Method to intelligently manage the end to end container compliance in cloud environments
One example method includes receiving data from a container data collector (CDC), and the data concerns a container, analyzing the data and, based on the analyzing, identifying a security tool needed to scan the container, drawing the security tool from a knowledge lake, executing the security tool to perform a vulnerability scan of the container, based on the executing of the security tool, generating and analyzing a report concerning the vulnerability scan, and transmitting the report, and results of the analyzing, to an alert and action stage.
1. A method, comprising:
receiving data from a container data collector (CDC), and the data concerns a container;
analyzing the data and, based on the analyzing, identifying a security tool needed to scan the container;
drawing the security tool from a knowledge lake;
executing the security tool to perform a vulnerability scan of the container;
based on the executing of the security tool, generating and analyzing a report concerning the vulnerability scan;
transmitting the report, and results of the analyzing, to an alert and action stage; and
the receiving, the analyzing of the data, the identifying, the drawing, the executing, the generating and the analyzing of the report, and the transmitting, are all performed by a device management console that comprises the CDC, an elastic container security hub (ECSH) module, the knowledge lake, the alert and action stage, and a fixed profile (FP) module.
2. The method as recited in claim 1 , wherein the vulnerability scan identifies a vulnerability in the container, and also identifies a potential resolution to the vulnerability.
3. The method as recited in claim 1 , wherein the report and/or results of the analyzing enable the alert and action stage to generate an alert which includes information that may be used by a fixed profile (FP) module to update a container image on which the container is based.
4. The method as recited in claim 1 , wherein a container image, on which the container is based, is updated based on the report and/or the results of the analyzing.
5. The method as recited in claim 1 , wherein the container is based on a container image, and a container image update is performed that results in an updated container image that lacks a vulnerability that was identified in the vulnerability scan.
6. The method as recited in claim 5 , wherein a container creation request is generated that triggers creation of a new container based on the updated container image, and the new container lacks the vulnerability.
7. The method as recited in claim 5 , wherein the updated container image is transmitted to a container image repository.
8. The method as recited in claim 1 , wherein the security tool is returned to the knowledge lake after the security tool is no longer needed.
9. The method as recited in claim 1 , wherein the CDC obtains the data concerning the container after the CDC determines that a host includes a container environment that includes the container.
10. A computer readable storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
receiving data from a container data collector (CDC), and the data concerns a container;
analyzing the data and, based on the analyzing, identifying a security tool needed to scan the container;
drawing the security tool from a knowledge lake;
executing the security tool to perform a vulnerability scan of the container;
based on the executing of the security tool, generating and analyzing a report concerning the vulnerability scan;
transmitting the report, and results of the analyzing, to an alert and action stage; and
the report and/or the results of the analyzing enable the alert and action stage to generate an alert which includes information that may be used by a fixed profile (FP) module to update a container image on which the container is based.
11. The computer readable storage medium as recited in claim 10 , wherein the vulnerability scan identifies a vulnerability in the container, and also identifies a potential resolution to the vulnerability.
12. The computer readable storage medium as recited in claim 10 , wherein a container image, on which the container is based, is updated based on the report and/or the results of the analyzing.
13. The computer readable storage medium as recited in claim 10 , wherein the container is based on a container image, and a container image update is performed that results in an updated container image that lacks a vulnerability that was identified in the vulnerability scan.
14. The computer readable storage medium as recited in claim 13 , wherein a container creation request is generated that triggers creation of a new container based on the updated container image, and the new container lacks the vulnerability.
15. The computer readable storage medium as recited in claim 13 , wherein the updated container image is transmitted to a container image repository.
16. The computer readable storage medium as recited in claim 10 , wherein the security tool is returned to the knowledge lake after the security tool is no longer needed.
17. The computer readable storage medium as recited in claim 10 , wherein the receiving, the analyzing of the data, the identifying, the drawing, the executing, the generating and the analyzing of the report, and the transmitting, are all performed by a device management console that comprises the CDC, an elastic container security hub (ECSH) module, the knowledge lake, the alert and action stage, and a fixed profile (FP) module.
18. The computer readable storage medium as recited in claim 10 , wherein the CDC obtains the data concerning the container after the CDC determines that a host includes a container environment that includes the container.