Generating machine data collection scripts from security policy content
A script generation service is disclosed that parses a security policy to identify data objects controlled by the policy and generate data collection commands in a shell scripting language to collect states of the data objects from machines. In embodiments, the security policy is written in a policy specification language that allows data objects to be specified using references to object entities, variables, other objects, transformation functions, and/or state filters. The generation service is capable of resolving these types of references either during the script generation process or using commands in the generated script. In embodiments, the generated scripts are pushed to data collection agents executing on machines in a monitored network, which can execute the scripts as authenticated processes to collect and return machine state data about the machines. The machine state data is then assessed to identify possible security policy violations.
1 . A system, comprising:
one or more computing devices configured to implement a script generation service, configured to:
receive a security policy specified in a security policy specification language (SPSL);
parse the security policy to identify a plurality of tests to check compliance of a machine, wherein individual ones of the tests specify (a) one or more data objects to be checked and (b) one or more compliant states of the one or more data objects;
generate data collection commands for data objects identified in the security policy, wherein the data collection commands are generated as one or more shell scripts executable on the machine to collect respective states of the data objects; and
send, over one or more networks, the one or more shell scripts generated from the security policy to a computer network, wherein the computer network includes a plurality of machines that execute agents configured to collect machine state data of the machines using the one or more shell scripts.
2 . The system of claim 1 , wherein:
the security policy specifies a data object that includes a variable; and
the script generation service resolves the variable to generate one or more data collection commands for the data object.
3 . The system of claim 1 , wherein:
the security policy specifies a data object that includes a reference to another data object; and
the script generation service resolves the reference to the other data object to generate one or more data collection commands for the data object.
4 . The system of claim 1 , wherein:
the security policy specifies a data object using one or more transformation functions defined by the SPSL; and
the script generation service generates one or more data collection commands for the data object based on the one or more transformation functions.
5 . The system of claim 1 , wherein:
the security policy specifies a data object using one or more state filters on a state of the data object; and
the script generation service generates one or more data collection commands for the data object to implement the one or more filters.
6 . The system of claim 1 , wherein the security policy is a public benchmark published by a security standard-setting organization.
7 . The system of claim 1 , wherein the script generation service is configured to generate shell scripts in different shell scripting languages.
8 . The system of claim 1 , wherein:
the script generation service executes as part of a network monitoring service configured to monitor compliance of a plurality of client networks;
the computer network is a client network monitored by the network monitoring service; and
the network monitoring service is configured to, periodically:
collect the machine state data from the computer network via the data collection agents;
assess the machine state data for compliance with the security policy; and
generate a notification when a violation of the security policy is detected.
9 . The system of claim 8 , wherein:
the network monitoring service is implemented using resources of an infrastructure provider network; and
the generation of the one or more data collection scripts are performed by one or more virtual compute instances provisioned on the infrastructure provider network.
10 . The system of claim 8 , wherein:
the data collection agents execute as authenticated processes in the computer network; and
the network monitoring service is configured to collect the machine state data without supplying authentication credentials for the computer network.
11 . A method, comprising:
executing a script generation service implemented using one or more computing devices, including:
receiving a security policy specified in a security policy specification language (SPSL);
parsing the security policy to identify a plurality of tests to check compliance of a machine, wherein individual ones of the tests specify (a) one or more data objects to be checked and (b) one or more compliant states of the one or more data objects;
generating data collection commands for data objects identified in the security policy, wherein the data collection commands are generated as one or more shell scripts executable on the machine to collect respective states of the data objects; and
sending, over one or more networks, the one or more shell scripts generated from the security policy to a computer network, wherein the computer network includes a plurality of machines that execute agents configured to collect machine state data of the machines using the one or more shell scripts.
12 . The method of claim 11 , wherein the security policy is a public benchmark published by a security standard-setting organization.
13 . The method of claim 11 , wherein:
the security policy specifies a data object using one or more references to one or more object entities, variables, other objects, transformation functions, or state filters in accordance with a schema specified by the SPSL; and
the script generation service resolves the one or more references to generate one or more data collection commands for the data object.
14 . The method of claim 11 , wherein:
the script generation service executes as part of a network monitoring service configured to monitor compliance of a plurality of client networks;
the computer network is a client network monitored by the network monitoring service; and
the method comprises the network monitoring service periodically:
collecting the machine state data from the computer network via the data collection agents;
assessing the machine state data for compliance with the security policy; and
generating a notification when a violation of the security policy is detected.
15 . The method of claim 14 , further comprising:
using the machine state data to update a configuration snapshot of the computer network stored in a database; and
assessing the machine state data for violations includes issuing queries to the configuration snapshot.
16 . The method of claim 15 , wherein the queries used to assess the machine state data are generated based on the parsing of the security policy.
17 . The method of claim 14 , further comprising:
comparing current assessment results of the computer network for a current assessment period to previous assessment results of the computer network for a previous assessment period stored in a results cache; and
generating an alert in response to one or more changes in the current assessment results detected based on the comparison.
18 . The method of claim 11 , further comprising:
storing a mapping of individual data objects in the security policy and respective data collection commands generated for the individual data objects;
determining that an update to the security policy has occurred;
determining a list of data object that are affected by the update; and
regenerating the subset of the data collection commands based on the list and the mapping.
19 . The method of claim 18 , further comprising:
selecting a scheduled time to regenerate the subset of the data collection commands, wherein the schedule time is before a next data collection time of the computer network; and
causing the script generation service to regenerate the subset of the data collection commands at the scheduled time.
20 . The method of claim 18 , wherein the update to the security policy is received via a graphical user interface.