Active Vulnerability Detection for a Compute Environment
Improved vulnerability detection in a cloud computing environment may be achieved by monitoring, by an agent executing in a compute asset of the cloud computing environment, one or more events associated with code deployed in the cloud computing environment; based at least in part on the one or more events, determining whether the code is active in the cloud computing environment; in response to the code being active, scanning the code to identify one or more vulnerabilities; and performing a notification in response to identifying one or more vulnerabilities.
1 . A method comprising:
monitoring, by an agent executing in a compute asset of a cloud computing environment, one or more events associated with code deployed in the cloud computing environment;
based at least in part on the one or more events, determining whether the code is active in the cloud computing environment;
in response to the code being active, scanning the code to identify one or more vulnerabilities; and
performing a notification in response to identifying one or more vulnerabilities.
2 . The method of claim 1 , wherein the code comprises on or more of an application, a containerized application, a container image, a container, a software package, a library, a virtual machine, a virtual machine image, and a host image.
3 . The method of claim 1 , wherein the code is one of host level code and container level code.
4 . The method of claim 1 , comprising in response to the code being inactive, deprioritizing scanning the code to identify the one or more vulnerabilities.
5 . The method of claim 1 , wherein the one or more events comprises a process of the code accessing a file in the cloud computing environment, and the agent determines the code is active based at least in part on the file access.
6 . The method of claim 5 , wherein the agent determines the code is active based at least in part on a detected opening of the file without issuing a callback.
7 . The method of claim 1 , wherein scanning the code comprises searching a file system associated with the compute asset to list packages containing code installed on the compute asset and scanning the packages for the one or more vulnerabilities.
8 . The method of claim 7 , comprising monitoring, by the agent, activity of the packages at runtime to determine whether code in a package is active.
9 . The method of claim 7 , further comprising detecting code drift by detecting that code in a package is running, comparing one or more attributes of the running code in the package to attributes of the package existing during a previous vulnerability scan, and determining a difference between the one or more attributes of the running code in the package to attributes of the package existing during the previous vulnerability scan.
10 . A non-transitory, machine-readable medium storing instructions, which when executed processing circuitry, cause the processing circuitry to:
monitor, by an agent executing in a compute asset of a cloud computing environment, one or more events associated with code deployed in the cloud computing environment;
based at least in part on the one or more events, determine whether the code is active in the cloud computing environment;
in response to the code being active, scan the code to identify one or more vulnerabilities; and
perform a notification in response to identifying one or more vulnerabilities.
11 . The non-transitory, machine-readable medium of claim 10 , wherein the instructions further cause the processing circuitry to:
in response to the code being inactive, deprioritizing scanning the code to identify the one or more vulnerabilities.
12 . The non-transitory, machine-readable medium of claim 10 , wherein the one or more events comprises a process of the code accessing a file in the cloud computing environment, and the agent determines the code is active based at least in part on the file access.
13 . The non-transitory, machine-readable medium of claim 12 , wherein the agent determines the code is active based at least in part on a detected opening of the file without issuing a callback.
14 . An apparatus, comprising:
processing circuitry; and
instructions that when executed by the processing circuitry cause the apparatus to:
monitor, by an agent executing in a compute asset of a cloud computing environment, one or more events associated with code deployed in the cloud computing environment;
based at least in part on the one or more events, determine whether the code is active in the cloud computing environment;
in response to the code being active, scan the code to identify one or more vulnerabilities; and
perform a notification in response to identifying one or more vulnerabilities.
15 . The apparatus of claim 14 , wherein instructions for scanning the code comprise instructions for searching a file system associated with the compute asset to list packages containing code installed on the compute asset and scanning the packages for the one or more vulnerabilities.
16 . The apparatus of claim 15 , comprising instructions for monitoring, by the agent, activity of the packages at runtime to determine whether code in a package is active.
17 . The apparatus of claim 15 , further comprising instructions for detecting code drift by detecting that code in a package is running, comparing one or more attributes of the running code in the package to attributes of the package existing during a previous vulnerability scan, and determining a difference between the one or more attributes of the running code in the package to attributes of the package existing during the previous vulnerability scan.
18 . The apparatus of claim 15 , further comprising instructions for monitoring inactive packages having one or more critical vulnerabilities.
19 . The apparatus of claim 15 , further comprising instructions to detect a security issue based at least in part on package activity.