System and method for performing event inquiries in a network

• US 10,095,864 B2
• Filed: 07/20/2016
• Issued: 10/09/2018
• Est. Priority Date: 03/08/2016
• Status: Active Grant

• Current Assignee: Tanium Inc.
• Original Assignee: Tanium Inc.
• Inventors: Hunt, Christian L., Gissel, Thomas R., Tarter, Aaron, Floyd, Daniel, Hobbs, Benjamin
• Primary Examiner(s): Okeke, Izunna
• Application Number:
  US15/215,483
• Publication Number:
  US 20170264589A1
• Time in Patent Office: 811 Days
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 41/0813 characterised by the conditions triggering a change of settings
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70

Abstract

A remote server dispatches an instruction packet to a node in a network through a linear communication orbit formed by a collection of nodes. The instruction packet propagates from node to node along the linear communication orbit until reaching the node. The instruction packet includes instructions for establishing a direct duplex connection between the node and the remote server. After dispatching the instruction packet to the node through the linear communication orbit, the remote server receives, from the node, a request for establishing the direct duplex connection. In response to receiving the request from the node, the remote server establishes the direct duplex connection. After establishing the direct duplex connection, the remote server issues instructions to the node to upload local data from the node to the remote server through the direct duplex connection.

Claims

1. A method of monitoring a network comprising a collection of machines, the method comprising:

at a respective server for monitoring the network;

dispatching an instruction packet to a respective machine in the network through a linear communication orbit formed by the collection of machines, wherein the instruction packet propagates from machine to machine along the linear communication orbit until reaching the respective machine, and wherein the instruction packet includes an instruction for establishing a direct duplex connection between the respective machine and the respective server by initiating an outbound connection request from the respective machine to the respective server;

after dispatching the instruction packet to the respective machine through the linear communication orbit, receiving, from the respective machine, a request for establishing the direct duplex connection between the respective machine and the respective server in accordance with a respective network connection protocol;

in response to receiving the request from the respective machine, establishing the direct duplex connection between the respective machine and the respective server in accordance with the respective network connection protocol; and

after establishing the direct duplex connection, issuing instructions to the respective machine to upload local data from the respective machine to the respective server through the direct duplex connection between the respective machine and the respective server.

2. The method of claim 1, wherein dispatching the instruction packet to the respective machine in the network through the linear communication orbit formed by the collection of machines comprises:

sending the instruction packet to a starting machine of the linear communication orbit, wherein the instruction packet identifies the respective machine as a destination for the instruction packet and the instruction packet is propagated through one or more upstream machines of the respective machine in the linear communication orbit before reaching the respective machine.

3. The method of claim 1, including:

injecting a query into the network through a starting machine of the linear communication orbit, wherein the starting machine propagates the query through the linear communication orbit; and

receiving local answers collected from a plurality of machines in the network through the starting machine of the linear communication orbit.

4. The method of claim 3, wherein the local answers are collected from the plurality of machines according to a schedule specified in the query.

5. The method of claim 3, wherein the local answers are generated by the plurality of machines according to historical local values stored in respective local databases of event histories that are maintained at the plurality of machines.

6. The method of claim 3, wherein receiving local answers collected from the plurality of machines in the network through the starting machine of the linear communication orbit includes:

receiving an aggregated answer from the starting machine of the linear communication orbit, wherein the aggregated answer is generated based on the local answers collected from the plurality of machines in the network.

7. The method of claim 1, wherein the direct duplex connection is a secure WebSocket connection.

8. The method of claim 1, wherein the respective server is separated from the network by a firewall.

9. The method of claim 1, including:

sending, through the direct duplex connection, a request for event artifacts associated with an event of interest; and

in response to sending the request for event artifacts, receiving relevant event artifact data for the event of interest through the direct duplex connection.

10. The method of claim 9, including:

based on the relevant event artifact data received through the direct duplex connection, creating a sandbox environment to recreate the event of interest.

11. The method of claim 1, including:

receiving user selection of an event of interest or one or more event artifacts associated with the respective machine; and

in response to receiving the user selection, generating one or more network-wide queries based on characteristics of the event of interest or the one or more event artifacts associated with the respective machine;

injecting at least one of the one or more network-wide queries into the network through a starting machine of the linear communication orbit to collect local answers from other machine in the network; and

receiving local answers for the at least one of the one or more network-wide queries, the local answers having been collected from a plurality of machines in the network through the starting machine of the linear communication orbit.

