Method and apparatus for providing forensic visibility into systems and networks
Methods and systems for providing forensic visibility into systems and networks are provided. More particularly, a sensor agent may receive events defining an action of a first object acting on a target. The object, the event, and the target are then correlated to at least one originating object such that an audit trail for each individual event is created. A global perspective indicating an age, popularity, a determination as to whether the object may be malware, and IP/URL information associated with the event may then be applied to at least one of the object, the event, the target, and the originating object. A priority may then be determined and assigned to the event based on at least the global perspective. An event line containing event information is then transmitted to an end recipient where the information may be heuristically displayed.
1. A method comprising:
gathering one or more events defining an action of a first object acting on a target;
generating a contextual state for at least one of the one or more events by correlating the at least one event to an originating object, the contextual state including an indication of the originating object of the first object and an indication of at least one of a device on which the first object is executed and a user associated with the first object;
obtaining a global perspective for the at least one event by obtaining information associated with one or more of the first object and the originating object, the information including at least one of age, popularity, a determination as to whether the first object is malware, a determination as to whether the originating object is malware, Internet Protocol (IP) Address, and Uniform Resource Locator (URL) information, wherein the global perspective for one or more related events to the at least one event across a network;
assembling an event line including details associated with the at least one event, the details including information uniquely identifying the first object, the action of the first object, the target, and the originating object; and
transmitting the assembled event line.
2. The method of claim 1 , wherein the information associated with the one or more of the first object and the originating object is obtained from a community database; and
wherein the event line is transmitted to an end recipient.
3. The method of claim 1 , further comprising:
obtaining an event priority based on one or more of the generated context and the global perspective for the at least one event, wherein the event line further includes the event priority for the at least one event.
4. The method of claim 1 , wherein the at least one event includes information uniquely identifying the object performing the action, information uniquely identifying the action being performed, and information uniquely identifying the target upon which the act is being performed.
5. The method of claim 4 , further comprising:
determining whether a global perspective for the at least one event has been cached;
when the global perspective for the at least one event has been cached, determining whether a time-to-live (TTL) value has been exceeded; and
when the global perspective for the at least one event has not been cached, obtaining a global perspective for the at least one event from a community database.
6. The method of claim 5 , further comprising:
determining whether the cached global perspective for the at least one event has expired; and
when the global perspective for the at least one event has expired, obtaining a global perspective for the at least one event from a community database.
7. The method of claim 4 , further comprising:
heuristically displaying information identifying the first object performing the action, information identifying the action being performed, information identifying the target upon which the act is being performed, and the global perspective according to one or more of a location associated with the first object; at least one characteristic of an outbound connection associated with the first object; a dropped executable file; an age of the first object; and a number of concurrent connections associated with the first object.
8. A system for providing forensic visibility into a system, comprising:
a device including:
a communication interface;
a processor;
data storage; and
a sensor agent stored on the data storage that is executable by the processor, wherein the sensor agent is operable to:
gather one or more events defining an action of a first object acting on a target;
generate a contextual state for at least one of the one or more events by correlating the at least one event to an originating object, the contextual state including an indication of the originating object of the first object and an indication of at least one of a device on which the first object is executed and a user associated with the first object;
obtain a global perspective for the at least one event by obtaining information associated with one or more of the first object and the originating object, the information including at least one of age, popularity, a determination as to whether the first object is malware, a determination as to whether the originating object is malware, Internet Protocol (IP) Address, and Uniform Resource Locator (URL) information, wherein the global perspective for one or more related events to the at least one event across a network;
assemble an event line including details associated with the at least one event, the details including information uniquely identifying each of the first object, the action of the first object, the target, and the originating object; and
transmit the assembled event line utilizing the communication interface.
9. The system of claim 8 , wherein the at least one of the one or more events is executed by the processor.
10. The system of claim 8 , further comprising:
a global perspective information server; and
an end recipient device, wherein the information associated with the one or more of the first object and the originating object is obtained from the global perspective information server and the sensor agent transmits the event line to the end recipient device.
11. The system of claim 8 , wherein the sensor agent is further operable to: cache the one or more events; and asynchronously consolidate and normalize the one or more events.
12. The system of claim 8 , wherein the at least one event includes information uniquely identifying the object performing the action, information uniquely identifying the action being performed, and information uniquely identifying the target upon which the act is being performed.
13. The system of claim 12 , wherein the sensor agent is further operable to:
determine whether the global perspective for the at least one event has been cached;
when the global perspective for the at least one event has been cached, determining whether a time-to-live (TTL) value has been exceeded; and
when the global perspective for the at least one event has not been cached, obtain a global perspective for the at least one event from a community database.
14. The system of claim 13 , wherein the sensor agent is further operable to:
determine whether the cached global perspective for the at least one event has expired; and
when the global perspective for the at least one event has expired, obtain a global perspective for the at least one event from a community database.
15. The system of claim 12 , wherein the end recipient heuristically displays information identifying the first object performing the action, information identifying the action being performed, information identifying the target upon which the act is being performed, and the global perspective according to one or more of a location associated with the first object; at least one characteristic of an outbound connection associated with the first object; a dropped executable file; an age of the first object; and a number of concurrent connections associated with the first object.
16. A system for providing forensic visibility into a system, comprising:
a device including:
a communication interface;
a processor;
data storage; and
a sensor agent stored on the data storage that is executable by the processor, wherein the sensor agent is operable to:
gather one or more events defining an action of a first object acting on a target;
generate a contextual state for at least one of the one or more events by correlating the at least one event to an originating object, the contextual state including an indication of the originating object of the first object and an indication of at least one of a device on which the first object is executed and a user associated with the first object;
assemble an event line including details associated with the at least one event, the details including information uniquely identifying each of the first object, the action of the first object, the target, the originating object, and global perspective information comprising information about one or more related events to the one or more events across a network; and
transmit the assembled event line utilizing the communication interface.
17. The system of claim 16 , further comprising a global perspective information server including:
a processor;
a communication interface;
data storage; and
a global perspective module, wherein the global perspective module is operable to:
receive the event line from the device;
obtain a global perspective for the at least one event by obtaining information associated with one or more of the first object and the originating object, the information including at least one of age, popularity, a determination as to whether the first object is malware, a determination as to whether the originating object is malware, Internet Protocol (IP) Address, and Uniform Resource Locator (URL) information;
assemble a second event line including details associated with the at least one event, the details including information uniquely identifying each of the first object, the action of the first object, the target, and the originating object; and
transmit the assembled second event line utilizing the communication interface to an end recipient.
18. The system of claim 17 , wherein the end recipient heuristically displays information identifying the first object performing the action, information identifying the action being performed, information identifying the target upon which the act is being performed, and the global perspective according to one or more of a location associated with the first object; at least one characteristic of an outbound connection associated with the first object; a dropped executable file; an age of the first object; and a number of concurrent connections associated with the first object.
19. The system of claim 16 , further comprising a bridge including:
a processor;
a communication interface; and
a cached event store, wherein the cached event store is operable to:
receive a first request for a global perspective for the at least one event;
receive a second request for a global perspective for another event, the second request originating from another device;
obtain a first global perspective for the at least one event by obtaining information associated with one or more of the first object and the originating object, the information including at least one of age, popularity, a determination as to whether the first object is malware, a determination as to whether the originating object is malware, Internet Protocol (IP) Address, and Uniform Resource Locator (URL) information;
obtain a second global perspective for the another event;
provide the first global perspective to the device; and
provide the second global perspective to the another device.