System and method for near real-time cloud security situation management

Abstract

A system and method for near real-time inspection of a computing environment for network security objects is presented. The method includes: continuously receiving a plurality of event records, each event record having an event type and corresponding to an event in a computing environment; detecting a first type of event record in the plurality of event records; parsing the first type of event record to detect a resource identifier, where the resource identifier corresponds to a resource deployed in the computing environment; initiating a check of resources of the network security object; and initiating a mitigation action in the computing environment in response to detecting the network security object on the resource.

Description

Technical Field

[0001] The present disclosure generally relates to cloud security posture management (CSPM), and in particular provides a near real-time CSPM monitoring solution. Background Art

[0002] Cloud Security Posture Management (CSPM) is a crucial component in the cloud computing landscape, serving as a comprehensive solution for organizations to enhance and maintain the security of their cloud environments. Essentially, CSPM refers to a set of security practices and tools designed to proactively identify, assess, and remediate security risks within cloud infrastructure. As more and more enterprises migrate their operations to cloud platforms, the need for robust security measures has become paramount, and CSPM has become a strategic ally in achieving this goal.

[0003] At its core, CSPM addresses the unique challenges associated with cloud security by focusing on the configuration and management of cloud resources. Cloud environments, characterized by their dynamic and scalable nature, require specialized security measures to protect sensitive data, applications, and infrastructure. CSPM provides a unified framework for continuously monitoring and enforcing security policies across different cloud service providers, ensuring consistent and reliable defense against potential threats.

[0004] A key aspect of CSPM is the ability to assess the configuration settings of cloud resources. This involves carefully examining parameters such as access controls, encryption settings, network configurations, and other relevant settings that impact the overall security posture. By identifying misconfigurations or deviations from best practices, CSPM enables organizations to proactively detect vulnerabilities that could be exploited by malicious actors. This proactive approach helps reduce the attack surface and strengthen cloud infrastructure against potential breaches.

[0005] Furthermore, CSPM facilitates compliance management by aligning cloud configurations with industry-specific regulatory requirements and internal security policies. This is particularly significant for organizations operating in industries with strict compliance standards, such as finance or healthcare. CSPM's automated assessment and reporting capabilities simplify the compliance process, providing organizations with the necessary insights to address any non-compliance issues promptly.

[0006] Another important function of CSPM is continuous monitoring. Cloud environments are dynamic, with resources regularly added, modified, or decommissioned. CSPM ensures real-time visibility into these changes, allowing organizations to promptly detect and respond to any security incidents or deviations from established security baselines. This continuous vigilance is essential in the fast-paced and constantly evolving cloud computing environment.

[0007] CSPM tools often offer remediation capabilities, allowing organizations to automatically correct identified security issues. This not only speeds up responses to potential threats but also minimizes the potential for human error during the remediation process. Automation is a key feature that enhances the overall efficiency and efficacy of security operations in cloud environments.

[0008] Due to the scale of most cloud environments, it is not feasible to continuously scan the environment for cybersecurity risks, for example, due to the cost in terms of money and resources required to do so. Therefore, current solutions tend to scan the environment periodically, which leaves the environment potentially somewhat exposed between scans.

[0009] Therefore, it would be advantageous to provide a solution that can overcome the above challenges. Summary of the Invention

[0010] The following is an overview of several example embodiments of the present disclosure. This overview is provided for the convenience of the reader to provide a basic understanding of these embodiments and does not fully limit the breadth of the present disclosure. This overview is not an extensive review of all contemplated embodiments and is neither intended to identify key or important elements of all embodiments nor to delineate the scope of any or all aspects. Its sole purpose is to present some concepts of one or more embodiments in a simplified form as a prelude to a more detailed description that will be presented later. For convenience, the terms "some embodiments" or "certain embodiments" may be used herein to refer to a single embodiment or multiple embodiments of the present disclosure.

[0011] A system of one or more computers can be configured to perform specific operations or actions by installing software, firmware, hardware, or a combination thereof on the system, which, when in operation, causes the system to perform those actions. One or more computer programs can be configured to perform specific operations or actions by including instructions that, when executed by a data processing device, cause the device to perform those actions.

