System and method for cloud-based control-plane event monitor
A method for cloud-based, control-plane-event monitoring includes receiving control-plane events from a cloud-based element associated with a first and a second cloud environment. The received control-plane events are ingested from the cloud-based elements associated with the first and second cloud environments to generate a multiple-source data set from the control-plane events from the cloud-based elements associated with the first and second cloud environments. The multiple-source data set is then evaluated based on attributes of the first and second cloud environments in order to generate a common event data set. The common event data set is then processed using a rule set to generate an outcome.
1. A method for cloud-based, control-plane-event monitoring, the method comprising:
a) receiving control-plane events from a cloud-based element associated with a first cloud environment, wherein at least one of the received control-plane events comprises a first event type with a first format;
b) receiving control-plane events from a cloud-based element associated with a second cloud environment, wherein at least one of the received control-plane event comprises a second event type with a second format and wherein the first event type and the second event type are a same event type and the first format and the second format are different formats;
c) generating a multiple-source data set from the control-plane events from the cloud-based elements associated with the first and second cloud environments;
d) evaluating the multiple-source data set based on attributes of the first and second cloud environments and transforming the at least one of the received control-plane events comprising the first event type with the first format and the at least one of the received control-plane events comprising the second event type with the second format into at least one common event with a common format, thereby generating a common event data set; and
e) processing the common event data set using a rule set to generate an outcome.
2. The method for cloud-based control-plane-event monitoring of claim 1 wherein the outcome comprises an alert.
3. The method for cloud-based control-plane-event monitoring of claim 1 wherein the outcome comprises a policy violation.
4. The method for cloud-based control-plane-event monitoring of claim 1 further comprising processing the common event data set to remove noisy normalized data.
5. The method for cloud-based, control-plane-event monitoring of claim 1 wherein the evaluating the multiple-source data set based on attributes of the first and second cloud environments comprises comparing distinct properties of at least two events in the multiple-source data set.
6. The method for cloud-based, control-plane-event monitoring of claim 1 wherein the evaluating the multiple-source data set based on attributes of the first and second cloud environments comprises categorizing a property of a first event in the multiple-source data set into a common event property.
7. The method for cloud-based, control-plane-event monitoring of claim 6 wherein the evaluating the multiple-source data set based on attributes of the first and second cloud environments comprises categorizing a property of a second event in the multiple-source data set into the common event property.
8. The method for cloud-based, control-plane-event monitoring of claim 1 wherein the processing the common event data set using the rule set to generate the outcome comprises processing the common event data set using a threat rule set to generate a threat assessment.
9. The method for cloud-based, control-plane-event monitoring of claim 1 wherein the processing the common event data set using the rule set to generate the outcome comprises processing the common event data set using a vulnerability rule set to generate a vulnerability assessment.
10. The method for cloud-based, control-plane-event monitoring of claim 1 wherein the processing the common event data set using the rule set to generate the outcome comprises processing the common event data set using a compliance rule set to generate a compliance assessment.
11. The method for cloud-based, control-plane-event monitoring of claim 1 wherein at least one of the cloud-based elements comprises a cloud-based computer.
12. The method for cloud-based, control-plane-event monitoring of claim 1 wherein at least one of the cloud-based elements comprises a cloud-based virtual machine.
13. The method for cloud-based, control-plane-event monitoring of claim 1 wherein the receiving control-plane events from the cloud-based element associated with the first cloud environment comprises receiving real-time continuous event information from an operating system kernel in the cloud-based element associated with the first cloud environment.
14. The method for cloud-based, control-plane-event monitoring of claim 1 wherein the receiving control-plane events from the cloud-based element associated with the first cloud environment comprises receiving real-time continuous event information from a containerization platform running on an operating system kernel in the cloud-based element associated with the first cloud environment.
15. The method for cloud-based, control-plane-event monitoring of claim 1 wherein the receiving control-plane events from the cloud-based element associated with the first cloud environment comprises receiving real-time continuous event information from an agent that is running on a same operating system as the cloud-based element associated with the first cloud environment.
16. A system for cloud-based, control-plane-event monitoring, the system comprising:
a) a collection processor having inputs that receive control-plane events comprising a first event type with a first format from a cloud-based element associated with a first cloud environment and that receive control-plane events comprising a second event type with a second format from a cloud-based element associated with a second cloud environment, wherein the first event type and the second event type are a same event type and the first format and the second format are different formats;
b) an ingestion processor that ingests the received control-plane events from the cloud-based elements associated with the first and second cloud environments, thereby generating a multiple-source data set from the control-plane events from the cloud-based elements associated with the first and second cloud environments;
c) an evaluation processor that evaluates the multiple-source data set based on attributes of the first and second cloud environments and that transforms the at least one of the received control-plane events comprising the first event type with the first format and the at least one of the received control-plane events comprising the second event type with the second format into at least one common event with a common format, thereby generating a common event data set; and
d) a processor that processes the common event data set using a rule set to generate an outcome.
17. The system for cloud-based, control-plane-event monitoring of claim 16 further comprising the cloud-based elements associated with the first and second cloud environments.
18. The system for cloud-based, control-plane-event monitoring of claim 17 wherein at least one of the cloud-based elements associated with at least one of the first and the second cloud environment comprises a computer.
19. The system for cloud-based, control-plane-event monitoring of claim 17 wherein the computer comprises a virtual machine.
20. The system for cloud-based, control-plane-event monitoring of claim 17 wherein at least one of the cloud-based elements associated with at least one of the first and the second cloud environment comprises a central processing unit.
21. The system for cloud-based, control-plane-event monitoring of claim 17 wherein at least one of the cloud-based elements associated with at least one of the first and the second cloud environment comprises an array of compute services.
22. The system for cloud-based, control-plane-event monitoring of claim 17 wherein at least one of the cloud-based elements associated with at least one of the first and the second cloud environment comprises an array of storage services.
23. The system for cloud-based, control-plane-event monitoring of claim 17 wherein at least one of the cloud-based elements associated with at least one of the first and the second cloud environment comprises an array of networking services.
24. The system for cloud-based, control-plane-event monitoring of claim 17 wherein at least one of the cloud-based elements associated with at least one of the first and the second cloud environment comprises an array of cloud migration services.
25. The system for cloud-based, control-plane-event monitoring of claim 17 wherein at least one of the cloud-based elements associated with at least one of the first and the second cloud environment comprises load balancing tools.
26. The system for cloud-based, control-plane-event monitoring of claim 17 wherein at least one of the cloud-based elements associated with at least one of the first and the second cloud environment comprises software development tools.
27. The system for cloud-based, control-plane-event monitoring of claim 16 wherein the processor that processes the common event data set using the rule set generates an alert.
28. The system for cloud-based, control-plane-event monitoring of claim 16 wherein the processor that processes the common event data set using the rule set generates a policy violation.
29. The system for cloud-based, control-plane-event monitoring of claim 16 wherein the processor that processes the common event data set using the rule set removes noisy normalized data.
30. The system for cloud-based, control-plane-event monitoring of claim 16 wherein the processor that processes the common event data set comprises a pipeline processor.
31. The system for cloud-based, control-plane-event monitoring of claim 16 wherein the collection processor and the ingestion processor are a same processor.
32. The system for cloud-based, control-plane-event monitoring of claim 16 wherein the collection processor and the evaluation processor are a same processor.
33. The system for cloud-based, control-plane-event monitoring of claim 16 wherein the ingestion processor and the evaluation processor are a same processor.