Technique and method for detection and display of the cybersecurity risk context of a cloud environment
A technique and method for detection and display of the cybersecurity risk context of a cloud environment initiates an inspection of cybersecurity objects within a cloud environment utilizing an inspection environment and stores information pertaining to discovered cybersecurity objects within the inspected cloud environment in a storage environment. The technique and method further generate a cybersecurity risk context for the inspected cloud environment based on the observations made concerning the cybersecurity objects contained within it. The technique and method further configure a web browser running on a client device to automatically display the generated cybersecurity risk context to a user, either through a web page overlay or through a toolbar plugin which has been installed in the web browser and configured to enable inspections of a cloud environment, once the user has navigated to a web page containing cybersecurity object identifiers.
1. A method for detecting a cybersecurity context based on a detected web interface, comprising:
detecting in a web interface an identifier corresponding to an entity deployed in a computing environment;
generating a query for a security database based on the detected identifier, wherein the security database includes a representation of the computing environment;
executing the query on the security database to return a response, wherein the response includes a cybersecurity risk; and
rendering, based on the response, a representation of the cybersecurity risk on a display, the representation associated with the web interface.
2. The method of claim 1 , further comprising:
extracting a data field value associated with the detected identifier.
3. The method of claim 2 , further comprising:
generating the query based on the extracted data field value.
4. The method of claim 1 , further comprising:
determining a remediation action based on the cybersecurity risk.
5. The method of claim 4 , further comprising:
initiating the remediation action in the computing environment.
6. The method of claim 1 , further comprising:
inspecting a workload deployed in the computing environment for the cybersecurity risk; and
generating a representation of the workload in the security database.
7. The method of claim 6 , wherein inspecting the workload further comprises:
generating an inspectable disk based on a disk associated with the workload; and
inspecting the inspectable disk for a cybersecurity object indicating the cybersecurity risk.
8. The method of claim 1 , wherein the response includes any one of: a location of the entity within the computing environment, an exposure of the entity to other entities, an aggregate value indicating a number of cybersecurity risks, a vulnerability, a misconfiguration, an exposure, and any combination thereof.
9. The method of claim 1 , further comprising:
generating a textual input for receiving a text input; and
rendering the textual input on the display.
10. The method of claim 9 , further comprising:
generating a prompt for a large language model (LLM) based on the textual input; and
processing the prompt utilizing the LLM.
11. The method of claim 10 , further comprising:
generating the prompt based on a template, the prompt when processed by the LLM generates an output including any one of: a remediation action, the query for the security database, and a combination thereof.
12. A non-transitory computer-readable medium storing a set of instructions for detecting a cybersecurity context based on a detected web interface, the set of instructions comprising:
one or more instructions that, when executed by one or more processors of a device, cause the device to:
detect in a web interface an identifier corresponding to an entity deployed in a computing environment;
generate a query for a security database based on the detected identifier, wherein the security database includes a representation of the computing environment;
execute the query on the security database to return a response, wherein the response includes a cybersecurity risk; and
render, based on the response, a representation of the cybersecurity risk on a display, the representation associated with the web interface.
13. A system for detecting a cybersecurity context based on a detected web interface comprising:
a processing circuitry;
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
detect in a web interface an identifier corresponding to an entity deployed in a computing environment;
generate a query for a security database based on the detected identifier, wherein the security database includes a representation of the computing environment;
execute the query on the security database to return a response, wherein the response includes a cybersecurity risk; and
render, based on the response, a representation of the cybersecurity risk on a display, the representation associated with the web interface.
14. The system of claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
extract a data field value associated with the detected identifier.
15. The system of claim 14 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
generate the query based on the extracted data field value.
16. The system of claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
determine a remediation action based on the cybersecurity risk.
17. The system of claim 16 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
initiate the remediation action in the computing environment.
18. The system of claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
inspect a workload deployed in the computing environment for the cybersecurity risk; and
generate a representation of the workload in the security database.
19. The system of claim 18 , wherein the memory contains further instructions that, when executed by the processing circuitry for inspecting the workload, further configure the system to:
generate an inspectable disk based on a disk associated with the workload; and
inspect the inspectable disk for a cybersecurity object indicating the cybersecurity risk.
20. The system of claim 13 , wherein the response includes any one of:
a location of the entity within the computing environment, an exposure of the entity to other entities, an aggregate value indicating a number of cybersecurity risks, a vulnerability, a misconfiguration, an exposure, and any combination thereof.
21. The system of claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
generate a textual input for receiving a text input; and
render the textual input on the display.
22. The system of claim 21 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
generate a prompt for a large language model (LLM) based on the textual input; and
process the prompt utilizing the LLM.
23. The system of claim 22 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
generate the prompt based on a template, the prompt when processed by the LLM generates an output including any one of:
a remediation action, the query for the security database, and a combination thereof.