Systems and methods for active directory protection in zero trust networks
Systems and methods for active directory protection in zero trust networks. In an embodiment, steps include performing inline monitoring of traffic associated with a cloud-based system; detecting one or more active directory protocols based on the inline monitoring; classifying the traffic as being associated with any of the one or more active directory protocols; inspecting the traffic associated with the one or more detected active directory protocols; and generating one or more active directory logs based on the inspecting and classifying.
1 . A method comprising steps of:
performing inline monitoring, by one or more enforcement nodes of a cloud-based system, of traffic associated with secure tunnels established through the cloud-based system between user devices and private applications;
detecting one or more active directory protocols based on the inline monitoring;
classifying the traffic as being associated with any of the one or more active directory protocols;
inspecting the traffic associated with the one or more detected active directory protocols; and
generating one or more active directory logs based on the inspecting and classifying, wherein the one or more active directory logs are exported from the one or more enforcement nodes, over secure connections, to a log routing system of the cloud-based system for storage and analytics, wherein the generating includes generating a plurality of active directory logs, wherein each of the plurality of active directory logs is associated with one of the one or more active directory protocols, and wherein the plurality of active directory logs comprise intrusion detection and prevention system (IDPS) logs generated for each of a client identifier, domain, and port tuple at a configured periodic interval, the periodic interval being configurable, and
wherein each IDPS log includes protocol-specific counters indicating at least successes, errors, and types of errors for the associated protocol.
2 . The method of claim 1 , wherein the steps further comprise:
generating one or more active directory trend visualizations based on the active directory logs.
3 . The method of claim 2 , wherein the steps further comprise:
providing the one or more active directory trend visualizations via a User Interface (UI).
4 . The method of claim 2 , wherein the one or more active directory trend visualizations include a trend timeline chart.
5 . The method of claim 2 , wherein the one or more active directory trend visualizations includes a trend timeline chart associated with each of the one or more active directory protocols.
6 . The method of claim 1 , wherein the detecting includes automatically detecting active directory protocols based on ports and payload format inspection.
7 . The method of claim 1 , wherein the inspecting includes uncovering anomalies associated with the traffic associated with the one or more active directory protocols, wherein uncovering the anomalies comprises automatically detecting, by an inspection pipeline including a protocol detection stage and a protocol-specific parsing stage, suspicious activity based on at least one of unusual counters, unused or invalid data, or an unusual number of requests exhibiting errors relative to successes with respect to a normalized behavior baseline, and generating the one or more active directory logs to include fields indicating the detected anomalies.
8 . The method of claim 1 , wherein the steps further comprise:
receiving one or more active directory protection configurations prior to the monitoring, wherein the one or more active directory protection configurations specify one or more application segments or segment groups for performing the steps thereon.
9 . The method of claim 1 , wherein the one or more active directory protocols include Light-weight Directory Access Protocol (LDAP), Server Message Block (SMB), and Kerberos (KRB).
10 . A non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors to perform steps of:
performing inline monitoring, by one or more enforcement nodes of a cloud-based system, of traffic associated with secure tunnels established through the cloud-based system between user devices and private applications;
detecting one or more active directory protocols based on the inline monitoring;
classifying the traffic as being associated with any of the one or more active directory protocols;
inspecting the traffic associated with the one or more detected active directory protocols; and
generating one or more active directory logs based on the inspecting and classifying, wherein the one or more active directory logs are exported from the one or more enforcement nodes, over secure connections, to a log routing system of the cloud-based system for storage and analytics, wherein the generating includes generating a plurality of active directory logs, wherein each of the plurality of active directory logs is associated with one of the one or more active directory protocols, and wherein the plurality of active directory logs comprise intrusion detection and prevention system (IDPS) logs generated for each of a client identifier, domain, and port tuple at a configured periodic interval, the periodic interval being configurable, and wherein each IDPS log includes protocol-specific counters indicating at least successes, errors, and types of errors for the associated protocol.
11 . The non-transitory computer-readable medium of claim 10 , wherein the steps further comprise:
generating one or more active directory trend visualizations based on the active directory logs.
12 . The non-transitory computer-readable medium of claim 11 , wherein the steps further comprise:
providing the one or more active directory trend visualizations via a User Interface (UI).
13 . The non-transitory computer-readable medium of claim 11 , wherein the one or more active directory trend visualizations include a trend timeline chart.
14 . The non-transitory computer-readable medium of claim 11 , wherein the one or more active directory trend visualizations includes a trend timeline chart associated with each of the one or more active directory protocols.
15 . The non-transitory computer-readable medium of claim 10 , wherein the detecting includes automatically detecting active directory protocols based on ports and payload format inspection.
16 . The non-transitory computer-readable medium of claim 10 , wherein the inspecting includes uncovering anomalies associated with the traffic associated with the one or more active directory protocols, wherein uncovering the anomalies comprises automatically detecting, by an inspection pipeline including a protocol detection stage and a protocol-specific parsing stage, suspicious activity based on at least one of unusual counters, unused or invalid data, or an unusual number of requests exhibiting errors relative to successes with respect to a normalized behavior baseline, and generating the one or more active directory logs to include fields indicating the detected anomalies.
17 . The non-transitory computer-readable medium of claim 10 , wherein the steps further comprise:
receiving one or more active directory protection configurations prior to the monitoring, wherein the one or more active directory protection configurations specify one or more application segments or segment groups for performing the steps thereon.
18 . The non-transitory computer-readable medium of claim 10 , wherein the one or more active directory protocols include Light-weight Directory Access Protocol (LDAP), Server Message Block (SMB), and Kerberos (KRB).