12. The method of claim 11, including:

prior to injecting the at least one of the one or more network-wide queries into the network, presenting the one or more network-wide queries that have been generated in an administrator user interface; and

receiving user selection of the at least one of the one or more network-wide queries in the administrator user interface for injection into the network.

13. The method of claim 11, wherein generating the one or more network-wide queries based on the characteristics of the event of interest or the one or more event artifacts associated with the respective machine includes:

generating the one or more network-wide queries based on one or more query templates and one or more local event artifact values associated with the respective machine.

14. The method of claim 11, wherein generating the one or more network-wide queries based on the characteristics of the event of interest or the one or more event artifacts associated with the respective machine includes:

automatically generating one or more indicators of compromise (IOCs) based on the characteristics of the event of interest or the one or more event artifacts associated with the respective machine.

15. The method of claim 1, including:

dispatching a first IOC for a first event of interest into the network, wherein the first IOC includes a plurality of indicator items;

in response to dispatching the first IOC into the network, receiving identification result data for the first event of interest from a plurality of machines in the network; and

modifying the first IOC based on the received identification result data for the first event of interest, wherein modifying the first IOC includes at least one of removing at least one of the plurality of indicator items and reordering the plurality of indicator items based on the received identification result data.

16. The method of claim 15, wherein receiving the identification result data for the first event of interest from the plurality of machines in the network includes:

receiving evaluation result data indicating repeated occurrences of a set of contextual conditions associated with the first event of interest.

17. The method of claim 15, including:

determining respective variances for at least some of the plurality of indicator items based on the received identification result data for the first event of interest; and

based on the respective variances for the at least some of the plurality of indicator items, determining respective confidence values for the at least some of the plurality of indicator items for the first event of interest, wherein;

modifying the first IOC based on the received identification result data for the first event of interest from the plurality of machines in the network includes removing one or more of the plurality of indicator items from the first IOC based on relative confidence values of the at least some of the plurality of indicator items.

18. The method of claim 15, including:

determining hit probabilities for at least some of the plurality of indicator items based on the received identification result data for the first event of interest, wherein;

modifying the first IOC based on the received identification result data for the first event of interest includes reordering the plurality of indicator items in the first IOC based on the relative hit probabilities for the at least some of the plurality of indicator items.

19. A system for monitoring a network comprising a collection of machines, the system comprising:

one or more processors; and

memory storing instructions that, when executed by the one or more processors, cause the processors to perform operations including;

dispatching an instruction packet to a respective machine in the network through a linear communication orbit formed by the collection of machines, wherein the instruction packet propagates from machine to machine along the linear communication orbit until reaching the respective machine, and wherein the instruction packet includes an instruction for establishing a direct duplex connection between the respective machine and the respective server by initiating an outbound connection request from the respective machine to the respective server;

after dispatching the instruction packet to the respective machine through the linear communication orbit, receiving, from the respective machine, a request for establishing the direct duplex connection between the respective machine and the respective server;

in response to receiving the request from the respective machine, establishing the direct duplex connection between the respective machine and the respective server; and

after establishing the direct duplex connection, issuing instructions to the respective machine to upload local data from the respective machine to the respective server through the direct duplex connection between the respective machine and the respective server.

20. A non-transitory computer-readable medium storing instructions that when executed by one or more processors, cause the processors to perform operations comprising:

dispatching an instruction packet to a respective machine in a network comprising a collection of machines through a linear communication orbit formed by the collection of machines, wherein the instruction packet propagates from machine to machine along the linear communication orbit until reaching the respective machine, and wherein the instruction packet includes an instruction for establishing a direct duplex connection between the respective machine and the respective server by initiating an outbound connection request from the respective machine to the respective server;

after dispatching the instruction packet to the respective machine through the linear communication orbit, receiving, from the respective machine, a request for establishing the direct duplex connection between the respective machine and the respective server; and

in response to receiving the request from the respective machine, establishing the direct duplex connection between the respective machine and the respective server; and

after establishing the direct duplex connection, issuing instructions to the respective machine to upload local data from the respective machine to the respective server through the direct duplex connection between the respective machine and the respective server.