[0012] In one general aspect, a method may include continuously receiving a plurality of event records, each event record having an event type and corresponding to an event in a computing environment. The method may also include detecting a first type of event record in the plurality of event records. The method may also include parsing the first type of event record to detect a resource identifier, wherein the resource identifier corresponds to a resource deployed in the computing environment. The method may also include initiating an inspection of the resource for a network security object. The method may also include, in response to detecting the network security object on the resource, initiating a mitigation action in the computing environment. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the method.

[0013] Implementations may include one or more of the following features. A method may include periodically checking each of a plurality of resources deployed in a computing environment for a network security object based on a list of resource identifiers. The method may include determining that a resource corresponding to the resource identifier has not been checked in a previous checking cycle. The method may include initiating a check of the resource, further based on the determination that the resource has not been previously checked. The method may include adding the resource identifier to the list of resource identifiers. The method may include initiating a check of a second resource in response to detecting a network security object on the resource, wherein the event record includes an identifier of the second resource. The method may include continuously receiving event records from a first source; and periodically receiving event records from a second source. The method may include detecting a second type of event record in a plurality of event records; and initiating a check of the resource only in response to detecting that the second type of event record occurs after the first type of event record. The method may include initiating a check of a resource of the second network security object; and determining that the resource comprises a network security risk based on detecting the network security object and the second network security object. Implementations of the described techniques may include hardware, methods or processes, or computer-tangible media.

[0014] In one general aspect, a non-transitory computer-readable medium may include one or more instructions that, when executed by one or more processors of a device, cause the device to: continuously receive a plurality of event records, each event record having an event type and corresponding to an event in a computing environment; detect a first type of event record in the plurality of event records; parse the first type of event record to detect a resource identifier, wherein the resource identifier corresponds to a resource deployed in the computing environment; initiate a check on the resource for a network security object; and, in response to detecting the network security object on the resource, initiate a mitigation action in the computing environment. Other embodiments of this aspect include corresponding computer systems, apparatuses, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the method.

[0015] In one general aspect, a system may include processing circuitry. The system may also include a memory containing instructions that, when executed by the processing circuitry, configure the system to: continuously receive a plurality of event records, each event record having an event type and corresponding to an event in a computing environment. The system may also detect a first type of event record among the plurality of event records. The system may also parse the first type of event record to detect a resource identifier, wherein the resource identifier corresponds to a resource deployed in the computing environment. The system may also initiate an inspection of the resource for a network security object. The system may also include, in response to detecting a network security object on the resource, initiating a mitigation action in the computing environment. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the method.

[0016] Implementations may include one or more of the following features. In the system, the memory contains further instructions that, when executed by the processing circuitry, further configure the system to: periodically check each of a plurality of resources deployed in the computing environment for a network security object based on a list of resource identifiers. In the system, the memory contains further instructions that, when executed by the processing circuitry, further configure the system to: determine that a resource corresponding to the resource identifier has not been checked in a previous check cycle. In the system, the memory contains further instructions that, when executed by the processing circuitry, further configure the system to: initiate a check of the resource, further based on the determination that the resource has not been previously checked. In the system, the memory contains further instructions that, when executed by the processing circuitry, further configure the system to: add the resource identifier to the list of resource identifiers. In the system, the memory contains further instructions that, when executed by the processing circuitry, further configure the system to: in response to detecting the network security object on the resource, initiate a check of a second resource, wherein the event record includes an identifier of the second resource. In the system, the memory contains further instructions that, when executed by the processing circuit, further configure the system to: continuously receive event records from the first source; and periodically receive event records from the second source. In the system, the memory contains further instructions that, when executed by the processing circuit, further configure the system to: detect a second type of event record in the plurality of event records; and initiate an inspection of the resource only in response to detecting that the second type of event record occurs after the first type of event record. In the system, the memory contains further instructions that, when executed by the processing circuit, further configure the system to: initiate an inspection of the resource of the second network security object; and determine that the resource includes a network security risk based on detecting the network security object and the second network security object. Implementations of the described technology may include hardware, methods or processes, or computer tangible media. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The subject matter disclosed herein is particularly pointed out and distinctly claimed in the claims at the conclusion of the specification.The foregoing and other objects, features, and advantages of the disclosed embodiments will become apparent from the following detailed description taken in conjunction with the accompanying drawings.

