File sharing framework in network security systems to synchronize data and configuration files across virtual machine clusters independent of file sharing technologies

1 . At least one security orchestration, automation and response (SOAR) appliance of a highly available (HA) security system on a data communication network, running a plurality of virtual machines within a cluster of nodes on at least one hypervisor, for sharing data and configuration files to synchronize a plurality of virtual machines independent of file sharing technology, the at least one SOAR appliance comprising:

a processor;

a network communication interface, communicatively coupled to the data communication network and to the processor; and

a memory, communicatively coupled to the processor and the network communication interface and storing:

a file sync database to store shared data and configuration files to support security operations on the cluster of nodes;

a file sync controller to receive notification of a file sharing command to share a specific file across at least two of the plurality of virtual machines as indicated in the file sharing command;

a virtual machine source node from the cluster of nodes to, responsive to receiving the file sharing command from an application in a virtual machine in the cluster of nodes, to copy the shared file to a source workspace directory and compress, and then copy the compressed file to the file sync database, wherein the command comprises a configuration template with file retrieval information; and

a virtual machine target node from the cluster of nodes to, listen for commands from other nodes in the cluster of nodes, and responsive to receiving the file sharing command, copy the compressed file to a target workspace directory and decompress, and then copy the shared file to the target node, according to the file retrieval information, wherein the virtual machine target node is located remotely from the virtual machine source node, in a different virtual machine pool.

2 . The at least one computing device of claim 1 , wherein the source node and the target node are both executing on the at least one SOAR appliance.

3 . The at least one computing device of claim 1 , wherein the source node is executing on a first SOAR appliance and the target node is executing on a second SOAR appliance, on the same local access network.

4 . The at least one computing device of claim 1 , wherein the source node executes on a first SOAR appliance on a first local access network and the target node executes on a second SOAR appliance on a second local access network.

5 . The at least one computing device of claim 1 , wherein the source node uses a first file sharing technology and the target node uses a second file sharing technology.

6 . The at least one computing device of claim 1 , wherein control module deletes the file from the workspace directory after being copied.

7 . The at least one computing device of claim 1 , further comprising a second target node, wherein responsive to the commend, the second target node copies the file from the workspace directory.

8 . The at least one computing device of claim 1 , wherein the source node and the target node are part of a highly available system.

9 . The at least one computing device of claim 1 , wherein the file comprises a configuration file for the cluster of nodes.

10 . The at least one computing device of claim 1 , further comprising a new node detector, wherein responsive to detecting onboarding of a new node, generating the command towards the new node as the target node to sync configuration files for the cluster of nodes.

11 . The computing device of claim 1 , wherein the file share command is responsive to a new node joining the cluster of nodes that needs to be synchronized.

12 . The computing device of claim 1 , wherein the computing device notifies a remote server responsive to the process not executing after exposure to the virtual machine parameters.

13 . A method in at least one security orchestration, automation and response (SOAR) appliance of a highly available (HA) security system on a data communication network, running a plurality of virtual machines within a cluster of nodes on at least one hypervisor, for sharing data and configuration files to synchronize a plurality of virtual machines independent of file sharing technology, the method comprising the steps of:

storing shared data and configuration files to support security operations on the cluster of nodes in a file sync database;

receiving notification of a file sharing command to share a specific file across at least two of the plurality of virtual machines as indicated in the file sharing command;

responsive to receiving the file sharing command at a virtual machine source node from an application in a virtual machine in the cluster of nodes, copying the shared file to a source workspace directory and compress, and then copy the compressed file to the file sync database, wherein the command comprises a configuration template with file retrieval information; and

listening for commands from other nodes in the cluster of nodes, and responsive to receiving the file sharing command, copying the compressed file to a target workspace directory and decompress, and then copying the shared file to the virtual machine target node, according to the file retrieval information, wherein the virtual machine target node is located remotely from the virtual machine source node, in a different virtual machine pool.

14 . A non-transitory computer-readable media in at least one method in at least one security orchestration, automation and response (SOAR) appliance of a highly available (HA) security system on a data communication network, running a plurality of virtual machines within a cluster of nodes on at least one hypervisor, implemented at least partially in hardware for, when executed by a processor, for sharing data and configuration files to synchronize a plurality of virtual machines independent of file sharing technology, the method comprising the steps of:

storing shared data and configuration files to support security operations on the cluster of nodes in a file sync database;

receiving notification of a file sharing command to share a specific file across at least two of the plurality of virtual machines as indicated in the file sharing command;

responsive to receiving the file sharing command at a virtual machine source node from an application in a virtual machine in the cluster of nodes, copying the shared file to a source workspace directory and compress, and then copy the compressed file to the file sync database, wherein the command comprises a configuration template with file retrieval information; and

listening for commands from other nodes in the cluster of nodes, and responsive to receiving the file sharing command, copying the compressed file to a target workspace directory and decompress, and then copying the shared file to the target virtual machine node, according to the file retrieval information, wherein the virtual machine target node is located remotely from the virtual machine source node, in a different virtual machine pool.