Systems and methods for tracking and recording events in a network of computing systems
A security client can be configured to operate on the one or more computing systems and record all events occurring on the one or more computing systems. The security client can operate as a “security camera” for the computing systems by identifying and retaining data and information that describes and details different events that occur on the computing systems. The security client can be configured to generate event records for the events that are uniquely associated with the process that requested or performed event. Likewise, the security client can be configured to uniquely associate the event records with the specific computing system associated with the event.
1. A computer security method comprising:
detecting an event, associated with a process, occurring in a computing system, wherein detecting the event comprises intercepting an operation at a layer of an operating system of the computing system;
generating, by a processor, an event identifier for the event, wherein the event identifier uniquely identifies the event in the computing system;
generating a record for the event, the record comprising the event identifier and details that describe the event;
generating a global identifier for the record based on the event identifier and attributes of the computing system on which the event occurred, wherein the global identifier uniquely identifies the computing system that is associated with the record among a plurality of computing systems including the computing system;
identifying a security breach in the computing system;
based at least on the security breach, retrieving, using the global identifier, the record associated with the computing system from a plurality of records associated with the plurality of computing systems; and
determining that the retrieved record associated with the computing system relates to the security breach associated with the computing system, contents of the retrieved record being indicative of an event relating to the security breach.
2. The method of claim 1 , wherein generating the event identifier comprises:
performing a hash operation on information associated with the event to generate the event identifier.
3. The method of claim 2 , wherein the information comprises at least one of the following: details of the event, the process, and a time the event occurred.
4. The method of claim 1 , the method further comprising:
providing the record and the global identifier to a central repository for storage with the global identifier; and
analyzing the retrieved record associated with the computing system, wherein the retrieved record is retrieved from the central repository storing the plurality of records associated with the plurality of computing systems.
5. The method of claim 1 , wherein generating the global identifier comprises:
performing a hash operation on the attributes associated with the computing system and the event identifier to generate the global identifier.
6. The method of claim 1 , wherein the contents comprise the event identifier.
7. The method of claim 1 , wherein the record includes the global identifier and the event identifier.
8. The method of claim 1 , the method further comprising:
searching event records of at least another one of the plurality of computing systems for at least one event record related to the security breach associated with the computing system.
9. A non-transitory computer readable storage medium comprising instructions that cause a processor to perform a method comprising:
detecting an event, associated with a process, occurring in a computing system, wherein detecting the event comprises intercepting an operation at a layer of an operating system of the computing system;
generating an event identifier for the event, wherein the event identifier uniquely identifies the event in the computing system;
generating a record for the event, the record comprising the event identifier and details that describe the event;
generating a global identifier for the record based on the event identifier and attributes of the computing system on which the event occurred, wherein the global identifier uniquely identifies the computing system that is associated with the record among a plurality of computing systems including the computing system;
identifying a security breach in the computing system;
based at least on the security breach, retrieving, using the global identifier, the record associated with the computing system from a plurality of records associated with the plurality of computing systems; and
determining that the retrieved record associated with the computing system relates to the security breach associated with the computing system, contents of the retrieved record being indicative of an event relating to the security breach.
10. The non-transitory computer readable storage medium of claim 9 , wherein generating the event identifier comprises:
performing a hash operation on information associated with the event to generate the event identifier.
11. The non-transitory computer readable storage medium of claim 10 , wherein the information comprises at least one of the following: details of the event, the process, and a time the event occurred.
12. The non-transitory computer readable storage medium of claim 9 , the method further comprising:
providing the record and the global identifier to a central repository for storage with the global identifier.
13. The non-transitory computer readable storage medium of claim 9 , wherein generating the global identifier comprises:
performing a hash operation on the attributes associated with the computing system and the event identifier to generate the global identifier.
14. The non-transitory computer readable storage medium of claim 9 , wherein the event comprises at least one of the following: initiation of the process, a request to start a new process, a request to create a file, a request to modify a file, a request to delete a file, request to create a registry key, a request to delete a registry key, a request to modify a registry key, a request to establish a network connection, and a request to load a binary.
15. The non-transitory computer readable storage medium of claim 9 , wherein the attributes associated with the computing system include at least one of the following: a type of the computing system, a name of the computing system, a configuration of the computing system, a network address of the computing system, a media access control (MAC) address of the computing system, information about a user of the computing system, and a telephone number associated with the computing system.
16. The non-transitory computer readable storage medium of claim 9 , the method further comprising:
searching event records of at least another one of the plurality of computing systems for at least one event record related to the security breach associated with the computing system.
17. A method for computer security, the method comprising:
receiving an event record for an event associated with a process executing on a computing system, the event being detected by intercepting an operation at a layer of an operating system of the computing system, wherein the event record comprises details of the event and a global identifier that uniquely identifies the computing system that is associated with the event record among a plurality of computing systems including the computing system, wherein the global identifier is based on an event identifier that uniquely identifies the event in the computing system and attributes of the computing system;
storing the event record in a computer readable storage medium having a plurality of event records associated with the plurality of computing systems, each of the plurality of event records indicative of a respective event detected on a respective computing system;
identifying a security breach in the computing system;
based at least on the security breach, retrieving, using the global identifier, the event record associated with the computing system from the plurality of event records associated with the plurality of computing systems; and
determining that the retrieved event record associated with the computing system relates to the security breach associated with the computing system, contents of the retrieved event record being indicative of an event relating to the security breach.
18. The method of claim 17 , wherein the event identifier is generated by performing a hash operation on information associated with the event.
19. The method of claim 17 , wherein the global identifier is generated by performing a hash operation on attributes associated with the computing system and the event identifier.
20. The method of claim 17 , the method further comprising:
searching event records of at least another one of the plurality of computing systems for at least one event record related to the security breach associated with the computing system.