[0018] Figure 1 is an example diagram of a computing environment monitored by an inspection environment for describing an embodiment.

[0019] Figure 2 is an example flow chart of a method for detecting events in a computing environment implemented according to an embodiment.

[0020] Figure 3 is an example flow chart of a method for providing near real-time network security inspection of a computing environment, implemented in accordance with an embodiment.

[0021] Figure 4 is an exemplary schematic diagram of a check controller according to an embodiment. DETAILED DESCRIPTION

[0022] It is important to note that the embodiments disclosed herein are merely examples of the many advantageous uses of the innovative teachings herein. In general, statements made in the specification of this application do not necessarily limit any of the various claimed embodiments. Furthermore, some statements may apply to some inventive features but not to others. In general, unless otherwise indicated, singular elements may be plural, and vice versa, without loss of generality. In the drawings, like numbers refer to like parts throughout the several views.

[0023] Figure 1 1 is an example diagram of a computing environment monitored by an inspection environment for describing an embodiment. According to an embodiment, computing environment 110 includes multiple entities. In an embodiment, computing environment 110 is a cloud computing environment, a networked computing environment, an on-premise environment, a hybrid environment, or a combination thereof.

[0024] In some embodiments, the computing environment 110 includes a virtual private cloud (VPC), a virtual network (VNet), a virtual private network (VPN), a subnet, and combinations thereof. For example, according to an embodiment, the computing environment 110 is deployed on a cloud computing infrastructure. In an embodiment, the cloud computing infrastructure is, for example, Amazon Web Services (AWS). Web Services, AWS), Microsoft Azure, Google Cloud Platform ( Cloud Platfor, GCP) etc.

[0025] In an embodiment, computing environment 110 includes multiple entities, such as resources and entities, etc. For example, in an embodiment, resources 112 are deployed in computing environment 110. In some embodiments, resources 112 are entities that expose functionality, provide services, software, hardware resources, virtual resources, combinations thereof, etc.

[0026] For example, according to an embodiment, the resource 112 is a virtual machine, a software container, a serverless function, a combination thereof, etc. In some embodiments, the resource 112 is an application, an operating system, a file, a software binary, a software library, a combination thereof, etc.

[0027] In an embodiment, using VirtualBox implements virtual machines, using The platform implements software containers, using Lambda implements serverless functions.

[0028] In some embodiments, the computing environment 110 further includes a plurality of principals, such as principal 114. In some embodiments, a principal is an entity, such as a cloud entity, that is authorized to initiate actions in the computing environment 110. For example, in some embodiments, principal 114 is a user account, a service account, a user role, a user group, a local account, a system account, a network account, or a combination thereof.

[0029] In some embodiments, the computing environment 110 includes an identity and access management (IAM) server (not shown), or the computing environment 110 is otherwise communicatively coupled to an IAM server. In some embodiments, the IAM server is configured to store principals and corresponding credentials (e.g., usernames and passwords), policies, access policies, etc.

[0030] In an embodiment, the computing environment 110 also includes an event database (DB) 116. In some embodiments, the event database is implemented as, for example, Amazon CloudTrail. In an embodiment, resources (such as serverless functions) are configured to write events as data records to a shared resource (such as a storage device bucket).

[0031] According to an embodiment, event database 116 is configured to store therein events as data records of activities in computing environment 110 .

[0032] For example, in an embodiment, an event is provisioning a resource, creating a new subject, deprovisioning a resource, updating permissions for a resource, communication between two resources, access to a resource by a subject, combinations thereof, and the like.

[0033] In some embodiments, an event data record includes a plurality of data fields, each data field having a data value. In some embodiments, the data record is stored as a vector, with each position in the vector corresponding to a unique data field. For example, according to an embodiment, the data fields may indicate a host name, a source, a destination, a subject identifier, a username identifier, and various combinations thereof.

