Adaptive system for network and security management
Systems and methods are described for identifying computer risk. A system may receive a set of input signals from independent sources. The system may use a header tracing component to discover and manage service dependencies and maps based on the input signals. The system may then configure new content sources or modify existing content sources based on service dependencies and maps. After configuration, the system may detect configuration, and setup monitoring of alert rules.
1 . A system for monitoring third-party services for computer risk, the system configured to:
receive a set of inputs from a plurality of independent sources, wherein the set of inputs comprise at least information regarding third-party service providers; and
determine, via a third-party monitoring services component of the system, for configuring third-party content sources, rules for monitoring and alerting on the content sources of the third-party service providers, wherein the third-party monitoring services component is configured to:
use a header tracing component to discover and manage service dependencies and maps;
based on processing results from the header tracing component, configure new content sources or modify existing content source configurations to include or exclude missing fields or information; and
based on the processing results from the header tracing component, detect configuration and setup of monitoring and alerting rules on the third-party monitoring services.
2 . The system as recited in claim 1 , wherein the third-party monitoring services component identifies new content sources based on at least one of analyzing types of data to monitor and examining existing gaps on the third-party monitoring systems.
3 . The system as recited in claim 2 , where in the monitoring gaps are derived by comparing discovered entities by these third-party monitoring systems and determining when there is missing information from those entities.
4 . The system as recited in claim 3 , wherein the third-party monitoring services component is further configured to classify observed entities into high-level categories including databases, wherein the databases include at least one of MySQL, BigQuery, and PostgreSQL.
5 . The system as recited in claim 4 , wherein the third-party monitoring services component is further configured to at least one of maintain and update a database of log types and fields captured by categories, using a combination of expert training and observed configurations.
6 . The system as recited in claim 5 , wherein the third-party monitoring services component is further configured to compare the database of log types and fields with observed entities to determine gaps in monitoring coverage.
7 . The system as recited in claim 6 , wherein the third-party monitoring services component is further configured to recommend actions based on the determined gaps, wherein the recommended actions, upon user approval, automatically configure new content sources.
8 . The system as recited in claim 1 , wherein the third-party monitoring services component is further configured to detect optimal configuration and setup of third-party detection and monitoring tools in cloud environments based on dynamic changes in infrastructure and budget restrictions.
9 . The system as recited in claim 8 , wherein the third-party monitoring services component is further configured to receive inputs from subcomponents including entity impact analysis and detection coverage, wherein the subcomponents provide information about risky entry points, chokepoints, and high-value assets (HVAs).
10 . The system as recited in claim 9 , wherein the third-party monitoring services component is further configured to classify gaps determined in existing detection and observability coverage by comparing based on comparison with frameworks such as including at least one of MITRE ATT&CK, NIST, and SRE golden signals.
11 . The system as recited in claim 10 , wherein the third-party monitoring services component is further configured to classify generate recommendations for setting up new tools, configuring parameters, or fine-tuning existing setups to enhance overall detection and observability capabilities.
12 . The system as recited in claim 11 , wherein the third-party monitoring services component is further configured to run continuously to identify gaps in the monitoring and detection configuration, and provide recommendations to a user for approval.
13 . A method comprising:
receiving a set of inputs from a plurality of independent sources, wherein the set of inputs comprise at least information regarding third-party service providers; and
determining, via a third-party monitoring services component, for configuring third-party content sources, rules for monitoring and alerting on the content sources of the third-party service providers, wherein the third-party monitoring services component is configured to:
discovering and managing service dependencies and maps to form processing results;
based on processing results, configuring new content sources or modify existing content source configurations to include or exclude missing fields or information and based on the processing results detecting configuration and setup of monitoring; and
alerting rules on the third-party monitoring services.
14 . The method as recited in claim 13 , wherein intelligence on new content sources and modifications to existing content sources is derived from analyzing types of data to monitor and examining existing gaps on the third-party monitoring methods.
15 . The method as recited in claim 14 , further comprising classifying observed entities into high-level categories including databases, wherein the databases include at least one of MySQL, BigQuery, and PostgreSQL.
16 . The method as recited in claim 15 , further comprising maintaining and updating a database of log types and fields captured by categories, using a combination of expert training and observed configurations.
17 . The method as recited in claim 16 , further comprising comparing the database of log types and fields with observed entities to determine gaps in monitoring coverage.
18 . The method as recited in claim 17 , further comprising triggering recommended actions based on the determined gaps, wherein the recommended actions, upon user approval, automatically configure new content sources.
19 . The method as recited in claim 13 , further comprising continuously detecting optimal configuration and setup of third-party detection and monitoring tools in cloud environments based on dynamic changes in infrastructure and budget restrictions.
20 . The method as recited in claim 19 , further comprising receiving inputs from subcomponents including entity impact analysis and detection coverage, wherein the subcomponents provide information about risky entry points, chokepoints, and high-value assets (HVAs).
21 . The method as recited in claim 20 , further comprising: determining gaps in existing detection and observability coverage.
22 . The method as recited in claim 21 , further comprising generating recommendations for setting up new tools, configuring parameters, or fine-tuning existing setups to enhance overall detection and observability capabilities.
23 . The method as recited in claim 22 , further comprising running continuously to identify gaps in the monitoring and detection configuration, and providing recommendations to a user for approval.