System and method for operating a protected endpoint device
A method, system and computer-usable medium are disclosed for operating a protected endpoint. In various embodiments, operation of the protected endpoint device comprises: receiving, at an endpoint collector operating on the protected endpoint device, information corresponding to activities occurring on an endpoint platform; placing, by the endpoint collector, a plurality of events corresponding to the activities on a message bus; receiving, at an endpoint agent, one or more of the plurality of events from the message bus; selectively processing, by the endpoint agent, one or more of the plurality of events received on the message bus, wherein the plurality of events selectively processed by the endpoint agent are events to which the endpoint agent has subscribed; and providing a service connection between the endpoint agent and a software service, wherein communications between the endpoint agent and software service include information corresponding to one or more of the subscribed events.
1. A computer-implementable method for operating a protected endpoint device, comprising:
receiving, at an endpoint collector operating on the protected endpoint device, information corresponding to activities occurring on an endpoint platform of the endpoint device, wherein the endpoint platform comprises one or more of the kernel and user space of the endpoint device;
placing, by the endpoint collector, a plurality of events corresponding to the activities on a message bus;
receiving, at an endpoint agent comprising an ingress filter and an egress filter, one or more of the plurality of events from the message bus at an input of the ingress filter;
selectively processing, by the endpoint agent, one or more of the plurality of events received on the message bus, wherein
the plurality of events selectively processed by the endpoint agent are events to which the endpoint agent has subscribed,
the events to which the endpoint agent has subscribed are selectively passed by the ingress filter to an output of the ingress filter to the exclusion of non-subscribed events,
the endpoint agent comprises an event analysis module and an egress filter both configured to receive events from the output of the ingress filter,
said selectively processing comprises
generating, by the event analysis module, endpoint agent communications based on an analysis of the events received from the output of the ingress filter, and
selectively passing events received from the output of the ingress filter through the egress filter to a service connection, and
the endpoint agent communications are broadcast on the message bus; and providing the service connection between the endpoint agent and a software service, wherein communications between the endpoint agent and software service include information corresponding to one or more of the subscribed events.
2. The method of claim 1 , further comprising an endpoint core, wherein:
the endpoint core is operable to configure the endpoint collector and endpoint agent over the message bus.
3. The method of claim 1 , wherein the endpoint collector includes a plurality of sensors configured to detect events occurring at an endpoint platform and to provide sensor outputs corresponding to the detected events, the method further comprising:
selectively enabling one or more of the plurality of sensors based on configuration parameters provided to the collector.
4. The method of claim 3 , the method further comprising:
selectively providing a subset of the sensor outputs to the message bus based on configuration parameters provided to the collector.
5. The method of claim 1 , the method further comprising:
communicatively coupling a plurality of endpoint agents with the endpoint collector over the message bus; and
allowing multiple endpoint agents to subscribe to events provided by the endpoint collector.
6. The method of claim 1 , further comprising:
enforcing a security policy by the endpoint collector with respect to activities occurring on the endpoint platform.
7. A system comprising:
a processor;
a data bus coupled to the processor; and
a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
receiving, at an endpoint collector operating on the protected endpoint, information corresponding to activities occurring on an endpoint platform of the endpoint device wherein the endpoint platform comprises one or more of the kernel and user space of the endpoint device;
placing, by the endpoint collector, a plurality of events corresponding to the activities on a message bus;
receiving, at an endpoint agent comprising an ingress filter and an egress filter, one or more of the plurality of events from the message bus at an input of the ingress filter;
selectively processing, by the endpoint agent, one or more of the plurality of events received on the message bus, wherein
the plurality of events selectively processed by the endpoint agent are events to which the endpoint agent has subscribed,
the events to which the endpoint agent has subscribed are selectively passed by the ingress filter to an output of the ingress filter to the exclusion of non-subscribed events,
the endpoint agent comprises an event analysis module and an egress filter both configured to receive events from the output of the ingress filter,
said selectively processing comprises
generating, by the event analysis module, endpoint agent communications based on an analysis of the events received from the output of the ingress filter, and
selectively passing events received from the output of the ingress filter through the egress filter to a service connection, and
the endpoint agent communications are broadcast on the message bus; and
providing the service connection between the endpoint agent and a software service, wherein communications between the endpoint agent and software service include information corresponding to one or more of the subscribed events.
8. The system of claim 7 , wherein:
the endpoint core is operable to configure the endpoint collector and endpoint agent over the message bus.
9. The system of claim 7 , wherein the collector includes a plurality of sensors configured to detect events occurring at an endpoint platform and to provide sensor outputs corresponding to the detected events, the instructions are further configured for:
selectively enabling one or more of the plurality of sensors based on configuration parameters provided to the collector.
10. The system of claim 9 , wherein the instructions are further configured for:
selectively providing a subset of the sensor outputs to the message bus based on configuration parameters provided to the collector.
11. The system of claim 7 , wherein the instructions are further configured for:
communicatively coupling a plurality of endpoint agents with the endpoint collector over the message bus; and
allowing multiple endpoint agents to subscribe to events provided by the endpoint collector.
12. The system of claim 7 , wherein the instructions are further configured for:
enforcing a security policy by the endpoint collector with respect to activities occurring on the endpoint platform.
13. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:
receiving, at an endpoint collector operating on the protected endpoint, information corresponding to activities occurring on an endpoint platform of the endpoint device wherein the endpoint platform comprises one or more of the kernel and user space of the endpoint device;
placing, by the endpoint collector, a plurality of events corresponding to the activities on a message bus;
receiving, at an endpoint agent comprising an ingress filter and an egress filter, one or more of the plurality of events from the message bus at an input of the ingress filter;
selectively processing, by the endpoint agent, one or more of the plurality of events received on the message bus, wherein
the plurality of events selectively processed by the endpoint agent are events to which the endpoint agent has subscribed,
the events to which the endpoint agent has subscribed are selectively passed by the ingress filter to an output of the ingress filter to the exclusion of non-subscribed events,
the endpoint agent comprises an event analysis module and an egress filter both configured to receive events from the output of the ingress filter,
said selectively processing comprises
generating, by the event analysis module, endpoint agent communications based on an analysis of the events received from the output of the ingress filter, and
selectively passing events received from the output of the ingress filter through the egress filter to a service connection, and
the endpoint agent communications are broadcast on the message bus; and
providing the service connection between the endpoint agent and a software service, wherein communications between the endpoint agent and software service include information corresponding to one or more of the subscribed events.
14. The non-transitory, computer-readable storage medium claim 13 , wherein the computer executable instructions are further configured for:
communicatively coupling a plurality of endpoint agents with the endpoint collector over the message bus; and
allowing multiple endpoint agents to subscribe to events provided by the endpoint collector.
15. The non-transitory, computer-readable storage medium of claim 13 , wherein the computer executable instructions are further configured for:
enforcing a security policy by the endpoint collector with respect to activities occurring on the endpoint platform.