[0034] In an embodiment, computing environment 110 is monitored by inspection environment 120. In certain embodiments, inspection environment 120 is configured to monitor computing environment 110 for network security threats, network security risks, misconfigurations, vulnerabilities, exposures, combinations thereof, and the like.

[0035] In some embodiments, inspection environment 120 includes an inspection controller 122, an inspector 124, and a secure database 126. In an embodiment, inspection controller 122 is configured to initiate inspections of resources in computing environment 110.

[0036] For example, in some embodiments, the inspection controller 122 is configured to select a resource 112 of the computing environment 110 and supply the inspector 124 to inspect the resource 112 for network security objects, wherein the network security objects indicate network security risks, network security threats, misconfigurations, vulnerabilities, exposures, malware objects, combinations thereof, and the like.

[0037] In an embodiment, the inspection controller 122 is configured to generate copies, snapshots, clones, and the like of disks deployed in the computing environment 110. In some embodiments, generating a clone of a disk for network security inspection is advantageous because the clone is immediately available when the clone is started, whereas when a snapshot is generated, the snapshot is only available after the entire snapshot file is created. Furthermore, according to an embodiment, cloning does not create a copy, but rather a pointer address pointing to the same underlying data as the original disk (thus generating the cloned disk).

[0038] In an embodiment, network security objects include: files, folders, system directories, operating systems, applications, software libraries, software binaries, code objects, malware code, file hashes, file checksums, passwords, user accounts, certificates, keys, and combinations thereof.

[0039] In some embodiments, the inspection controller 122 is configured to provision an inspector 124 to inspect copies, snapshots, and clones of network security objects. In some embodiments, the inspector 124 is configured to detect network security objects of a first type and network security objects of a second type. In some embodiments, the inspection controller is configured to detect network security risks based on combinations of network security objects (e.g., toxic combinations).

[0040] According to an embodiment, secure database 126 is configured to store representations of computing environments, such as computing environment 110 , etc. In an embodiment, secure database 126 includes a database schema, including database constraints and metadata, etc., that defines how data records are generated and stored in secure database 126 .

[0041] In some embodiments, secure database 126 is configured to utilize a unified schema such that, for example, resources from various different cloud computing environments (eg, Azure and AWS) are represented using a single data record type (eg, a "resource" type).

[0042] As an example, according to an embodiment, virtual machines in Azure and virtual machines in AWS are represented in the secure database 126 using a single representation type for representing any virtual machine.

[0043] In certain embodiments, the security database 126 is further configured to represent network security risks, network security threats, network paths, exposures, misconfigurations, remediation actions, mitigation actions, enrichments, combinations thereof, and the like.

[0044] For example, in an embodiment, the secure database 126 is a graph database (such as In such embodiments, resources are represented as nodes in a security graph. In embodiments, a vertex connects a node to another node, where the vertex also indicates the type of connection between the nodes. For example, in embodiments, a node representing a subject is connected to a node representing a resource via a vertex, where the vertex indicates that the subject "can access" the resource.

[0045] In some embodiments, the check controller 122 is configured to periodically check the computing environment 110 for network security risks and threats, etc. A complete network security check is both time-consuming and resource-intensive, so the tradeoff is to perform such checks periodically.

[0046] However, in computing environments (such as cloud computing environments), where resources are rapidly provisioned and de-provisioned, a resource may be provisioned only between checks and thus never be checked.

[0047] Furthermore, a bad actor who knows when an inspection is occurring can configure resources to be de-provisioned during the inspection and then provisioned again once the inspection window is complete, allowing them to exploit resources in computing environment 110 for malicious purposes.

[0048] Therefore, in an embodiment, it is advantageous to have a check controller 122 that is further configured to detect certain events, such as by accessing the event database 116, the cloud log of the computing environment 110, the network log of the computing environment 110, and combinations thereof, to detect resources that were not checked in the previous check.

[0049] For example, in an embodiment, the inspection controller 122 is configured to maintain a list of identifiers of resources in the computing environment 110 that were last inspected, a list of identifiers of resources in the computing environment 110 that should be inspected in the next inspection, and combinations thereof.

