Methods and apparatus for remediating policy test failures, including correlating changes to remediation processes

• US 9,026,646 B2
• Filed: 09/16/2011
• Issued: 05/05/2015
• Est. Priority Date: 09/16/2011
• Status: Active Grant

• Current Assignee: Tripwire Incorporated (Belden Inc.)
• Original Assignee: Tripwire Incorporated (Belden Inc.)
• Inventors: Whitlock, David, Gascoigne-Piggford, Guy, Granum, Geoff, Petrie, Mark
• Primary Examiner(s): Winder, Patrice
• Assistant Examiner(s): Chang, Julian
• Application Number:
  US13/235,141
• Publication Number:
  US 20130073715A1
• Time in Patent Office: 1,327 Days
• Field of Search: 709220-226, 714/100, 714 1- 57, 726 1- 25
• US Class Current: 709/224
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: G06F 11/30 Monitoring
• CPC Class Codes: H04L 12/00 Data switching networks interconnection of, or transfer of information or other signals between, memories, input/output devices or central processing units G06F13/00
• CPC Class Codes: H04L 41/0654 using network fault recovery ring fault isolation or reconfiguration in loop networks without recovery actions by a network management system H04L12/437
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 41/0695 the faulty arrangement being the maintenance, administration or management system
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

Disclosed herein are methods, systems, and articles associated with correlating detected changes within a computer network with remediation processes performed in response to policy test failures. In embodiments, on determination that a failure of a policy test has occurred within a computer network having a number of nodes, a remediation process may be executed to remediate the failure. Change at a node may be detected. Further, the detected change may be correlated with the execution of the remediation process, and the correlation may be identified.

Claims

1. A method comprising:

detecting, by a computing device, a change at a node within a computer network having a plurality of nodes, wherein the change occurred in response to execution of a remediation process in the computer network, wherein the remediation process was performed to remediate an earlier failure of a policy test in the computer network, and wherein the detecting is performed in response to the performance of the remediation process;

correlating, by the computing device, the detected change as having been in response to the execution of the remediation process; and

identifying, by the computing device, the detected change as being correlated with the execution of the remediation process so that the detected change is not treated as a further policy test failure.

2. The method of claim 1, further comprising executing, by the computing device, the remediation process prior to the detecting, correlating, and identifying, the executing including executing a remediation script.

3. The method of claim 1, wherein correlating the detected change comprises correlating the detected change with a remediation approval identification (ID) or an ID of a remediation work order, wherein the remediation approval ID and the ID of a remediation work order are related to execution of a remediation script.

4. The method of claim 3, wherein the remediation approval ID and the ID of a remediation work order are the same.

5. The method of claim 1, wherein detecting a change at a node within the computer network comprises:

determining a pre-remediation state of the node, prior to execution of the remediation process;

subsequent to executing the remediation process, determining a post-remediation state of the node; and

comparing the pre-remediation state with the post-remediation state.

6. The method of claim 1, detecting a change at a node within a computer network comprises:

compiling, by the computing device, a list of one or more nodes of the computer network, whose respective one or more states have changed.

7. The method of claim 6, wherein correlating the detected change comprises correlating the detected changes with respect to the list of one or more nodes whose respective one or more states have changed with a remediation approval identifications (ID) or an ID of a remediation work order, wherein the remediation approval ID and the ID of the remediation work order are related to execution of the remediation process.

8. The method of claim 7, wherein identifying the detected change as correlated with execution of the remediation process comprises identifying the list of one or more nodes as correlated with execution of the remediation process.

9. An article of manufacture comprising:

a non-transitory computer-readable storage medium; and

a plurality of programming instructions stored on the storage medium and configured to program one or more computing devices, in response to execution of the programming instructions, to perform operations including;

detecting a change at a node within a computer network having a plurality of nodes, wherein the change occurred in response to execution of a remediation process in the computer network, wherein the remediation process was performed to remediate an earlier failure of a policy test in the computer network, and wherein the detecting is performed in response to the performance of the remediation process;

correlating the detected change as having been in response to the execution of the remediation process; and

identifying the detected change as being correlated with the execution of the remediation process and consequently not treating the detected change as a further policy test failure.

10. The article of manufacture of claim 9, wherein correlating the detected change comprises:

correlating the detected change with a remediation approval identification (ID) or an ID of a remediation work order, wherein the remediation approval ID and the ID of a remediation work order are related to execution of a remediation script.

11. The article of manufacture of claim 10, wherein the remediation approval ID and the ID of a remediation work order are the same.

12. The article of manufacture of claim 9, wherein detecting a change at a node within the computer network comprises:

determining a pre-remediation state of the node, prior to execution of the remediation process;

subsequent to executing the remediation process, determining a post-remediation state of the node; and

comparing the pre-remediation state with the post-remediation state.

13. The article of manufacture of claim 9, wherein detecting a change at a node within the computer network comprises:

compiling a list of one or more nodes of the computer network, whose respective one or more states have changed.

14. The article of manufacture of claim 13, wherein correlating the detected change comprises:

correlating the detected change with respect to the list of one or more nodes whose respective one or more states have changed with a remediation approval identification (ID) or an ID of a remediation work order, wherein the remediation approval ID and the ID of a remediation work order are related to execution of the remediation process.

15. The article of manufacture of claim 14, wherein identifying the detected change comprises:

identifying the list of one or more nodes as correlated with the remediation process.

16. The article of manufacture of claim 9, wherein the operations further comprise executing the remediation process prior to the detecting, correlating, and identifying, the executing including executing a remediation script.

17. An apparatus comprising:

one or more processor; and

a non-transitory computer-readable storage medium coupled with the one or more processors, and having stored therein a plurality of programming configured to enable the apparatus, in response to execution of the programming instructions, to

detect a change at a node within a computer network having a plurality of nodes, wherein the change occurred in response to execution of a remediation process in the computer network, wherein the remediation process was performed to remediate a failure of a policy test in the computer network, and wherein the detection is performed in response to the performance of the remediation process;

correlate the detected change as having been in response to the execution of the remediation process; and

identify the detected change as being correlated with execution of the remediation process so that the detected change is not treated as a further policy test failure.

18. The apparatus of claim 17, wherein correlate the detected change comprises:

correlate the detected change with a remediation approval identification (ID) or an ID of a remediation work order, wherein the remediation approval ID and the ID of a remediation work order are related to execution of a remediation script.

19. The apparatus of claim 17, wherein detect a change at a node within the computer network comprises:

compile a list of one or more nodes of the computer network, whose respective one or more states have changed.

20. The apparatus of claim 17, wherein the programming instructions are further configured to enable the apparatus, in response to execution of the programming instructions, to perform the remediation process, including execution of a remediation script.