, an IaC template associated with the monitored deployment.
7 . The method of claim 1 further comprising providing an indication of the one or more vulnerabilities, wherein the customized monitoring program is dynamically generated in response to the static code analysis and the customized monitoring program is unique to a particular customer, unique to the application, unique to a particular executable, unique to a particular Docker build, unique to a particular environment, or unique to a particular point in time.
8 . The method of claim 7 , wherein a severity of an anomaly indicated in a polygraph is based on a vulnerability corresponding to the anomaly being identified by the static code analysis.
9 . The method of claim 7 , wherein the indication of the one or more vulnerabilities comprises an alert.
10 . The method of claim 9 , wherein the alert is presented during a stage of a continuous integration/continuous deployment (CI/CD) pipeline prior to an execution of the application.
11 . A system comprising:
a memory; and
one or more processing devices, operatively coupled to the memory, the one or more processing devices configured to:
inspect, using static code analysis, a non-executable representation of an application to identify one or more points for monitoring during execution of the application including one or more vulnerabilities in the application;
generate a customized monitoring program based on the static code analysis and insert into an executable representation of the application, the customized monitoring program at each location in the executable representation of the application that corresponds to the identified one or more points in the application;
detect during dynamic analysis of the application one or more exploitable conditions in the monitored deployment based on monitoring with the customized monitoring program the identified one or more points during execution of the application; and
initiate, based on information describing the one or more vulnerabilities in the application that were identified using static code analysis, a remediation workflow associated with the one or more exploitable conditions detected during dynamic analysis of the application.
12 . The system of claim 11 , wherein to initiate a remediation workflow the one or more processing devices is further configured to initiate a pull request to incorporate a modified version of the application into the monitored deployment.
13 . The system of claim 11 , wherein to initiate a remediation workflow the one or more processing devices is further configured to initiate a request to modify the monitored deployment based on an updated Infrastructure-as-Code (‘IaC’) template.
14 . The system of claim 11 , wherein the one or more processing devices is further configured to update, based on information describing the one or more vulnerabilities in the application that were identified using static code analysis, an IaC template associated with the monitored deployment.
15 . The system of claim 11 , wherein the remediation workflow resolves the detected condition.
16 . The system of claim 11 , wherein the indication of the one or more vulnerabilities comprises an alert that is presented during a stage of a continuous integration/continuous deployment (′CI/CD′) pipeline prior to an execution of the application.
17 . A non-transitory computer readable storage medium storing instructions which, when executed, cause one or more processing devices to:
inspect, using static code analysis, a non-executable representation of an application to identify one or more points for monitoring during execution of the application including one or more vulnerabilities in the application;
generate a customized monitoring program based on the static code analysis and insert into an executable representation of the application, the customized monitoring program at each location in the executable representation of the application that corresponds to the identified one or more points in the application;
detect during dynamic analysis of the application one or more exploitable conditions in the monitored deployment based on monitoring with the customized monitoring program the identified one or more points during execution of the application; and
initiate, based on information describing the one or more vulnerabilities in the application that were identified using static code analysis, a remediation workflow associated with the one or more exploitable conditions detected during dynamic analysis of the application.
18 . The non-transitory computer readable storage medium of claim 17 further storing instructions which, when executed, cause the one or more processing devices to initiate a pull request to incorporate a modified version of the application into the monitored deployment.
19 . The non-transitory computer readable storage medium of claim 17 further storing instructions which, when executed, cause the one or more processing devices to initiate a request to modify the monitored deployment based on an updated Infrastructure-as-Code (‘IaC’) template.
20 . The non-transitory computer readable storage medium of claim 17 further storing instructions which, when executed, cause the one or more processing devices to modify, based on detecting the one or more exploitable conditions, one or more static code analysis techniques of the static code analysis for the application.