[0050] In an embodiment, the check controller 122 is configured to detect certain predetermined event types (e.g., in the event database 116) and to initiate a check of a resource based on the detected event. For example, in an embodiment, the check controller 122 is configured to detect an event type indicating that a resource is provisioned. In an embodiment, in response to detecting an event in the event database 116, the check controller 122 is configured to initiate a check of the provisioned resource. In some embodiments, the check controller 122 is configured to extract an identifier of the resource from the event record and further initiate a check based on the identifier of the resource.

[0051] In some embodiments, the check controller 122 is configured to compare the detected resource identifier with a resource list of the check controller 122. In some embodiments, if the resource identifier is not on the resource list, the check controller 122 is configured to initiate a check of the resource. In some embodiments, the check controller 122 is configured to add the resource identifier to the resource list. This allows the check controller 122 to provision a checker for the resource during subsequent checks of the computing environment 110, according to embodiments.

[0052] In some embodiments, the inspection controller 122 is configured to immediately provision the inspector 124 to inspect the resource based on the detected event. This provides real-time or near real-time inspection of the resource for indicative network security objects (eg, network security risks).

[0053] Figure 2 is an example flow chart of a method for detecting events in a computing environment implemented according to an embodiment. According to an embodiment, performing real-time or near real-time inspection of a computing environment is advantageous, and in particular, by performing real-time (or near real-time) inspections of only components of the computing environment that have not been previously inspected, considerable resources are saved because only new resources are specifically inspected.

[0054] At S210 , a plurality of event records are accessed. In an embodiment, accessing a plurality of events includes accessing a bucket, a storage device, a database, etc. storing the event records.

[0055] In an embodiment, the event record includes an event type. In some embodiments, the event type indicates: a change in a resource, a provision of a resource, a change in a permission, a combination thereof, and the like.

[0056] In some embodiments, the access event record includes an access log, such as a network log, a cloud log, an event log, and a combination thereof, etc. In some embodiments, for example, CloudTrail is used to store the event record.

[0057] At S220 , event types are monitored. In an embodiment, multiple events are received continuously, periodically, or a combination thereof. For example, in some embodiments, a first source periodically provides event records, while a second source continuously provides event records, and both sources provide events based on the same computing environment.

[0058] In an embodiment, the inspection controller is configured to monitor an event log, an event database, an event storage, etc. for a first type of event. In an embodiment, for example, the event log includes a plurality of different event types. However, not all events are of interest for initiating a network security inspection.

[0059] In some embodiments, the check controller is configured to monitor a first type of event and a second type of event occurring within a predetermined time window. For example, if the first event indicates that a resource is provisioned and the second event indicates that the resource communicates with a blocked IP address, the check controller is configured to initiate a check on the resource.

[0060] At S230, a predetermined event type is detected. In an embodiment, a first predetermined event type of a first type is detected at a first time, and a second predetermined event type of a second type is detected at a second time. In some embodiments, detecting an event type within a predetermined time range indicates that a network security check should be initiated.

[0061] In some embodiments, detecting a predetermined event type includes: receiving an event record; parsing the event record to detect a data field; extracting a value of the data field; comparing the value of the data field with a predetermined data value; and determining whether the event is of a predetermined type based on the comparison result, the extracted data value, etc.

[0062] At S240, a mitigation action is initiated. In an embodiment, the mitigation action includes: revoking access from a subject, changing access of a subject, revoking access to a resource, revoking access from a resource, initiating a firewall policy, sandboxing a resource, deprovisioning a resource, generating an alert, updating an alert, generating an alert severity, updating an alert severity, and combinations thereof.

[0063] In some embodiments, the mitigation action includes a remediation action. For example, upon detecting a network security risk, threat, misconfiguration, etc., a remediation action is initiated to remedy the risk, threat, etc.

[0064] In some embodiments, the mitigation action includes generating an instruction to check the resource later.

[0065] Figure 3 The present invention is a flowchart illustrating an example method for providing near-real-time network security checks of a computing environment, according to an embodiment. In an embodiment, providing near-real-time network security checks includes continuously detecting event records generated in response to events in the computing environment. In some embodiments, certain events (e.g., certain event types) serve as initiators of network security checks, i.e., when an event of this type is detected, a network security check should be initiated for the resources associated with the event.

