Method and apparatus for message based security audit logging
Example embodiments of the present invention provide a method, an apparatus, and a computer program product for message based security audit logging. The method includes receiving an event notification related to an event in a storage resource management service, processing the event notification according to a messaging fabric and an ontology model, and, according to the processed event notification, persisting an audit log entry corresponding to the event.
1. A method comprising:
receiving, in a storage resource management service associated with a storage area network (SAN), an event notification having one or more event types related to one or more events at one or more event listeners configured to receive event notifications having the one or more event types in a messaging fabric according to a publish/subscribe communications model;
processing the event notification according to an ontology model, the ontology model comprising keys corresponding to event types for event audit logging, the ontology model being configured to model resources and properties of the SAN and event types; and
persisting one or more audit log entries corresponding to the one or more events according to the processed event notifications;
wherein the storage resource management service is configured to implement a messaging framework comprising:
a plurality of functional services implemented by applications running on storage resource management hosts in the SAN, the plurality of functional services being configured to detect events in the SAN and to publish messages for the detected events to the messaging fabric, the messages comprising keys in the event ontology corresponding to designated SAN event types;
a plurality of event listeners associated with different SAN event types in the ontology model, each of the plurality of event listeners being configured to detect published messages having keys corresponding to one or more designated SAN event types and to parse the published messages having keys corresponding to its designated SAN event types to identify audit-related information embedded therein by one or more of the applications running on the storage resource managements hosts in the SAN; and
a persistent data store configured to store the audit-related information parsed by the plurality of event listeners in an audit log and to provide an interface for searching and viewing the audit log.
2. The method of claim 1 wherein receiving the event notification comprises:
identifying the one or more event types for the one or more events in the event notification;
determining whether the messaging fabric comprises event listeners configured to receive event notifications related to events having the identified event types; and
creating a new event listener configured to receive event notifications related to events having a given event type responsive to determining that the messaging fabric does not include an event listener configured to receive event notifications related to events having the given event type.
3. The method of claim 2 wherein creating a new event listener configured to receive event notifications related to events having the given event type comprises:
receiving the event notification;
parsing the event notification to identify the given event type; and
persisting the given event type to the ontology model.
4. The method of claim 1 further comprising:
reading event types from the ontology model; and
registering the event types with the messaging fabric;
wherein receiving the event notification comprises receiving the event notification from one or more of the event listeners in the messaging fabric.
5. The method of claim 1 wherein processing the event notification according to the ontology model comprises:
extracting a given event from the event notification; and
determining whether the given event is valid.
6. The method of claim 5 wherein determining whether the given event is valid comprises determining whether the given event includes attributes required for its associated event type.
7. The method of claim 6 wherein persisting the one or more audit log entries comprises persisting a given audit log entry corresponding to the given event responsive to determining that the given event is valid.
8. The method of claim 6 further comprising logging an error indicating that the given event is invalid instead of persisting a given audit log entry corresponding to the given event responsive to determining that the given event is invalid.
9. The method of claim 1 wherein at least one of the messages is published asynchronously relative to detection of one or more corresponding events by one or more of the plurality of applications running on the storage resource management hosts in the SAN.
10. The method of claim 1 wherein a given message published by a given application running on a given storage resource management host in the SAN comprises a functional message and an audit message, the functional message comprising a payload specifying one or more operations performed on a storage resource in the SAN and the audit message comprising a representation of the operations performed on the storage resource in the SAN defined in accordance with the ontology model.
11. A system comprising:
one or more processors; and
memory storing computer program code that when executed on the one or more processors causes the system to:
receive, in a storage resource management service associated with a storage area network (SAN), an event notification having one or more event types related to one or more events at one or more event listeners configured to receive event notifications having the one or more event types in a messaging fabric according to a publish/subscribe communications model;
process the event notification according to an ontology model, the ontology model comprising keys corresponding to event types for event audit logging, the ontology model being configured to model resources and properties of the SAN and event types; and
persist one or more audit log entries corresponding to the one or more events according to the processed event notification;
wherein the storage resource management service is configured to implement a messaging framework comprising:
a plurality of functional services implemented by applications running on storage resource management hosts in the SAN, the plurality of functional services being configured to detect events in the SAN and to publish messages for the detected events to the messaging fabric, the messages comprising keys in the event ontology corresponding to designated SAN event types;
a plurality of event listeners associated with different SAN event types in the ontology model, each of the plurality of event listeners being configured to detect published messages having keys corresponding to one or more designated SAN event types and to parse the published messages having keys corresponding to its designated SAN event types to identify audit-related information embedded therein by one or more of the applications running on the storage resource managements hosts in the SAN; and
a persistent data store configured to store the audit-related information parsed by the plurality of event listeners in an audit log and to provide an interface for searching and viewing the audit log.
