Configuration management for network activity detectors
Network activity detectors, such as firewalls, communicate with one another to form a Unified Threat Management System. A first network activity detector sends a request for configuration settings to a second network activity detector. The second network activity detector sends a set of configuration settings in response to the request. The configuration settings include information for detecting digital security threats and/or for responding to detected digital security threats. In this way, configuration settings are propagated from one network activity detector to another so that network activity detectors within a UTMS system are configured consistently, e.g., have up-to-date information for detecting and/or responding to digital security threats.
1. A method of distributing configuration information of network activity detectors in detecting digital security threats in a computer network having a plurality of network activity detectors, including a first network activity detector, a second network activity detector, and a third network activity detector, the method comprising:
identifying, by the first network activity detector during start-up of the first network activity detector, the second network activity detector as a source of the configuration information, wherein the second network activity detector stores the configuration information of network activity detectors in detecting digital security threats;
in response to the first network activity detector identifying the second network activity detector as the source during the start-up of the first network activity detector, sending, by the first network activity detector to the second network activity detector, a request for the configuration information; and
receiving, by the first network activity detector from the second network activity detector, the configuration information;
configuring the first network activity detector as a second source of the configuration information; and
sending, by the first network activity detector as the second source, the configuration information to the third network activity detector during start-up of the third network activity detector.
2. The method of claim 1 , wherein:
the request is sent using a UDP network packet.
3. The method of claim 1 , wherein:
the configuration information sent by the first network activity detector to the third network activity detector is at least partially encrypted; and
the encryption is based on one or more of a MAC address of the third network activity detector, a process identifier of an operating environment running on the third network activity detector, and a serial number of a processor of the third network activity detector.
4. The method of claim 1 , further comprising:
creating another set of configuration information.
5. The method of claim 1 , further comprising:
receiving, from the third network activity detector, a request for the configuration information; and
instructing, by the first network activity detector, the third network activity detector to send future requests for configuration information to a fourth network activity detector,
wherein the fourth network activity detector is different from the first network activity detector.
6. The method of claim 5 , further comprising:
instructing, by the first network activity detector, the fourth network activity detector to respond to requests for configuration information.
7. The method of claim 1 , wherein the identifying comprises determining that the second network activity detector is in a predefined operating mode.
8. A non-transitory computer-readable storage medium having computer-executable instructions, wherein the computer-executable instructions, when executed by one or more computer processors, cause the one or more computer processors to perform a method of distributing configuration information of network activity detectors in detecting digital security threats in a computer network having a plurality of network activity detectors, including a first network activity detector, a second network activity detector, and a third network activity detector, the method comprising:
identifying, by the first network activity detector during start-up of the first network activity detector, the second network activity detector as a source of the configuration information, wherein the second network activity detector stores the configuration information of network activity detectors in detecting digital security threats;
in response to the first network activity detector identifying the second network activity detector as the source during the start-up of the first network activity detector,
sending, by the first network activity detector to the second network activity detector, a request for the configuration information; and
receiving, by the first network activity detector from the second network activity detector, the configuration information;
configuring the first network activity detector as a second source of the configuration information; and
sending, by the first network activity detector as the second source and to the third network activity detector, the configuration information during start-up of the third network activity detector.
9. The computer-readable storage medium of claim 8 , wherein:
the request is sent using a UDP network packet.
10. The computer-readable storage medium of claim 8 , wherein:
the configuration information sent by the first network activity detector to the third network activity detector is at least partially encrypted; and
the encryption is based on one or more of a MAC address of the third network activity detector, a process identifier of an operating environment running on the third network activity detector, and a serial number of a processor of the third network activity detector.
11. The computer-readable storage medium of claim 8 , wherein the computer-executable instructions further comprises instructions for:
creating another set of configuration information.
12. The computer-readable storage medium of claim 8 , wherein the computer-executable instructions further comprises instructions for:
receiving, from the third network activity detector, a request for the configuration information; and
instructing, by the first network activity detector, the third network activity detector to send future requests for configuration information to a fourth network activity detector,
wherein the fourth network activity detector is different from the first network activity detector.
13. The computer-readable storage medium of claim 12 , wherein the computer-executable instructions further comprises instructions for:
instructing, by the first network activity detector, the fourth network activity detector to respond to requests for configuration information.
14. The computer-readable storage medium of claim 8 , wherein the identifying comprises determining that the second network activity detector is in a predefined operating mode.
15. A network activity detector configured to perform a method of distributing configuration information of network activity detectors in detecting digital security threats in a computer network having a plurality of network activity detectors, including the network activity detector, a second network activity detector, and a third network activity detector, the network activity detector comprising:
a network interface configured to couple with the network; and
a processor configured to:
identify, during start-up of the network activity detector, the second network activity detector as a source of the configuration information, wherein the second network activity detector stores the configuration information of network activity detectors in detecting digital security threats;
in response to the second network activity detector being identified as the source during the start-up of the network activity detector,
send, to the second network activity detector, a request for the configuration information; and
receive, from the second network activity detector, the configuration information;
configure the network activity detector as a second source of the configuration information; and
send, by the network activity detector as the second source and to the third network activity detector, the configuration information during start-up of the third network activity detector.
16. The network activity detector of claim 15 , wherein:
the request is sent using a UDP network packet.
17. The network activity detector of claim 15 , wherein the network activity detector is a first network activity detector, and wherein:
the configuration information sent by the first network activity detector to the third network activity detector is at least partially encrypted; and
the encryption is based on one or more of a MAC address of the third network activity detector, a process identifier of an operating environment running on the third network activity detector, and a serial number of a processor of the third network activity detector.
18. The network activity detector of claim 15 , wherein the processor is further configured to:
create another set of configuration information.
19. The network activity detector of claim 15 , wherein the network activity detector is a first network activity detector and the processor of the first network activity detector is further configured to:
receive, from the third network activity detector, a request for the configuration information; and
instruct, by the first network activity detector, the third network activity detector to send future requests for configuration information to a fourth network activity detector,
wherein the fourth network activity detector is different from the first network activity detector.
20. The network activity detector of claim 19 , wherein the processor is further configured to:
instruct, by the first network activity detector, the fourth network activity detector to respond to requests for configuration information.
21. The network activity detector of claim 15 , wherein the identifying comprises determining that the second network activity detector is in a predefined operating mode.