Endpoint agent for enterprise security system
An endpoint security agent facilitates a security policy on an endpoint computing device. The endpoint agent comprises an engine and one or more plugins that each provide a particular security feature. The endpoint agent receives a policy from a cloud server specifying one or more plug-ins used by the policy and configuration of those plug-ins. The endpoint agent retrieves, installs, and configures the one or more plugins. The endpoint agent updates a communication table with command subscription information obtained from each installed plugin indicating command types subscribed to by each plug-in. When a command is received, a lookup of the command type is performed in the table, and the command is sent to the subscribing plugin.
1. A method for installing a plug-in to an endpoint security agent executing on an endpoint in a networked computer environment, the method comprising:
installing a plug-in in an endpoint security agent;
obtaining, from the plug-in, command type identifiers for a set of command types subscribed to by the plug-in;
updating a communication table to store associations between the plug-in and each of the command type identifiers obtained from the plug-in;
receiving a target command from the cloud server;
identifying a target command type identifier from the target command received from the cloud server;
determining, based on the communication table, a subscribing plug-in of the endpoint security agent associated with the target command type identifier in the target command; and
sending the target command to the subscribing plug-in.
2. The method of claim 1 , further comprising:
receiving, from the subscribing plug-in in response to the target command, a response indicative of a result of the subscribing plug-in processing the target command; and
sending the response to the cloud server.
3. The method of claim 1 , further comprising:
identifying a link to an address on the cloud server from where the plug-in can be downloaded; and
downloading the plug-in using the link.
4. The method of claim 1 , further comprising:
obtaining, from the plug-in, a plug-in digital certificate indicative of authenticity of the plug-in;
authenticating the plug-in digital certificate; and
providing an endpoint agent digital certificate to the plug-in to enable the plug-in to verify authenticity of the endpoint security agent.
5. The method of claim 1 , wherein the plug-in is configured to perform a security function including at least one of:
a scanning function to detect malware installed on the endpoint,
a real-time protection function to prevent malware from being installed on the endpoint,
an administrative function to collect state information about the endpoint and provide the state information to the cloud server, and
a remote desktop function to enable remote access to the endpoint from a remote administrative client.
6. The method of claim 1 , further comprising:
receiving a policy specifying an operating configuration of the endpoint security agent;
identifying a currently installed plug-in that is not required by the policy; and
uninstalling the currently installed plug-in in response to receiving the policy.
7. The method of claim 1 , further comprising:
identifying a new version of a currently installed plug-in is available; and
obtaining the new version of the plug-in from a server.
8. A non-transitory computer-readable storage medium storing instructions for installing a plug-in to an endpoint security agent executing on an endpoint in a networked computer environment, the instructions when executed by a processor cause the processor to perform steps comprising:
installing a plug-in in an endpoint security agent;
obtaining, from the plug-in, command type identifiers for a set of command types subscribed to by the plug-in;
updating a communication table to store associations between the plug-in and each of the command type identifiers obtained from the plug-in;
receiving a target command from the cloud server;
identifying a target command type identifier from the target command received from the cloud server;
determining, based on the communication table, a subscribing plug-in of the endpoint security agent associated with the target command type identifier in the target command; and
sending the target command to the subscribing plug-in.
9. The non-transitory computer-readable storage medium of claim 8 , wherein the instructions when executed by the processor further cause the processor to perform steps including:
receiving, from the subscribing plug-in in response to the target command, a response indicative of a result of the subscribing plug-in processing the target command; and
sending the response to the cloud server.
10. The non-transitory computer-readable storage medium of claim 8 , wherein the instructions when executed by the processor further cause the processor to perform steps including:
identifying a link to an address on the cloud server from where the plug-in can be downloaded; and
downloading the plug-in using the link.
11. The non-transitory computer-readable storage medium of claim 8 , wherein the instructions when executed by the processor further cause the processor to perform steps including:
obtaining, from the plug-in, a plug-in digital certificate indicative of authenticity of the plug-in;
authenticating the plug-in digital certificate; and
providing an endpoint agent digital certificate to the plug-in to enable the plug-in to verify authenticity of the endpoint security agent.
12. The non-transitory computer-readable storage medium of claim 8 , wherein the plug-in is configured to perform a security function including at least one of:
a scanning function to detect malware installed on the endpoint,
a real-time protection function to prevent malware from being installed on the endpoint,
an administrative function to collect state information about the endpoint and provide the state information to the cloud server, and
a remote desktop function to enable remote access to the endpoint from a remote administrative client.
13. The non-transitory computer-readable storage medium of claim 8 , wherein the instructions when executed by the processor further cause the processor to perform steps including:
receiving a policy specifying an operating configuration of the endpoint security agent;
identifying a currently installed plug-in that is not required by the policy; and
uninstalling the currently installed plug-in in response to receiving the policy.
14. The non-transitory computer-readable storage medium of claim 8 , wherein the instructions when executed by the processor further cause the processor to perform steps including:
identifying a new version of a currently installed plug-in is available; and
obtaining the new version of the plug-in from a server.
15. A computer system for implementing a security policy on a plurality of endpoints in a networked computer environment, the security system comprising:
one or more computer processors; and
one or more non-transitory computer-readable storage media, the storage media storing computer program instructions executable by the one or more computer processors to perform steps comprising:
installing a plug-in in an endpoint security agent;
obtaining, from the plug-in, command type identifiers for a set of command types subscribed to by the plug-in;
updating a communication table to store associations between the plug-in and each of the command type identifiers obtained from the plug-in;
receiving a target command from the cloud server;
identifying a target command type identifier from the target command received from the cloud server;
determining, based on the communication table, a subscribing plug-in of the endpoint security agent associated with the target command type identifier in the target command; and
sending the target command to the subscribing plug-in.
16. The computer system of claim 15 , wherein the instructions when executed by the processor further cause the processor to perform steps including:
receiving, from the subscribing plug-in in response to the target command, a response indicative of a result of the subscribing plug-in processing the target command; and
sending the response to the cloud server.
17. The computer system of claim 15 , wherein the instructions when executed by the processor further cause the processor to perform steps including:
identifying a link to an address on the cloud server from where the plug-in can be downloaded; and
downloading the plug-in using the link.
18. The computer system of claim 15 , wherein the instructions when executed by the processor further cause the processor to perform steps including:
obtaining, from the plug-in, a plug-in digital certificate indicative of authenticity of the plug-in;
authenticating the plug-in digital certificate; and
providing an endpoint agent digital certificate to the plug-in to enable the plug-in to verify authenticity of the endpoint security agent.
19. The computer system of claim 15 , wherein the plug-in is configured to perform a security function including at least one of:
a scanning function to detect malware installed on the endpoint,
a real-time protection function to prevent malware from being installed on the endpoint,
an administrative function to collect state information about the endpoint and provide the state information to the cloud server, and
a remote desktop function to enable remote access to the endpoint from a remote administrative client.
20. The computer system of claim 15 , wherein the instructions when executed by the processor further cause the processor to perform steps including:
receiving a policy specifying an operating configuration of the endpoint security agent;
identifying a currently installed plug-in that is not required by the policy; and
uninstalling the currently installed plug-in in response to receiving the policy.