[0066] At S310, the computing environment is checked for network security objects. In embodiments, the computing environment is checked periodically, for example, every 12 hours, daily, weekly, or daily. In some embodiments, the check controller is configured to discover resources in the computing environment, for example, by initiating network discovery to detect resources deployed therein. In certain embodiments, the check controller is configured to query the Application Programming Interface (API) of a cloud computing infrastructure (such as AWS) to detect resources deployed in a particular cloud computing environment.

[0067] In an embodiment, a computing environment is checked for a plurality of network security objects, including files, folders, system directories, operating systems, applications, software libraries, software binaries, code objects, malware code, file hashes, file checksums, passwords, user accounts, certificates, keys, and combinations thereof.

[0068] At S320 , an event storage is accessed. In an embodiment, the event storage is an event storage device, a storage device bucket, a cloud log, a network log, an event log, or a combination thereof.

[0069] In some embodiments, accessing the event store includes providing credentials to a service account, user account, etc. to access the event store. For example, in an embodiment, the inspection controller is provided with login credentials, security tokens, certificates, keys, etc., which allow the inspection controller to access the event store.

[0070] In some embodiments, the event store is accessed continuously, for example, by continuously receiving events from an event source. In embodiments, the event store is accessed periodically, continuously, or a combination thereof. For example, in embodiments, the event store is accessed periodically between a first time and a second time for an event, and the event store is accessed continuously between the second time and a third time. According to embodiments, this is advantageous because it allows network traffic to be limited during busier times by reducing the amount of event records accessed when the network is busy.

[0071] At S330 , a resource identifier is detected. In an embodiment, the resource identifier is detected in a first type event record, wherein the inspection controller is configured to trigger the inspection in response to detecting the first type event record.

[0072] In some embodiments, detecting the resource identifier includes detecting a first type event record in an event from the accessed event store, and parsing the event record to detect a value of a predetermined data field, wherein the predetermined data field indicates an identifier of the resource. For example, in an embodiment, the data record is parsed to detect a data field "resource_name". In this example, the data field "resource_name" includes the identifier "host.domain.123-4".

[0073] In some embodiments, the event record includes multiple resource identifiers. In some embodiments, the multiple resource identifiers are associated with a single resource, such as a container pod is associated with a single container node, or multiple container nodes are associated with a container cluster.

[0074] At S340 , a check on the resource is initiated. In an embodiment, the check controller is configured to initiate a check on the resource based on the detected resource identifier.

[0075] In an embodiment, when multiple resource identifiers are detected, the inspection controller is configured to initiate an inspection of any or all resources corresponding to the resource identifiers. In some embodiments where multiple resources are detected, the inspection of the resources is initiated based on the type of event. For example, in the event that the event indicates that resource "A" accessed resource "B", the inspection controller is configured to initiate an inspection of only resource "A". In an embodiment, in response to detecting a network security object on resource "A", the inspection controller is configured to initiate an inspection of the network security object on resource "B" to determine, for example, whether resource "B" was infected via resource "A".

[0076] Figure 44 is an example schematic diagram of the inspection controller 122 according to an embodiment. According to an embodiment, the inspection controller 122 includes a processing circuit 410 coupled to a memory 420, a storage device 430, and a network interface 440. In an embodiment, the components of the inspection controller 122 are communicatively connected via a bus 450.

[0077] In some embodiments, the processing circuit 410 can be understood as one or more hardware logic components and circuits. For example, according to embodiments, illustrative types of hardware logic components include field programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip systems (SOCs), graphics processing units (GPUs), tensor processing units (TPUs), artificial intelligence (AI) accelerators, general-purpose microprocessors, microcontrollers, and digital signal processors (DSPs), or any other hardware logic components configured to perform calculations or other information operations.

[0078] In some embodiments, the memory 420 is a volatile memory (e.g., random access memory), a non-volatile memory (e.g., read-only memory, flash memory), a combination thereof, etc. In some embodiments, the memory 420 is an on-chip memory, an off-chip memory, a combination thereof, etc. In some embodiments, the memory 420 is a temporary storage memory for the processing circuit 410.

