Compute environment security monitoring using a live state snapshot of a compute resource

A computer program product embodied in a non-transitory computer-readable storage medium and comprising computer instructions configured to direct a data collection system to perform a process comprising:

• live capturing, by a sub-kernel component of the data collection system, a state snapshot of a compute resource within a compute environment, wherein the compute resource is communicatively coupled to a data platform configured to perform security monitoring of the compute environment, and wherein the live capturing is performed by updating a master state snapshot with one or more delta state snapshots to avoid detectable disruption to the compute resource during the live capturing, wherein the master state snapshot comprises an entire state of the compute resource captured at a first capture time and a delta state snapshot comprises changes to the compute resource captured at a second capture time occurring after the second capture time;
• determining, based on the state snapshot, event data that represents one or more events occurring with respect to the compute resource;
• and
• providing the event data to the data platform for use by the data platform in performing the security monitoring of the compute environment.

A method comprising:

• receiving, by a data platform configured to perform security monitoring of a compute environment, a live state snapshot of a compute resource within the compute environment, wherein the live state snapshot is live captured by a sub-kernel component of a data collection system communicatively coupled to the data platform, and wherein the live capture of the live state snapshot is performed by updating a master state snapshot with one or more delta state snapshots to avoid detectable disruption to the compute resource during the live capture, wherein the master state snapshot comprises an entire state of the compute resource captured at a first capture time and a delta state snapshot comprises changes to the compute resource captured at a second capture time occurring after the second capture time;
• determining, by the data platform and based on the live state snapshot, event data that represents one or more events occurring with respect to the compute resource;
• and
• using, by the data platform, the event data to perform the security monitoring of the compute environment.