12. The system of claim 11 further comprising computer program code that when executed on the one or more processors causes the system:
to identify the one or more event types for the one or more events in the event notification;
to determine whether the messaging fabric comprises event listeners configured to receive event notifications related to events having the identified event types; and
to create a new event listener configured to receive event notifications related to events having a given event type responsive to determining that the messaging fabric does not include event listener configured to receive event notifications related to events having the given event type.
13. The system of claim 12 further comprising computer program code that when executed on the one or more processors causes the system:
to receive the event notification;
to parse the event notification to identify the given event type; and
to persist the given event type to the ontology model.
14. The system of claim 11 further comprising computer program code that when executed on the one or more processors causes the system:
to read event types from the ontology model;
to register the event types with the messaging fabric; and
to receive the event notification from one or more of the event listeners in the messaging fabric.
15. The system of claim 11 further comprising computer program code that when executed on the one or more processors causes the system:
to extract a given event from the event notification; and
to determine whether the given event is valid.
16. The system of claim 15 further comprising computer program code that when executed on the one or more processors causes the system to determine whether the given event includes attributes required for its associated event type.
17. The system of claim 16 further comprising computer program code that when executed on the one or more processors causes the system to persist a given audit log entry corresponding to the given event responsive to determining that the given event is valid.
18. The system of claim 16 further comprising computer program code that when executed on the one or more processors causes the system to log an error indicating that the given event is invalid instead of persisting a given audit log entry corresponding to the given event responsive to determining that the given event is invalid.
19. The system of claim 11 wherein a given message published by a given application running on a given storage resource management host in the SAN comprises a functional message and an audit message, the functional message comprising a payload specifying one or more operations performed on a storage resource in the SAN and the audit message comprising a representation of the operations performed on the storage resource in the SAN defined in accordance with the ontology model.
20. A computer program product having a non-transitory computer readable storage medium having computer program code encoded thereon comprising:
computer program code for receiving, in a storage resource management service associated with a storage area network (SAN), an event notification having one or more event types related to one or more event at one or more event listeners configured to receive event notifications having the one or more event types in a messaging fabric according to a publish/subscribe communications model;
computer program code for processing the event notification according to an ontology model, the ontology model comprising keys corresponding to event types for event audit logging, the ontology model being configured to model resources and properties of the SAN and event types; and
computer program code for persisting one or more audit log entries corresponding to the one or more events according to the processed event notification;
wherein the storage resource management service is configured to implement a messaging framework comprising:
a plurality of functional services implemented by applications running on storage resource management hosts in the SAN, the plurality of functional services being configured to detect events in the SAN and to publish messages for the detected events to the messaging fabric, the messages comprising keys in the event ontology corresponding to designated SAN event types;
a plurality of event listeners associated with different SAN event types in the ontology model, each of the plurality of event listeners being configured to detect published messages having keys corresponding to one or more designated SAN event types and to parse the published messages having keys corresponding to its designated SAN event types to identify audit-related information embedded therein by one or more of the applications running on the storage resource managements hosts in the SAN; and
a persistent data store configured to store the audit-related information parsed by the plurality of event listeners in an audit log and to provide an interface for searching and viewing the audit log.
21. The computer program product of claim 20 wherein a given message published by a given application running on a given storage resource management host in the SAN comprises a functional message and an audit message, the functional message comprising a payload specifying one or more operations performed on a storage resource in the SAN and the audit message comprising a representation of the operations performed on the storage resource in the SAN defined in accordance with the ontology model.