[0079] In one configuration, software for implementing one or more embodiments disclosed herein is stored in storage device 430, memory 420, combinations thereof, and the like. Software should be broadly interpreted as any type of instructions, whether referred to as software, firmware, middleware, microcode, hardware description language, or otherwise. According to an embodiment, the instructions include code (e.g., in source code format, binary code format, executable code format, or any other suitable code format). According to an embodiment, when executed by processing circuit 410, the instructions cause processing circuit 410 to perform the various processes described herein.

[0080] In some embodiments, the storage device 430 is a magnetic storage device, an optical storage device, a solid-state storage device, a combination thereof, etc., and depending on the embodiment, the storage device 430 is implemented as flash memory, a hard drive, another storage technology, various combinations thereof, or any other medium that can be used to store the desired information.

[0081] According to an embodiment, the network interface 440 is configured to provide communications to the inspection controller 122 , such as with the inspector 124 , the computing environment 110 , and the security database (security DB) 126 .

[0082] It should be understood that the embodiments described herein are not limited to Figure 4 While a particular architecture is shown, other architectures may equally be used without departing from the scope of the disclosed embodiments.

[0083] Furthermore, in some embodiments, the inspector 124, the security database 126, and combinations thereof, etc. may be configured to: Figure 4 The illustrated architecture enables. In other embodiments, other architectures may equally be used without departing from the scope of the disclosed embodiments.

[0084] The various embodiments disclosed herein can be implemented as hardware, firmware, software or any combination thereof. In addition, the software is preferably implemented as an application program tangibly embodied on a program storage unit or a computer-readable medium, and the program storage unit or the computer-readable medium is composed of a combination of some or some devices and / or devices. The application program can be uploaded to a machine including any suitable architecture, and the machine executes the application program. Preferably, the machine is implemented on a computer platform with hardware such as one or more processing units ("PUs"), memory and input / output interfaces. The computer platform may also include an operating system and microinstruction code. The various processes and functions described herein may be part of the microinstruction code or part of the application program, or any combination thereof, and they may be executed by the PU, whether or not such a computer or processor is explicitly shown. In addition, various other peripheral units may be connected to the computer platform, such as additional data storage units and printing units, etc. In addition, a non-transitory computer-readable medium is any computer-readable medium other than a temporary propagation signal.

[0085] All examples and conditional language listed herein are intended for teaching purposes to help the reader understand the principles of the disclosed embodiments and the concepts contributed by the inventors to advance the art, and should be understood as not being limited to these specifically listed examples and conditions. In addition, all statements describing the principles, aspects, and embodiments of the disclosed embodiments herein, as well as their specific examples, are intended to encompass structural and functional equivalents thereof. In addition, it is intended that such equivalents include both currently known equivalents and equivalents developed in the future, that is, any element developed to perform the same function, regardless of structure.

[0086] It should be understood that any reference to an element herein using names such as "first," "second," etc. does not generally limit the number or order of those elements. Rather, these names are generally used herein as a convenient way to distinguish between two or more elements or instances of an element. Thus, a reference to a first and a second element does not mean that only two elements can be used there, or that the first element must precede the second element in some way. Furthermore, unless otherwise specified, a group of elements includes one or more elements.

[0087] As used herein, the phrase "at least one" followed by a list of items means that any of the listed items may be used alone or in any combination of two or more of the listed items. For example, if a system is described as including "at least one of A, B, and C," the system may include only A; only B; only C; 2 As; 2 Bs; 2 Cs; 3 As; a combination of A and B; a combination of B and C; a combination of A and C; a combination of A, B, and C; a combination of 2 As and Cs; a combination of A, 3 Bs, and 2 Cs, and so on.

