Configuration management for a capture/registration system

• US 9,253,154 B2
• Filed: 08/12/2008
• Issued: 02/02/2016
• Est. Priority Date: 08/12/2008
• Status: Active Grant

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Gaitonde, Jitendra B.
• Primary Examiner(s): LEE, BRYAN Y
• Application Number:
  US12/190,536
• Publication Number:
  US 20130246377A1
• Time in Patent Office: 2,730 Days
• Field of Search: 709/224
• US Class Current: 1/1
• CPC Class Codes: H04L 41/0813 characterised by the conditions triggering a change of settings
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0263 Rule management

Abstract

A method, apparatus, and system is described for distributing a rule to a distributed capture system and storing the rule in a global configuration database, wherein the rule defines an action for the distributed capture system to perform regarding packets intercepted by the distributed capture system.

Claims

1. A non-transitory computer-implemented method comprising:

distributing a rule to a distributed capture system, wherein the rule defines an action for the distributed capture system to perform regarding packets intercepted by the distributed capture system;

storing the rule in a global configuration database, which includes registered documents, each of the registered documents including a respective signature and a respective document identifier that collectively form a primary key, which can be searched within the global configuration database; and

distributing a plurality of crawler tasks to the capture system, wherein the crawler tasks are configured to search for rule violations within resting documents that are not being transmitted over a network connection, wherein the action is based on a particular document registered with the capture system and content of an object provided in the packets, and wherein the particular document is identified by one or more signatures, which can be compared against signatures derived from the object.

2. The method of claim 1, wherein the rule is distributed within a policy, and wherein the policy includes one or more rules and a designation as to which of a plurality of distributed capture systems should apply the policy.

3. The method of claim 2, wherein the policy further includes a policy state of either active or passive and each of the one or more rules within the policy are individually set to inherit or not to inherit the policy state.

4. The method of claim 1, wherein the action is based upon one or more of the following:

the source or destination of the packets.

5. The method of claim 1, wherein the rule defines an action of the distributed capture system regarding files stored on a network or a portion of a network associated with the distributed capture system.

6. The method of claim 5, wherein the rule defines what objects stored on a network or a portion of a network associated with the distributed capture system should be registered by the capture system.

7. The method of claim 1, wherein the rule is based upon a user-defined template.

8. The method of claim 1, wherein the defined action is one or more of the following:

an email notification, a syslog notification, and prevention of the transmittal of the intercepted packets.

9. The method of claim 1, wherein the rule further defines exceptions to the defined action.

10. The method of claim 1, further comprising:

storing, in the global configuration database, a plurality of versions of the rule and which version of the rule applies to the distributed capture system.

11. The method of claim 10, further comprising:

identifying an additional distributed capture system in a network;

distributing a default version of a rule to the additional distributed capture system, wherein the rule defines an action for the additional distributed capture system to perform regarding packets intercepted by the additional distributed computer system.

12. The method of claim 1, wherein the rule is distributed in response to one or more of the following:

the addition of a capture system to a network, a capture system reestablishing a connection to a network, a periodic update, the creation of a new rule, a change made to an existing rule, and the deletion of a rule.

13. A non-transitory machine-readable storage medium having executable instructions that when executed, cause a machine to perform operations comprising:

distributing a rule to a distributed capture system, wherein the rule defines an action for the distributed capture system to perform regarding packets intercepted by the distributed capture system;

storing the rule in a global configuration database, which includes registered documents, each of the registered documents including a respective signature and a respective document identifier that collectively form a primary key, which can be searched within the global configuration database; and

distributing a plurality of crawler tasks to the capture system, wherein the crawler tasks are to search for rule violations within resting documents that are not being transmitted over a network connection, wherein the action is based on a particular document registered with the capture system and content of an object provided in the packets, and wherein the particular document is to be identified by one or more signatures, which can be compared against signatures derived from the object.

14. The machine-readable storage medium of claim 13, wherein the rule is distributed within a policy, and wherein the policy includes one or more rules and a designation as to which of a plurality of distributed capture systems should apply the policy.

15. The machine-readable storage medium of claim 14, wherein the policy further includes a policy state of either active or passive and each of the one or more rules within the policy are individually set to inherit or not to inherit the policy state.

16. The machine-readable storage medium of claim 13, wherein the defined action is based upon one or more of the following:

the source or destination of the intercepted packets.

