System and method for monitoring network vulnerabilities

A system for managing network vulnerabilities, comprising:

• a plurality of hardware network elements comprising:
• a first hardware network element, and
• a second hardware network element;
• and
• a network controller operating on a third hardware network element, wherein the network controller is configured to:
• transmit a callback to the first hardware network element, wherein the callback comprises executable code configured to cause the first hardware network element to transmit a filesystem manifest to the network controller;
• obtain, in response to executing the callback on the first hardware network element, image data from the filesystem manifest, regarding wherein the image data identifies a filesystem key in the filesystem manifest that corresponds to a first software container among a plurality of software containers, and wherein the plurality of software containers are virtualized user-space instances operating on a single kernel in the hardware network element;
• determine, using the filesystem key that is identified from the image data, a first software vulnerability of a first software image, the first software image being used to generate the first software container;
• and
• generate, using the first software vulnerability and the filesystem key, a vulnerability map of the plurality of hardware network elements,
• wherein the vulnerability map describes a plurality of software vulnerabilities among the plurality of network elements.

A non-transitory computer readable medium storing instructions managing network vulnerabilities, the instructions comprising functionality for:

• transmitting a callback from a network controller and to a network element, wherein the callback comprises executable code configured to cause the network element to transmit a filesystem manifest to the network controller;
• obtaining, in response to executing the callback on the network element, image data from the filesystem manifest, wherein the image data identifies a filesystem key in the filesystem manifest that corresponds to a first software container among a plurality of software containers, and wherein the plurality of software containers are virtualized user-space instances operating on a single kernel in the network element;
• determining, using the filesystem key that is identified from the image data, a first software vulnerability of a first software image, the first software image being used to generate the first software container;
• and
• generating, using the first software vulnerability, a vulnerability map of a network,
• wherein the vulnerability map describes a plurality of software vulnerabilities on the network.