Techniques for agentless endpoint detection and response for appliances

A non-transitory computer-readable medium storing a set of instructions for agentless endpoint detection and response for software appliances deployed in a cloud computing environment, the set of instructions comprising:

• one or more instructions that, when executed by one or more processing circuitries of a device, cause the device to:
• detect a software appliance deployed in a cloud computing environment, the software appliance including an application stored on a disk of the software appliance;
• generate an inspectable disk based on a clone of the disk, wherein the disk stores a log of events for the application;
• inspect the log of events stored on the inspectable disk to detect a first event indicating a cybersecurity issue
• inspect a network log of the cloud computing environment to detect a second event in the cloud computing environment
• determine a cybersecurity threat based on detecting the first event and the second event;
• and
• initiate a mitigation action in response to the detection of the cybersecurity threat.

A system for agentless endpoint detection and response for software appliances deployed in a cloud computing environment comprising:

• a processing circuitry;
• a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
• detect a software appliance deployed in a cloud computing environment, the software appliance including an application stored on a disk of the software appliance;
• generate an inspectable disk based on a clone of the disk, wherein the disk stores a log of events for the application;
• inspect the log of events stored on the inspectable disk to detect a first event indicating a cybersecurity issue
• inspect a network log of the cloud computing environment to detect a second event in the cloud computing environment
• determine a cybersecurity threat based on detecting the first event and the second event;
• and
• initiate a mitigation action in response to the detection of the cybersecurity threat.