Honeypot asset cloning
Approaches provide for a management component to manage distribution of configuration information or other information in a network environment. For example, a request to deploy a security appliance configured to replicate functionality, behavior, and/or an identity of a computing device is received. The request includes selection criteria specifying one or more computing devices to replicate. Using the selection criteria, a computing device is identified as well as information associated with the computing device. The identified information is modified based on configuration requirements for a security appliance. The modified information is used to generate configuration information which is used to perform one of a number of actions, including, for example, configuring the security appliance or generating a new security appliance, among other such actions, where at least a portion of the operating behavior, functionality, or identification information of the security appliance substantially matches that of the identified computing device.
1. A computing system, comprising:
at least one computing device processor;
a memory device including instructions that, when executed by the at least one computing device processor, enables the computing system to:
maintain a data store in an electronic environment, the data store including information regarding a plurality of computing device assets connected to the computing system via a network;
receive a request to manage configuration deployments, the request comprising selection criteria;
identify, based at least in part on the selection criteria associated with the request, at least one computing asset in the plurality of computing device assets;
identify information in the data store associated with the at least one identified computing asset, wherein the identified information in the data store is configuration information for the at least one computing asset;
modify the identified information based at least in part on configuration requirements for at least one replicated asset to create modified asset identifying information that is different from the identified information in the data store associated with the at least one identified computing asset;
generate at least one configuration file based at least in part on the modified asset identifying information; and
configure the at least one replicated asset using the at least one configuration file, wherein at least a portion of the at least one replicated asset is a copy of the at least one identified computing asset.
2. The computing system of claim 1 , wherein the instructions, when executed by the at least one computing device processor, further enables the computing system to:
transmit the at least one configuration file to at least one replicated asset.
3. The computing system of claim 1 , wherein the instructions, when executed by the at least one computing device processor, further enables the computing system to:
generate a replicated asset based at least in part on the at least one configuration file.
4. The computing system of claim 1 , wherein information for the plurality of computing device assets includes for each computer asset at least one of an operating system version, a service banner, an open port, or a MAC address.
5. The computing system of claim 1 , wherein the instructions, when executed by the at least one computing device processor to modify the identified information, further enable the computing system to normalize the identified information.
6. The computing system of claim 1 , wherein the instructions, when executed by the at least one computing device processor to modify the identified information, further enable the computing system to replace a first value in the identified information with a second value associated with the at least one replicated asset.
7. The computing system of claim 1 , wherein the instructions, when executed by the at least one computing device processor to modify the identified information, further enable the computing system to identify mapping information that identifies a subset of the identified information supported by at least one replicated asset.
8. The computing system of claim 1 , wherein the instructions, when executed by the at least one computing device processor further provides an import engine operable to aggregate data from a plurality of data sources and supply it to the data store.
9. A computer-implemented method, comprising:
receiving a request to manage configuration deployments, the request comprising selection criteria;
identifying, based at least in part on the selection criteria associated with the request, a computing asset of a plurality of computing assets connected via a network;
identifying information in a data store associated with the at least one identified computing asset, wherein the identified information in the data store is configuration information for the at least one computing asset;
modifying the identified information based at least in part on configuration requirements for at least one security appliance to create modified asset identifying information that is different from the identified information in the data store associated with the at least one identified computing asset;
generating at least one configuration file based at least in part on the modified asset identifying information; and
configuring the at least one security appliance using the at least one configuration file, wherein at least a portion of the at least one security appliance is a copy of the at least one identified computing asset.
10. The computer-implemented method of claim 9 , further comprising:
transmitting the at least one configuration file to the at least one security appliance.
11. The computer-implemented method of claim 9 , further comprising:
generating a security appliance based at least in part on the at least one configuration file.
12. The computer-implemented method of claim 9 , wherein information for the plurality of computing assets includes for each computer asset at least one of an operating system version, a service banner, an open port, or a MAC address.
13. The computer-implemented method of claim 9 , further comprising:
normalizing the identified information.
14. The computer-implemented method of claim 9 , further comprising:
replacing a first value in the identified information with a second value associated with the at least one security appliance.
15. The computer-implemented method of claim 9 , further comprising:
identifying mapping information that identifies a subset of the identified information supported by at least one security appliance.
16. The computer-implemented method of claim 9 , further comprising:
enabling an import engine to aggregate data from a plurality of data sources.
17. A non-transitory computer readable storage medium storing instructions that, when executed by at least one processor of a computing system, causes the computing system to:
maintain a data store in an electronic environment, the data store including information regarding a plurality of computing device assets connected to the computing system via a network;
receive a request to manage configuration deployments, the request comprising selection criteria;
identify, based at least in part on the selection criteria associated with the request, at least one computing asset in the plurality of computing device assets;
identify information in the data store associated with the at least one identified computing asset, wherein the identified information in the data store is configuration information for the at least one computing asset;
modify the identified information based at least in part on configuration requirements for at least one replicated asset to create modified asset identifying information that is different from the identified information in the data store associated with the at least one identified computing asset;
generate at least one configuration file based at least in part on the modified asset identifying information; and
configure the at least one replicated asset using the at least one configuration file, wherein at least a portion of the at least one replicated asset is a copy of the at least one identified computing asset.
18. The non-transitory computer readable storage medium of claim 17 , wherein the instructions, when executed by the at least one processor further enables the computing system to:
generate a replicated asset based at least in part on the at least one configuration file.
19. The non-transitory computer readable storage medium of claim 17 , wherein the instructions, when executed by the at least one processor further enables the computing system to at least normalize the identified information, replace a first value in the identified information with a second value associated with the at least one replicated asset, or identify mapping information that identifies a subset of the identified information supported by at least one replicated asset.
20. The non-transitory computer readable storage medium of claim 17 , wherein the instructions, when executed by the at least one processor further enables the computing system to:
use an import engine to aggregate data from a plurality of data sources, individual data sources associated with at least one computing asset.