SYSTEMS AND METHODS FOR TRACKING AND AUDITING CHANGES IN A MULTI-TENANT CLOUD SYSTEM

• US 20170011079A1
• Filed: 07/09/2015
• Published: 01/12/2017
• Est. Priority Date: 07/09/2015
• Status: Active Grant

• Current Assignee: Zscaler Incorporated
• Original Assignee: Zscaler Incorporated
• Inventors: VERMA, Manav, HALIM, Sofian, BHASIN, Gunjan
• Granted Patent: US 10,587,671 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 16/972 Access to data in other repository systems, e.g. legacy data or dynamic Web page generation
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/5096 wherein the managed service relates to distributed or central networked applications
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data

Abstract

Systems and methods for tracking and auditing changes in one or more cloud-based systems include, at a Web application, intercepting requests between one or more users and the Web application associated with the one or more cloud-based systems and creating log messages based on the intercepted requests; at a log forwarder in the logging system, forwarding the log messages to a log indexer; at the log indexer in the logging system, receiving the forwarded log messages and indexing the forwarded log messages in a centralized storage; and, at the logging system, responsive to a query, forwarding responsive indexed data from the centralized storage, based on the query.

Claims

1. A method for tracking and auditing changes in one or more cloud-based systems, the method comprising:

at a Web application, intercepting requests between one or more users and the Web application associated with the one or more cloud-based systems and creating log messages based on the intercepted requests;

at a log forwarder in the logging system, forwarding the log messages to a log indexer;

at the log indexer in the logging system, receiving the forwarded log messages and indexing the forwarded log messages in a centralized storage; and

at the logging system, responsive to a query, forwarding responsive indexed data from the centralized storage, based on the query.

2. The method of claim 1, further comprising:

at the Web application, receiving the forwarded responsive indexed data, creating and formatting the forwarded responsive indexed data for an audit report; and

providing the audit report to a user.

3. The method of claim 1, wherein the Web application comprises main application logic and interception logic, wherein the intercepting requests and the creating log messages is performed by the interception logic, and the forwarding is performed by the log forwarder, separately from the main application logic of the Web application.

4. The method of claim 3, wherein the interception logic is implemented in a non-blocking Input/output (IO) thread separate from processor cycles which are reserved for the main application logic.

5. The method of claim 1, wherein the requests comprise configuration changes for the one or more cloud-based systems by the one or more users.

6. The method of claim 5, wherein the one or more cloud-based systems are a distributed, cloud-based security system.

7. The method of claim 1, wherein the one or more cloud-based systems comprise at least two cloud-based systems which are separate and distinct from one another, the logging system is configured to store the forwarded log messages in the centralized storage from the at least two cloud-based systems in a segregated manner.

8. The method of claim 1, wherein auditing and tracking information associated with the Web application is stored in the centralized storage which is separate from the Web application.

9. The method of claim 1, wherein the logging system comprises a big data server.

10. The method of claim 1, wherein the intercepted requests comprise HyperText Transfer Protocol (HTTP) requests.

11. A logging system for tracking and auditing changes in one or more cloud-based systems, the logging system comprising:

one or more Web applications associated with the one or more cloud-based systems; and

a logging system communicatively coupled to the one or more Web applications, wherein the logging system comprises a log forwarder and a log indexer;

wherein the one or more Web applications are configured to intercept requests between one or more users and the one or more Web applications associated with the one or more cloud-based systems and create log messages based on the intercepted requests;

wherein the log forwarder is configured to forward the log messages to the log indexer;

wherein the log indexer is configured to receive the forwarded log messages and index the forwarded log messages in a centralized storage; and

wherein the logging system, responsive to a query, is configured to forward responsive indexed data from the centralized storage, based on the query.

12. The logging system of claim 11, wherein the one or more Web applications are further configured to receive the forwarded responsive indexed data, create and format the forwarded responsive indexed data for an audit report, and provide the audit report to a user.

13. The logging system of claim 11, wherein the one or more Web applications each comprise main application logic and interception logic, wherein the intercepting requests and the creating log messages is performed by the interception logic, and the forwarding is performed by the log forwarder, separately from the main application logic of the Web application.

14. The logging system of claim 13, wherein the interception logic is implemented in a non-blocking Input/output (IO) thread separate from processor cycles which are reserved for the main application logic.

15. The logging system of claim 11, wherein the requests comprise configuration changes for the one or more cloud-based systems by the one or more users.

16. The logging system of claim 15, wherein the one or more cloud-based systems are a distributed, cloud-based security system.

17. The logging system of claim 11, wherein the one or more cloud-based systems comprise at least two cloud-based systems which are separate and distinct from one another, the logging system is configured to store the forwarded log messages in the centralized storage from the at least two cloud-based systems in a segregated manner.

18. The logging system of claim 11, wherein auditing and tracking information associated with the Web application is stored in the centralized storage which is separate from the Web application.

19. The logging system of claim 11, wherein the logging system comprises a big data server.

20. A Web application server, comprising:

a network interface;

a processor; and

memory storing instructions that, when executed, cause the processor to

authenticate a user associated with a cloud-based system,

receive instructions from the user for making changes in the cloud-based system,

intercept the instructions in a form of an HyperText Transfer Protocol (HTTP) request, and

create a log message based on the intercepted HTTP request, wherein a logging system is configured to retrieve and index the log message from the Web application server for indexing in centralized storage,

wherein the Web application server comprises main application logic and interception logic, wherein the intercepting requests and the creating log messages is performed by the interception logic, and the forwarding is performed by the log forwarder, separately from the main application logic of the Web application, and

wherein the interception logic is implemented in a non-blocking Input/output (IO) thread separate from processor cycles which are reserved for the main application logic.