System and method for cybersecurity threat detection utilizing static and runtime data
A system and method for improved endpoint detection and response (EDR) in a cloud computing environment initiates inspection based on data received from a sensor deployed on a workload. The method includes: configuring a resource, deployed in a cloud computing environment, to deploy thereon a sensor, the sensor configured to detect runtime data; detecting a potential cybersecurity threat on the resource based on detected runtime data received from the sensor; and initiating inspection of the resource for the potential cybersecurity threat.
1. A method for improved endpoint detection and response (EDR) in a cloud computing environment, comprising:
deploying a sensor on a resource, the resource deployed in a cloud computing environment, wherein the sensor is configured to detect runtime data of the resource;
detecting a potential cybersecurity threat on the resource based on detected runtime data received from the sensor; and
initiating inspection of the resource for the potential cybersecurity threat.
2. The method of claim 1 , further comprising:
detecting a disk associated with the resource;
generating an inspectable disk based on the detected disk; and
inspecting the inspectable disk for a cybersecurity object indicating the potential cybersecurity threat.
3. The method of claim 2 , further comprising:
cloning the detected disk into the inspectable disk.
4. The method of claim 1 , further comprising:
determining that the potential cybersecurity threat is an actual cybersecurity threat; and
initiating a mitigation action in the cloud computing environment based on the actual cybersecurity threat.
5. The method of claim 4 , further comprising:
applying a logical expression of a definition to an event detected by the sensor; and
determining that the potential cybersecurity threat is an actual cybersecurity threat in response to a binary outcome of the applied logical expression having a predetermined value.
6. The method of claim 1 , wherein the resource is a virtual machine, and the sensor is a service deployed on an operating system of the virtual machine.
7. The method of claim 1 , wherein the resource is a serverless function, and the sensor is a code layer of the serverless function, the serverless function further including a function code.
8. The method of claim 1 , wherein the resource is a software container, further comprising:
configuring a container cluster of the software container to deploy a daemonset, the daemonset including a plurality of nodes, each node including a daemonset pod, wherein the daemonset pod is the deployed sensor.
9. The method of claim 1 , further comprising:
sending a rule to the sensor, the rule including a logical expression and an action;
configuring the sensor to apply the rule on a detected event; and
configuring the sensor to perform the action in response to applying the rule on the detected event and receiving a predetermined result.
10. The method of claim 9 , further comprising:
sending data pertaining to the detected event to a sensor backend server.
11. A non-transitory computer-readable medium storing a set of instructions for improved endpoint detection and response (EDR) in a cloud computing environment, the set of instructions comprising:
one or more instructions that, when executed by one or more processors of a device, cause the device to:
deploy a sensor on a resource, the resource deployed in a cloud computing environment, wherein the sensor is configured to detect runtime data of the resource;
detect a potential cybersecurity threat on the resource based on detected runtime data received from the sensor; and
initiate inspection of the resource for the potential cybersecurity threat.
12. A system for improved endpoint detection and response (EDR) in a cloud computing environment comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
deploy a sensor on a resource, the resource deployed in a cloud computing environment, wherein the sensor is configured to detect runtime data of the resource;
detect a potential cybersecurity threat on the resource based on detected runtime data received from the sensor; and
initiate inspection of the resource for the potential cybersecurity threat.
13. The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
detect a disk associated with the resource;
generate an inspectable disk based on the detected disk; and
inspect the inspectable disk for a cybersecurity object indicating the potential cybersecurity threat.
14. The system of claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
clone the detected disk into the inspectable disk.
15. The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
determine that the potential cybersecurity threat is an actual cybersecurity threat; and
initiate a mitigation action in the cloud computing environment based on the actual cybersecurity threat.
16. The system of claim 15 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
apply a logical expression of a definition to an event detected by the sensor; and
determine that the potential cybersecurity threat is an actual cybersecurity threat in response to a binary outcome of the applied logical expression having a predetermined value.
17. The system of claim 12 , wherein the resource is a virtual machine, and the sensor is a service deployed on an operating system of the virtual machine.
18. The system of claim 12 , wherein the resource is a serverless function, and the sensor is a code layer of the serverless function, the serverless function further including a function code.
19. The system of claim 12 , wherein the resource is a software container, further comprising:
configuring a container cluster of the software container to deploy a daemonset, the daemonset including a plurality of nodes, each node including a daemonset pod, wherein the daemonset pod is the deployed sensor.
20. The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
send a rule to the sensor, the rule including a logical expression and an action;
configure the sensor to apply the rule on a detected event; and
configure the sensor to perform the action in response to applying the rule on the detected event and receiving a predetermined result.
21. The system of claim 20 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
send data pertaining to the detected event to a sensor backend server.