17. The machine-readable storage medium of claim 13, wherein the rule defines an action of the distributed capture system regarding files stored on a network or a portion of a network associated with the distributed capture system.

18. The machine-readable storage medium of claim 17, wherein the rule defines what objects stored on a network or a portion of a network associated with the distributed capture system should be registered by the capture system.

19. The machine-readable storage medium of claim 13, wherein the rule is based upon a user-defined template.

20. The machine-readable storage medium of claim 13, wherein the defined action is one or more of the following:

an email notification, a syslog notification, and prevention of the transmittal of the intercepted packets.

21. The machine-readable storage medium of claim 13, wherein the rule further defines exceptions to the defined action.

22. The machine-readable storage medium of claim 13, wherein the executable instructions, when executed, further cause the machine to perform operations comprising:

storing, in the global configuration database, a plurality of versions of the rule and which version of the rule applies to the distributed capture system.

23. The machine-readable storage medium of claim 22, wherein the executable instructions, when executed, further cause the machine to perform operations comprising:

identifying an additional distributed capture system in a network;

distributing a default version of a rule to the additional distributed capture system, wherein the rule defines an action for the additional distributed capture system to perform regarding packets intercepted by the additional distributed capture system.

24. The machine-readable storage medium of claim 13, wherein the rule is distributed in response to one or more of the following:

the addition of a capture system to a network, a capture system reestablishing a connection to a network, a periodic update, the creation of a new rule, a change made to an existing rule, and the deletion of a rule.

25. A system comprising:

a memory including a global configuration database to store a rule;

a configuration manager coupled to the global configuration database to distribute the rule; and

a distributed capture system to receive the rule and store the rule in a local configuration database, wherein the rule defines an action for the distributed capture system to perform regarding packets intercepted by the distributed capture system, wherein the global configuration database is configured to store registered documents, each of the registered documents including a respective signature and a respective document identifier that collectively form a primary key, which can be searched within the global configuration database, wherein the configuration manager is configured to distribute a plurality of crawler tasks to the distributed capture system, wherein the crawler tasks are configured to search for rule violations within resting documents that are not being transmitted over a network connection, wherein the action is based on a particular document registered with the capture system and content of an object provided in the packets, and wherein the particular document is identified by one or more signatures, which can be compared against signatures derived from the object.

26. The system of claim 25, wherein the rule is distributed within a policy, and wherein the policy includes one or more rules and a designation as to which of a plurality of distributed capture systems should apply the policy.

27. The system of claim 26, wherein the policy further includes a policy state of either active or passive and each of the one or more rules within the policy are individually set to inherit or not to inherit the policy state.

28. The system of claim 25, wherein the global configuration database further stores a plurality of versions of the rule and which version of the rule applies to the distributed capture system.

29. The system of claim 25, wherein the configuration manager distributes the rule in response to one or more of the following:

the addition of a capture system to a network, a capture system reestablishing a connection to a network, a periodic update, the creation of a new rule, a change made to an existing rule, and the deletion of a rule.

30. An apparatus comprising:

a memory including a global configuration database to store a rule; and

a configuration manager coupled to the global configuration database to distribute the rule to a distributed capture system, wherein the rule defines an action for the distributed capture system to perform regarding packets intercepted by the distributed capture system, wherein the global configuration database is configured to store registered documents, each of the registered documents including a respective signature and a respective document identifier that collectively form a primary key, which can be searched within the global configuration database, and wherein the configuration manager is configured to distribute a plurality of crawler tasks to the capture system, and wherein the crawler tasks are configured to search for rule violations within resting documents that are not being transmitted over a network connection, wherein the action is based on a particular document registered with the capture system and content of an object provided in the packets, and wherein the particular document is identified by one or more signatures, which can be compared against signatures derived from the object.

31. The apparatus of claim 30, wherein the rule is distributed within a policy, and wherein the policy includes one or more rules and a designation as to which of a plurality of distributed capture systems should apply the policy.

32. The apparatus of claim 31, wherein the policy further includes a policy state of either active or passive and each of the one or more rules within the policy are individually set to inherit or not to inherit the policy state.

33. The apparatus of claim 30, wherein the global configuration database further stores a plurality of versions of the rule and which version of the rule applies to the distributed capture system.

34. The apparatus of claim 30, wherein the configuration manager distributes the rule in response to one or more of the following:

the addition of a capture system to a network, a capture system reestablishing a connection to a network, a periodic update, the creation of a new rule, a change made to an existing rule, and the deletion of a rule.