Incident response using asset configuration data

• US 10,158,663 B2
• Filed: 09/08/2017
• Issued: 12/18/2018
• Est. Priority Date: 12/03/2014
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Satish, Sourabh, Friedrichs, Oliver, Mahadik, Atif, Salinas, Govind
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US15/699,454
• Publication Number:
  US 20180013785A1
• Time in Patent Office: 466 Days
• Field of Search: 726 1, 726 11- 15, 713153-154, 709223-225, 709229
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: H04L 47/2425 for supporting services specification, e.g. SLA
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Systems, methods, and software described herein enhances how security actions are implemented within a computing environment. In one example, a method of implementing security actions for a computing environment comprising a plurality of computing assets includes identifying a security action in a command language for the computing environment. The method further provides identifying one or more computing assets related to the security action, and obtaining hardware and software characteristics for the one or more computing assets. The method also includes translating the security action in the command language to one or more action procedures based on the hardware and software characteristics, and initiating implementation of the one or more action procedures in the one or more computing assets.

Claims

1. A method of improving security incident responses for a computing environment comprising a plurality of computing assets, the method comprising:

in a processing system, maintaining asset configuration data for the plurality of computing assets, the asset configuration data comprising characteristics for each of the one or more computing assets;

in response to identifying a security incident in the computing environment, providing, for display, security incident information related to the security incident to an administrator associated with the computing environment;

identifying a selection of a security action from the administrator;

identifying one or more computing assets related to the security action;

identifying configuration data for the one or more computing assets from the maintained asset configuration data;

identifying one or more action procedures to support the selection based on the identified configuration data; and

initiating implementation of the one or more action procedures in the one or more computing assets.

2. The method of claim 1 wherein the security incident information identifies at least one computing asset in the plurality of assets related to the security incident.

3. The method of claim 1 wherein the security incident information comprises enrichment information for the security incident obtained from internal or external sources.

4. The method of claim 1 wherein the security incident information comprises suggestions of one or more security actions to be taken against the security incident, and wherein identifying the selection of the security action comprises identifying the selection of the security action from the one or more security actions.

5. The method of claim 1 wherein identifying the selection of the security action comprises identifying the selection of the security action in a command language.

6. The method of claim 5 wherein the command language comprises a visual programming language.

7. The method of claim 1 wherein the plurality of computing assets comprises host computing systems, end user computing systems, routers, switches, or virtual processing systems.

8. The method of claim 1 wherein identifying the selection of the security action from the administrator comprises receiving the selection of the security action from an administration console associated with the administrator.

9. The method of claim 1 wherein the security action comprises an action to block at least one internet protocol (IP) address, an action to remove a process on the one or more computing assets, or an action to enter the one or more computing assets into a virtual local area network (VLAN).

10. An apparatus to improve security incident responses for a computing environment comprising a plurality of computing assets, the apparatus comprising:

one or more non-transitory computer readable storage media;

a processing system operatively coupled to the one or more non-transitory computer readable storage media; and

processing instructions stored on the one or more non-transitory computer readable storage media that, when executed by the processing system, direct the processing system to;

maintain asset configuration data for the plurality of computing assets, the asset configuration data comprising characteristics for each of the one or more computing assets;

in response to identifying a security incident in the computing environment, provide, for display, security incident information related to the security incident to an administrator associated with the computing environment;

identify a selection of a security action from the administrator;

identify one or more computing assets related to the security action;

identify configuration data for the one or more computing assets from the maintained asset configuration data;

identify one or more action procedures to support the selection based on the identified configuration data; and

initiate implementation of the one or more action procedures in the one or more computing assets.

11. The apparatus of claim 10 wherein the security incident information identifies at least one computing asset in the plurality of assets related to the security incident.

12. The apparatus of claim 10 wherein the security incident information comprises enrichment information for the security incident obtained from internal or external sources.

13. The apparatus of claim 10 wherein the security incident information comprises suggestions of one or more security actions to be taken against the security incident, and wherein identifying the selection of the security action comprises identifying the selection of the security action from the one or more security actions.

14. The apparatus of claim 10 wherein identifying the selection of the security action comprises identifying the selection of the security action in a command language.

15. The apparatus of claim 14 wherein the command language comprises a visual programming language.

16. The apparatus of claim 10 wherein the plurality of computing assets comprises host computing systems, end user computing systems, routers, switches, or virtual processing systems.

17. The apparatus of claim 10 wherein identifying the selection of the security action from the administrator comprises receiving the selection of the security action from an administration console associated with the administrator.

18. The apparatus of claim 10 wherein the security action comprises an action to block at least one internet protocol (IP) address, an action to remove a process on the one or more computing assets, or an action to enter the one or more computing assets into a virtual local area network (VLAN).

19. An apparatus to improve security incident responses for a computing environment comprising a plurality of computing assets, the apparatus comprising:

one or more non-transitory computer readable storage media; and

processing instructions stored on the one or more non-transitory computer readable storage media that, when executed by a processing system, direct the processing system to;

maintain asset configuration data for the plurality of computing assets, the asset configuration data comprising characteristics for each of the one or more computing assets;

in response to identifying a security incident in the computing environment, provide, for display, security incident information related to the security incident to an administrator associated with the computing environment;

identify a selection of a security action from the administrator;

identify one or more computing assets related to the security action;

identify configuration data for the one or more computing assets from the maintained asset configuration data;

identify one or more action procedures to support the action selection based on the identified configuration data; and

initiate implementation of the one or more action procedures in the one or more computing assets.

20. The apparatus of claim 19 wherein the security incident information comprises suggestions of one or more security actions to be taken against the security incident, and wherein identifying the selection of the security action comprises identifying the selection of the security action from the one or more security actions.