DYNAMIC ASSESSMENT AND CONTROL OF SYSTEM ACTIVITY
Techniques are disclosed relating to monitoring computer system activity. In some embodiments, a computing device receives information from observation instrumentation that monitors a plurality of observation points in a computer system. The information includes information identifying activities occurring in the computer system and observed by the observation instrumentation. The computing device determines, from the received information, a risk profile associated with the computer system and, based on the risk profile, adjusts how the observation instrumentation monitors the plurality of observation points. In some embodiments, the received information includes information about one or more user activity risk factors, system risk factors, application risk factors, contact risk factors and/or enterprise risk factors. In some embodiments, based on the risk profile, the computing device causes a control action to be taken with respect to one or more components in the computer system.
1 . A non-transitory computer readable medium having stored thereon instructions that are executable by a computing device to perform operations comprising:
receiving information from observation instrumentation that monitors a plurality of observation points in a computer system, wherein the information includes information identifying activities occurring in the computer system and observed by the observation instrumentation;
determining, from the received information, a risk profile associated with the computer system; and
based on the risk profile, adjusting how the observation instrumentation monitors the plurality of observation points.
2 . The computer readable medium of claim 1 , wherein the received information includes information about one or more user activity risk factors, wherein the user activity risk factors include a presence of user activity, a privilege level of a user, whether a user is logged in locally or remotely to the computer system, information about a user's focus, and a login period.
3 . The computer readable medium of claim 1 , wherein the received information includes information about one or more system risk factors, wherein the system risk factors include a system hardware configuration, a system software configuration, a system stress level, a conformity with enterprise security and management requirements, and observed suspicion indicators.
4 . The computer readable medium of claim 1 , wherein the received information includes information about one or more application risk factors, wherein the application risk factors include an application trust level, an application's prevalence across the computer system, a likelihood that an application's execution is performed responsive to a user's instruction, and a manner in which an application accesses data in a file system or over a network.
5 . The computer readable medium of claim 1 , wherein the received information includes information about contact risk factors and enterprise risk factors.
6 . The computer readable medium of claim 1 , wherein the received information includes performance information associated with one or more components in the computer system, wherein the operations further comprise:
determining, from the received information, a performance profile for one or more components in the computer system; and
based on the performance profile, adjusting how the agents monitor the plurality of observation points.
7 . The computer readable medium of claim 6 , wherein the performance information identifies capabilities for one or more components of a network or resource utilizations associated with one or more components of the network.
8 . The computer readable medium of claim 7 , wherein the performance information includes one or more of system hardware or software capabilities, system resource utilization levels, network performance levels, application performance levels, network stress indicators, and service level objectives.
9 . The computer readable medium of claim 1 , wherein the received information includes operation state information associated with one or more components in the computer system, wherein the operations further comprise:
determining, from the received information, an operation state profile for one or more components in the computer system; and
based on the operation state profile, adjusting how the observation instrumentation monitors the plurality of observation points.
10 . The computer readable medium of claim 9 , wherein the operation state information includes system stress indicators, an indication of user presence, user activity patterns, user trust level, network characteristics, an indication of attached devices, an indication of current or expected system workload, or regulatory requirements.
11 . The computer readable medium of claim 1 , wherein the adjusting includes increasing or decreasing a frequency at which the observation instrumentation monitors one of the observations points.
12 . The computer readable medium of claim 1 , wherein the adjusting includes controlling an amount of information received from the observation instrumentation.
13 . The computer readable medium of claim 12 , wherein the observation instrumentation collects more information than the amount of information received from the observation instrumentation, wherein the observation instrumentation stores the collected information into one or more caches, and wherein the adjusting includes controlling 1) how much of the collected information is stored by the one or more caches or 2) how long the collected information is stored by the one or more caches.
14 . The computer readable medium of claim 1 , wherein the operations further comprise:
based on the risk profile, causing a control action to be taken with respect to one or more components in the computer system.
15 . The computer readable medium of claim 1 , wherein the operations further comprise:
storing a policy defining a set of criteria for monitoring the plurality of observation points;
evaluating the risk profile against the stored policy; and
based on the evaluating, adjusting how the agents monitor the plurality of observation points.
16 . The computer readable medium of claim 1 , wherein the computer system is a network having a plurality of endpoint computing devices, wherein ones of the plurality of observation points reside at ones of the plurality of endpoint computing devices.
17 . The computer readable medium of claim 16 , wherein the received information includes network flow information associated with the network.
18 . A non-transitory computer readable medium having stored thereon instructions that are executable by a computing device to perform operations comprising:
receiving information from a plurality of observation points in a computer system, wherein the information identifies activities occurring in the computer system and that are indicative of the computer system's potential security risk;
determining, from the received information, a risk profile associated with the computer system; and
based on the risk profile, causing one or more control actions to be taken at one or more control points in the computer system.
19 . The computer readable medium of claim 18 , wherein the one or more control actions include one or more of the following cyber-security risk actions:
process suspension or termination, restricting an application, restricting a user, restricting network access, restricting device usage, taking a memory dump, providing an alert, adjusting an extent of monitoring at the plurality of observation points, adjusting a degree of storage for the received information, and adjusting an endpoint security policy.
20 . The computer readable medium of claim 18 , wherein the one or more control actions include one or more of the following performance actions:
suspending or terminating a process based on a priority of the process, adjusting a priority of a process, rescheduling a process, adjusting a network priority, and adjusting an extent of monitoring at the plurality of observation points.
21 . The computer readable medium of claim 18 , wherein the one or more control actions include one or more of the following operational state actions:
restricting workload activity, restricting network activity, restricting device attachment, and managing storage or resource consumption at the plurality of observation points or at the one or more control points.
22 . A computer system, comprising:
a plurality of collectors configured to collect information from a plurality of observation points in the computer system, wherein the collected information includes cyber-security data, performance data, and operation state data about the computer system; and
one or more analyzers configured to:
analyze the collected information to determine one or more profiles for the computer system; and
based on the one or more profiles, cause one or more control actions to be taken at one or more control points in the computer system.
23 . The computer system of claim 22 , wherein the one or more control actions include adjusting an extent that ones of the plurality of collectors monitor the plurality of observation points.