Asset grouping rules for vulnerability detection and management in IT systems
Disclosed are methods, systems and non-transitory computer readable memory for vulnerability detection and management. For instance, a method may include obtain asset information for an organization, wherein the asset information indicates a plurality of assets; obtain a set of grouping rules, wherein the set of grouping rules defines a plurality of groups based on asset attributes; obtain asset data from at least one source, wherein the asset data indicates particular attributes for at least a subset of assets of the plurality of assets; determine at least one specific group for each of the subset of assets; generate a data structure associating each asset of the subset of assets to a first group, thereby grouping the subset of assets into the first group; and perform at least one vulnerability management action using a command that applies to all of the assets, and only the assets, of the first group.
1 . A system for vulnerability detection and management, the system comprising:
at least one processor; and
at least one memory storing instructions, wherein the system is configured to:
obtain scanner data from at least one scanner, wherein the scanner data comprises a text file including a plurality of findings regarding one or more assets of a plurality of assets;
extract data bits for each finding from the scanner data and store, for each finding, a finding record in a findings table, wherein a finding record includes at least an asset ID and a vulnerability ID;
determine at least one analytic record for the plurality of findings and store the at least one analytic record in an analytic table, wherein the analytic table associates a scan key value, asset IDs, and vulnerability IDs;
determine a plurality of trend records based on the findings table and the analytic table, wherein a first trend record of the plurality of trend records include an indication of a change in a vulnerability status for a first asset from a first time period to a second time period, and store the plurality of trend records in a trend table;
obtain a set of grouping rules,
wherein the set of grouping rules defines a plurality of groups based on asset attributes,
the asset attributes include at least one of asset name, asset IP address, asset OS, business owner, business owner team, or support team, and
each grouping rule of the set of grouping rules includes one or more conditions comprising logical operators on values of the asset attributes;
obtain asset data from at least one source, wherein the asset data indicates particular attributes for at least a subset of assets of the plurality of assets, and the at least one source includes the trend table;
determine at least one specific group for each asset of the subset of assets based on the particular attributes for the at least a subset of assets and the set of grouping rules;
generate an asset-group data structure associating each asset of the subset of assets to a first group based on asset IDs from the trend table, thereby grouping the subset of assets into the first group; and
perform at least one vulnerability management action using a command that applies to all of the assets, and only the assets, of the first group.
2 . The system of claim 1 , wherein, to obtain the asset information for the organization, the system is configured to: use a scanning tool to generate finding information; and extract the asset information from the finding information.
3 . The system of claim 1 , wherein, to obtain the set of grouping rules, the system is configured to: (1) receive user interactions with a web user interface to generate conditions to define the set of grouping rules, (2) receive a user upload of a file including a syntax-correct data structure that indicates conditions to define the set of grouping rules, and/or (3) receive data at an API to provide conditions to define the set of grouping rules.
4 . The system of claim 1 , wherein, to obtain the asset data from the at least one source, the system is configured to: (1) obtain data for specific assets by user interactions with a web user interface and/or file upload, or (2) obtain data from one or more APIs.
5 . The system of claim 1 , wherein the plurality of groups includes at least one or more layers of a hierarchy of groups.
6 . The system of claim 5 , wherein the one or more layers of the hierarchy of groups includes at least a first layer of groups and a second layer of groups.
7 . The system of claim 6 , wherein a subset of groups in the second layer of groups are nested under a group in the first layer of groups.
8 . The system of claim 7 , wherein the subset groups in the second layer of groups nested under the group in the first layer share a same attribute as the group in the first layer.
9 . The system of claim 5 , wherein the one or more layers include up to a predetermined number of layers.
10 . The system of claim 1 , wherein, to determine a group for an asset, the system is configured to: (1) determine attributes for the asset; (2) determine a grouping rule for the group is satisfied by the attributes for the asset; and (3) associate the asset with the group.