Claims

1. A method for performing near real-time inspection of a computing environment for network security objects, comprising: continuously receiving a first plurality of event records from a first source, each event record having an event type and corresponding to an event in the computing environment; periodically receiving a second plurality of event records from a second source, each event record having an event type and corresponding to an event in the computing environment; detecting a first type event record; detecting a second type of event record; determining that the second type event record occurs after the first type event record; parsing the first type of event record to detect a resource identifier, wherein the resource identifier corresponds to a resource deployed in the computing environment; initiating an inspection of the resource of the network security object only in response to detecting that the second type of event record occurs after the first type of event record; and In response to detecting the network security object on the resource, a mitigation action is initiated in the computing environment.

2. The method according to claim 1, further comprising: Each resource of a plurality of resources deployed in the computing environment is periodically checked against the network security object based on the list of resource identifiers.

3. The method according to claim 2, further comprising: It is determined that the resource corresponding to the resource identifier has not been checked in a previous checking cycle.

4. The method according to claim 3, further comprising: Further based on the determination that the resource has not been previously inspected, an inspection of the resource is initiated.

5. The method according to claim 2, further comprising: The resource identifier is added to a list of resource identifiers.

6. The method according to claim 1, further comprising: In response to detecting a network security object on the resource, an inspection of a second resource is initiated, wherein the first type event record includes an identifier of the second resource.

7. The method according to claim 1, further comprising: Initiating an inspection of the resource of the second network security object; as well as Based on detecting the network security object and the second network security object, it is determined that the resource includes a network security risk.

8. A non-transitory computer-readable medium storing a set of instructions for performing near real-time inspection of a computing environment for network security objects, the set of instructions comprising: One or more instructions that, when executed by one or more processors of a device, cause the device to: continuously receiving a first plurality of event records from a first source, each event record having an event type and corresponding to an event in the computing environment; periodically receiving a second plurality of event records from a second source, each event record having an event type and corresponding to an event in the computing environment; detecting a first type event record; detecting a second type of event record; determining that the second type event record occurs after the first type event record; parsing the first type of event record to detect a resource identifier, wherein the resource identifier corresponds to a resource deployed in the computing environment; initiating an inspection of the resource of the network security object only in response to detecting that the second type of event record occurs after the first type of event record; and In response to detecting the network security object on the resource, a mitigation action is initiated in the computing environment.

9. A system for performing near real-time inspection of a computing environment for network security objects, comprising: processing circuits; a memory containing instructions that, when executed by the processing circuit, configure the system to: continuously receiving a first plurality of event records from a first source, each event record having an event type and corresponding to an event in the computing environment; periodically receiving a second plurality of event records from a second source, each event record having an event type and corresponding to an event in the computing environment; detecting a first type event record; detecting a second type of event record; determining that the second type event record occurs after the first type event record; parsing the first type of event record to detect a resource identifier, wherein the resource identifier corresponds to a resource deployed in the computing environment; initiating an inspection of the resource of the network security object only in response to detecting that the second type of event record occurs after the first type of event record; and In response to detecting the network security object on the resource, a mitigation action is initiated in the computing environment.

10. The system according to claim 9, wherein: The memory contains further instructions that, when executed by the processing circuit, further configure the system to: Each resource of a plurality of resources deployed in the computing environment is periodically checked against the network security object based on the list of resource identifiers.

11. The system according to claim 10, wherein: The memory contains further instructions that, when executed by the processing circuit, further configure the system to: It is determined that the resource corresponding to the resource identifier has not been checked in a previous checking cycle.

12. The system according to claim 11, wherein The memory contains further instructions that, when executed by the processing circuit, further configure the system to: Further based on the determination that the resource has not been previously inspected, an inspection of the resource is initiated.

13. The system according to claim 10, wherein: The memory contains further instructions that, when executed by the processing circuit, further configure the system to: The resource identifier is added to a list of resource identifiers.

14. The system according to claim 9, wherein: The memory contains further instructions that, when executed by the processing circuit, further configure the system to: In response to detecting a network security object on the resource, an inspection of a second resource is initiated, wherein the first type event record includes an identifier of the second resource.

15. The system according to claim 9, wherein: The memory contains further instructions that, when executed by the processing circuit, further configure the system to: Initiating an inspection of the resource of the second network security object; and Based on detecting the network security object and the second network security object, it is determined that the resource includes a network security risk.

Images