Systems, methods, and computer-readable media for analyzing intercepted telemetry events to generate vulnerability reports supplemented with contextual data

A telemetry interception and analysis platform (TIAP) system, comprising:

• a server comprising a database and a processor to run a TIAP portal comprising an event service operative to receive telemetry events and usage events from a TIAP runtime being executed on a customer computer system in conjunction with an application being executed on the customer computer system,
• wherein the telemetry events are intercepted at a library level within a software stack running on the computer system,
• wherein each telemetry event is associated with a particular instance of a particular component being called by the application and wherein each telemetry event comprises a plurality of information categories populated by the TIAP runtime,
• wherein the usage events are intercepted for each method called in every class accessed within the software stack running on the computer system, wherein the usage events are specific to a particular programming language used in connection with the application,
• wherein the TIAP portal comprises a common vulnerability and exposure (CVE) service operative to receive a plurality of CVEs, wherein the plurality of CVEs are stored in the database,
• wherein the CVE service generates a list of vulnerable components based on the usage events and the plurality of CVEs, and
• wherein the TIAP portal displays the list of vulnerable components in a user interface, and wherein the TIAP portal displays a plurality of populated information categories pertaining to each displayed vulnerable component.

A method implemented in a telemetry interception and analysis platform (TIAP) system, the method comprising:

• executing, on a server comprising a database and a processor, a TIAP portal comprising an event service operative to receive telemetry events and usage events from a TIAP runtime being executed on a customer computer system in conjunction with an application being executed on the customer computer system;
• receiving, at the TIAP portal, the telemetry events and the usage events, wherein each telemetry event comprises a plurality of information categories populated by the TIAP runtime;
• receiving, at the TIAP portal, CVEs from CVE sources;
• analyzing, with a CVE service, the received telemetry events and the received usage events in conjunction with the CVEs to generate a list of vulnerable components used by the application;
• using the CVE service to use usage information pertaining to methods invoked and classes loaded to provide analysis indicating an extent a particular component is vulnerable;
• and
• displaying, by the TIAP portal, the vulnerable components in a ranked order as determined by the CVE service, wherein the populated information categories are displayed in conjunction with a respective vulnerable component.