11 . The system of claim 10 , wherein the system is further configured to, if the group associated with the asset is a nested group: associate the asset with each parent group in each higher order layer.
12 . The system of claim 1 , wherein an asset is associated to multiple groups.
13 . The system of claim 1 , wherein each asset is associated to only one lowest level group.
14 . The system of claim 1 , wherein an asset is associated to multiple lowest level groups.
15 . The system of claim 1 , wherein the system is configured to: (1) obtain new asset data from the at least one source, and (2) update the data structure to add assets to, remove assets from, or move assets between groups of the plurality of groups based on the new asset data.
16 . The system of claim 1 , wherein the system is configured to: detect vulnerability(s) for assets of the subset of assets and/or groups of the plurality of groups; and perform one or combinations of: display the vulnerability(s) for the assets based on the groups, or display summaries of the vulnerability(s) of the assets on a group-basis.
17 . The system of claim 1 , wherein, to perform the at least one vulnerability management action using the command that applies to all of the assets, and only the assets, of the first group, the system is configured to: detect a vulnerability for an asset of the first group, and perform one or combinations of: (1) transmit an alert to a defined endpoint for the asset and/or first group, (2) flag the first group on login, (3) generate external ticket(s) and assign based on the first group, (4) generate report(s) based on the first group, and/or (5) trigger one or more automation rules based on the first group.
18 . The system of claim 1 , wherein the system is configured to:
obtain service data indicating tags for assets to associate the assets with a particular service, wherein the assets associated with the particular service comprise a full stack including device, OS, and/or web application, thereby forming a service group based on the tags and a service grouping rule; detect a vulnerability for an asset of the service group; and perform one or combinations of: (1) transmit an alert for the service group, (2) flag the service group on login, (3) generate external ticket(s) and assign based on the service group, (4) generate report(s) based on the service group, and/or (5) trigger one or more automation rules based on the service group.
19 . The system of claim 1 , wherein the system is configured to: obtain an organizational hierarchy; map assets onto portions of the organizational hierarchy and associate the assets with the portions of the organizational hierarchy; detect a vulnerability for an asset of a portion of organizational hierarchy; and perform one or combinations of: (1) transmit an alert for the portion of organizational hierarchy, (2) flag the portion of organizational hierarchy on login, (3) generate external ticket(s) and assign based on the portion of organizational hierarchy, (4) generate report(s) based on the portion of organizational hierarchy, and/or (5) trigger one or more automation rules based on the portion of organizational hierarchy.
20 . A computer-implemented method for vulnerability detection and management, comprising:
obtain scanner data from at least one scanner, wherein the scanner data comprises a text file including a plurality of findings regarding one or more assets of a plurality of assets;
extracting data bits for each finding from the scanner data;
storing, for each finding, a finding record in a findings table, wherein a finding record includes at least an asset ID and a vulnerability ID;
determining at least one analytic record for the plurality of findings;
storing the at least one analytic record in an analytic table, wherein the analytic table associates a scan key value, asset IDs, and vulnerability IDs;
determining a plurality of trend records based on the findings table and the analytic table, wherein a first trend record of the plurality of trend records include an indication of a change in a vulnerability status for a first asset from a first time period to a second time period;
storing the plurality of trend records in a trend table;
obtaining a set of grouping rules, wherein the set of grouping rules defines a plurality of groups based on asset attributes, and at least one grouping rule of the set of grouping rules maps assets onto portions of an organizational hierarchy based on an attribute indicating an employee division, employee role, or employee location;
obtaining asset data from at least one source, wherein the asset data indicates particular attributes for at least a subset of assets of the plurality of assets, and the at least one source includes the trend table;
determining at least one specific group for each of the subset of assets based on the set of grouping rules and the particular attributes;
generating an asset-group data structure associating each asset of the subset of assets to a first group based on asset IDs from the trend table, thereby grouping the subset of assets into the first group; and
performing at least one vulnerability management action using a command that applies to all of the assets, and only the assets, of the first group.