SYSTEMS AND METHODS FOR INTEGRATING CLOUD SERVICES WITH INFORMATION MANAGEMENT SYSTEMS

• US 20150163199A1
• Filed: 01/15/2015
• Published: 06/11/2015
• Est. Priority Date: 04/30/2012
• Status: Active Grant

• Current Assignee: Zscaler Incorporated
• Original Assignee: Zscaler Incorporated
• Inventors: Kailash, Kailash, Balaiah, Chakkaravarthy Periyasamy, Pangeni, Sushil, Sinha, Amit, Crank, Samuel John, Apte, Manoj, Narasimhan, Sridhar
• Granted Patent: US 9,912,638 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 41/5096 wherein the managed service relates to distributed or central networked applications
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Systems and methods of integrating log data from a cloud system with an internal management system are described, wherein the cloud system is located externally from a secure network which contains the internal management system. The systems and methods include receiving log data from a cloud system through a secure connection between the secure network and the cloud system; buffering the received log data; filtering the buffered, received log data; and transmitting the filtered, buffered, received log data to the internal management system in a format associated with the internal management system.

Claims

1. A method of integrating log data from a cloud system with an internal management system, wherein the cloud system is located externally from a secure network which contains the internal management system, the method comprising:

receiving log data from a cloud system through a secure connection between the secure network and the cloud system;

buffering the received log data;

filtering the buffered, received log data; and

transmitting the filtered, buffered, received log data to the internal management system in a format associated with the internal management system.

2. The method of claim 1, wherein the transmitting of the filtered, buffered, received log data to the internal management system is via simple, insecure protocols inside the secure network.

3. The method of claim 1, wherein the internal management system is a Security Information and Event Management (SIEM) system, and the method is performed via an external service bridge which is located within the secure network.

4. The method of claim 3, wherein the external service bridge is any of a server, an appliance, a service operating on a virtual machine, and a service operating on a hardware device inside the secure network.

5. The method of claim 1, wherein the log data undergoes a first line of filtering in the cloud system and a second line of filtering within the secure network, prior to being sent to the internal management system.

6. The method of claim 1, wherein the cloud system is configured to proactively detect and preclude distribution of security threats between users associated with the secure network and the Internet, and wherein the security threats comprise any of malware, spyware, viruses, trojans, botnets, email spam, data leakage, policy violations, and other undesirable content.

7. The method of claim 1, wherein the format is American Standard Code for Information Interchange (ASCII) format and the transmitting is over a Transmission Control Protocol (TCP) connection inside the secure network.

8. The method of claim 1, wherein the internal management system is configured to perform any of data aggregation, correlation, alerting, dashboard, compliance, and retention of data.

9. The method of claim 1, wherein the internal management system is a first internal management system of a plurality of internal management systems, and the method further comprising:

transmitting the filtered, buffered, received log data accordingly to each of the plurality of internal management systems in an associated format.

10. The method of claim 9, wherein a record of the filtered, buffered, received log data is sent to at least two of the plurality of internal management systems.

11. A system configured to integrate log data from a cloud system with an internal management system, wherein the cloud system is located externally from a secure network which contains the internal management system, the system comprising:

a network interface communicatively coupled to the secure network and the cloud system;

a processor communicatively coupled to the network interface and a data store; and

memory storing instructions that, when executed, cause the processor to

obtain log data from the cloud system through a secure connection, via the network interface, between the secure network and the cloud system;

buffer the received log data in the data store;

filter the buffered, received log data; and

cause transmission of the filtered, buffered, received log data to the internal management system, via the network interface, in a format associated with the internal management system.

12. The system of claim 11, wherein the filtered, buffered, received log data is transmitted to the internal management system via simple, insecure protocols inside the secure network.

13. The system of claim 11, wherein the internal management system is a Security Information and Event Management (SIEM) system, and the system is an external service bridge which is located within the secure network.

14. The system of claim 13, wherein the external service bridge is any of a server, an appliance, a service operating on a virtual machine, and a service operating on a hardware device inside the secure network.

15. The system of claim 11, wherein the log data undergoes a first line of filtering in the cloud system and a second line of filtering within the secure network, prior to being sent to the internal management system.

16. The system of claim 11, wherein the cloud system is configured to proactively detect and preclude distribution of security threats between users associated with the secure network and the Internet, and wherein the security threats comprise any of malware, spyware, viruses, trojans, botnets, email spam, data leakage, policy violations, and other undesirable content.

17. The system of claim 11, wherein the format is American Standard Code for Information Interchange (ASCII) format and the network interface is configured to transmit over a Transmission Control Protocol (TCP) connection inside the secure network to the internal management system.

18. The system of claim 11, wherein the internal management system is configured to perform any of data aggregation, correlation, alerting, dashboard, compliance, and retention of data.

19. The system of claim 11, wherein the internal management system is a first internal management system of a plurality of internal management systems, and the instructions, when executed, further cause the processor to:

cause transmission of the filtered, buffered, received log data accordingly to each of the plurality of internal management systems in an associated format.

20. The system of claim 19, wherein a record of the filtered, buffered, received log data is sent to at least two of the plurality of internal management systems.