Endpoint-level SLA evaluation in managed networks
An embodiment includes a method of real-time, endpoint-specific SLA compliance evaluation in a managed network. The method includes receiving SLA definition input that indicates an SLA definition of the managed network. Responsive to detection of a trigger event, the method includes initiating a scan of endpoints including retrieval of endpoint-level state data. The method includes identifying a portion of the retrieved state data relevant to the SLA definition. The method includes aggregating the portions of the retrieved state data. The method includes determining whether the managed network is SLA compliant at an endpoint-level of granularity based on the aggregated portions. Responsive to the managed network being noncompliant, the method includes identifying a subset of endpoints failing to meet the SLA definition and implementing a product modification process to address a metric of the SLA definition and change a product to bring the first endpoint into compliance.
1 . A method of vulnerability detection and mitigation in managed networks, the method comprising:
receiving a defined state of software products on a first managed network that is hosted on a cloud network and that includes a first managed endpoint;
detecting a trigger event in the first managed network, wherein the trigger event is indicative of a change to the first managed endpoint that is inconsistent with the defined state; and
responsive to detection of the trigger event:
initiating a global scan of a second managed network having a similar defined state that is hosted on the cloud network, the global scan being configured to identify presence of the trigger event in the second managed network; and
responsive to the trigger event being present at a second managed endpoint of the second managed network, implementing a product modification process at the second managed network, wherein the product modification process includes distribution of at least one product update to a product installed at the second managed endpoint.
2 . The method of claim 1 , wherein:
the cloud network includes a cloud storage device; and
the trigger event is further indicative of one or more or a combination of:
a change to the product at the first managed endpoint;
a change to data stored in on a cloud storage; and
a change to the defined state.
3 . The method of claim 1 , further comprising implementing an automated local scan of a first additional managed endpoint of the first managed network for outstanding patches and vulnerabilities at the first additional managed endpoint responsive to detection of the trigger event.
4 . The method of claim 3 , further comprising responsive to the trigger event being present at the first additional managed endpoint, implementing the product modification process at the first additional managed endpoint.
5 . The method of claim 1 , further comprising initiating a network scan of a plurality of additional managed endpoints of the first managed network responsive to detection of the trigger event, the network scan being configured to identify presence of the trigger event in each of the plurality of additional managed endpoints.
6 . The method of claim 5 , further comprising responsive to the trigger event being present at one or more additional managed endpoints of the plurality of additional managed endpoints, implementing the product modification process at the one or more additional managed endpoints.
7 . The method of claim 1 , wherein the detecting includes monitoring a software management interface that records software inventory of the first managed network.
8 . The method of claim 1 , wherein the detecting the trigger event includes communicating with a kernel driver installed at the first managed endpoint, wherein the kernel driver is configured to monitor software inventory changes at the first managed endpoint.
9 . The method of claim 1 , wherein the trigger event includes:
an update to content or to the product;
a notification by a service in a cloud network that is pushed to the first managed endpoint, the notification indicating that content has been updated;
an update published to a patch catalog;
an unauthorized change to a software inventory of the first managed endpoint in the first managed network; or
an unauthorized change to a software inventory of an additional managed endpoint having a similar defined state.
10 . The method of claim 1 , wherein:
the defined state includes constraints on one or more components of the first managed network; and
the constraints include one or more or a combination of:
a product update status of one or more products of the first managed endpoint,
a product version preference of one or more products of the first managed endpoint,
a preferred product being installed at the first managed endpoint,
a vendor update installation status,
a particular product being removed or not present on the first managed endpoint,
a security setting being implemented at the first managed endpoint prior to installation of one or more products of the first managed endpoint,
a time limitation of use of one or more products of the first managed endpoint,
a location limitation of use of one or more products of the first managed endpoint,
a specific combination of one or more products of the first managed endpoint,
an indication of a vulnerability of one or more products of the first managed endpoint,
a known weakness of one or more products of the first managed endpoint, and
a threat or attack in another component or one or more products of the first managed endpoint.
11 . A non-transitory computer-readable medium having encoded therein programming code executable by one or more processors to perform or control performance of operations of vulnerability detection and mitigation in managed networks, the operations comprising:
receiving a defined state of software products on a first managed network that is hosted on a cloud network and that includes a first managed endpoint;
detecting a trigger event in the first managed network, wherein the trigger event is indicative of a change to the first managed endpoint that is inconsistent with the defined state; and
responsive to detection of the trigger event:
initiating a global scan of a second managed network having a similar defined state that is hosted on the cloud network, the global scan being configured to identify presence of the trigger event in the second managed network; and
responsive to the trigger event being present at a second managed endpoint of the second managed network, implementing a product modification process at the second managed network, wherein the product modification process includes distribution of at least one product update to a product installed at the second managed endpoint.
12 . The non-transitory computer-readable medium of claim 11 , wherein:
the cloud network includes a cloud storage device; and
the trigger event is further indicative of one or more or a combination of:
a change to the product at the first managed endpoint;
a change to data stored in on a cloud storage; and
a change to the defined state.
13 . The non-transitory computer-readable medium of claim 11 , wherein the operations further comprise implementing an automated local scan of a first additional managed endpoint of the first managed network for outstanding patches and vulnerabilities at the first additional managed endpoint responsive to detection of the trigger event.
14 . The non-transitory computer-readable medium of claim 13 , wherein the operations further comprise responsive to the trigger event being present at the first additional managed endpoint, implementing the product modification process at the first additional managed endpoint.
15 . The non-transitory computer-readable medium of claim 11 , wherein:
the operations further comprise initiating a network scan of a plurality of additional managed endpoints of the first managed network responsive to detection of the trigger event; and
the network scan is configured to identify presence of the trigger event in each of the plurality of additional managed endpoints.
16 . The non-transitory computer-readable medium of claim 15 , wherein the operations further comprise responsive to the trigger event being present at one or more additional managed endpoints of the plurality of additional managed endpoints, implementing the product modification process at the one or more additional managed endpoints.
17 . The non-transitory computer-readable medium of claim 11 , wherein the detecting includes monitoring a software management interface that records software inventory of the first managed network.
18 . The non-transitory computer-readable medium of claim 11 , wherein:
the detecting the trigger event includes communicating with a kernel driver installed at the first managed endpoint; and
the kernel driver is configured to monitor software inventory changes at the first managed endpoint.
19 . The non-transitory computer-readable medium of claim 11 , wherein the trigger event includes:
an update to content or to the product;
a notification by a service in a cloud network that is pushed to the first managed endpoint, the notification indicating that content has been updated;
an update published to a patch catalog;
an unauthorized change to a software inventory of the first managed endpoint in the first managed network; or
an unauthorized change to a software inventory of an additional managed endpoint having a similar defined state.
20 . The non-transitory computer-readable medium of claim 11 , wherein:
the defined state includes constraints on one or more components of the first managed network; and
the constraints include one or more or a combination of:
a product update status of one or more products of the first managed endpoint,
a product version preference of one or more products of the first managed endpoint,
a preferred product being installed at the first managed endpoint,
a vendor update installation status,
a particular product being removed or not present on the first managed endpoint,
a security setting being implemented at the first managed endpoint prior to installation of one or more products of the first managed endpoint,
a time limitation of use of one or more products of the first managed endpoint,
a location limitation of use of one or more products of the first managed endpoint,
a specific combination of one or more products of the first managed endpoint,
an indication of a vulnerability of one or more products of the first managed endpoint,
a known weakness of one or more products of the first managed endpoint, and
a threat or attack in another component or one or more products of the first managed endpoint.