Framework for coordination between endpoint security and network security services
View Patent ↗Systems and techniques are described for virtual machine security. A described technique includes operating one or more virtual machines each in accordance with a respective security container, wherein the respective security container is associated with a respective rule that specifies transfer of the virtual machine from the respective security container to a quarantine container based on one or more criteria. One or more security services are operated on the one or more virtual machines to identify one or more security threats associated with one or more of the virtual machines. One or more tags generated by the endpoint security services are obtained, where each tag is for a virtual machine that is associated with one of the identified security threats. And one of the virtual machines is identified as requiring transfer to the quarantine container based on, at least, one or more of the obtained tags and the one or more criteria.
1. A computer-implemented method comprising:
through a user interface, receiving data to create a security container and to associate a security service and a tag-based rule with the security container;
assigning a virtual machine (VM) to the security container by:
detecting a user membership group in response to a login event of the VM;
selecting the security container based on the user membership group; and
assigning the VM associated with the VM login event to the selected security container;
through the VM's association with the service container, operating the security service on the VM to identify a security threat associated with the VM and to assign a tag with the VM;
using the tag-based rule to process the tag, and in response, to re-assign the VM to a quarantine container until the security threat is resolved, wherein VMs assigned to the quarantine container have restricted network connectivity; and
after resolution of the security threat, removing the tag from the VM and transferring the VM back to the security container.
2. The method of claim 1 further comprising associating a network firewall setting with the quarantine container to restrict network connectivity of VMs associated with the quarantine container.
3. The method of claim 1 , wherein the tag-based rule specifies a threat level threshold.
4. The method of claim 1 , wherein the quarantine container is one quarantine container from a plurality of quarantine containers, the tag is a first tag, the tag-based rule is a first tag-based rule, and the security threat is a first security threat, the method further comprising:
operating the security service on a second VM through the second VM's association with a second security container to identify a second security threat associated with the second VM and to assign a second tag for the second security threat to the second VM, wherein the second security container is associated with a second tag-based rule that specifies a second quarantine container from the plurality of quarantine containers to transfer the second VM based on the second tag; and
re-assigning the second VM from the second security container to the second quarantine container based on the second.
5. The method of claim 1 , wherein the security service is a first security service, the tag is a first tag, and a second security service is associated with the security container, wherein the second security service identifies a different security threat and assigns a different tag to the VM.
6. A system comprising:
a data processing apparatus programmed to perform operations comprising:
through a user interface, receiving data to create a security container and to associate a security service and a tag-based rule with the security container;
associating a network firewall setting with a quarantine container to restrict network connectivity of VMs associated with the quarantine container;
assigning a virtual machine (VM) to the security container by:
detecting a user membership group in response to a login event of the VM;
selecting the security container based on the user membership group; and
assigning the VM associated with the VM login event to the selected security container;
through the VM's association with the service container, operating the security service on the VM to identify a security threat associated with the VM and to assign a tag with the VM;
using the tag-based rule to process the tag, and in response, to re-assign the VM to a quarantine container until the security threat is resolved, wherein the VM assigned to the quarantine container has restricted network connectivity;
after resolution of the security threat, removing the tag from the VM and transferring the VM back to the security container.
7. The system of claim 6 , wherein the tag-based rule specifies a threat level threshold.
8. The system of claim 6 , wherein the quarantine container is one quarantine container from a plurality of quarantine containers, the tag is a first tag, the tag- based rule is a first tag-based rule, and the security threat is a first security threat, wherein the operations further comprise:
operating the security service on a second VM through the second VM's association with a second security container to identify a second security threat associated with the second VM and to assign a second tag for the second security threat to the second VM, wherein the second security container is associated with a second tag-based rule that specifies a second quarantine container from the plurality of quarantine containers to transfer the second VM based on the second tag; and
re-assigning the second VM from the second security container to the second quarantine container based on the second tag.
9. A non-transitory machine readable storage medium storing a program which when executed by a set of processing units manages virtual machines, the program comprising sets of instructions for:
through a user interface, receiving data to create a security container and to associate a security service and a tag-based rule with the security container;
assigning a virtual machine (VM) to the security container by:
detecting a user membership group in response to a login event of the VM;
selecting the security container based on the user membership group; and
assigning the VM associated with the VM login event to the selected security container:
through the VM's association with the service container, operating the security service on the VM to identify a security threat associated with the VM and to assign a tag with the VM;
using the tag-based rule to process the tag, and in response, to re-assign the VM to a quarantine container until the security threat is resolved, wherein VMs assigned to the quarantine container have restricted network connectivity; and
after resolution of the security threat, removing the tag from the VM and transferring the VM back to the security container.
10. The non-transitory machine readable storage medium of claim 9 , wherein the program further comprises a set of instructions for associating a network firewall setting with the quarantine container to restrict network connectivity of VMs associated with the quarantine container.
11. The non-transitory machine readable storage medium of claim 9 wherein the tag-based rule specifies a threat level threshold.