Real-time configuration discovery and management
Embodiments are directed to monitoring network traffic in a network. A network monitoring engine may monitor networks to collect characteristics associated with network flows. The network monitoring engine may be arranged to identify entities on the network based on characteristics associated with the network flows. The network monitoring engine may provide entity profiles based on the identified entities and the characteristics. A configuration management engine may compare the entity profiles with configuration item (CI) entries in a database. The configuration management engine may provide discrepancy notices based on differences discovered during the comparison. Accordingly, the network monitoring engine may execute one or more policies to perform one or more additional actions based on the one or more discrepancies notices. Also, the configuration management engine may perform audits of an organization's information technology infrastructure to identify one or more violations of compliance policies.
1. A method for monitoring network traffic in a network, wherein one or more processors in a network computer execute instructions to perform actions, comprising:
passively monitoring the network to provide a plurality of characteristics associated with one or more network flows, wherein the passive monitoring avoids decryption of encrypted packets in the one or more network flows;
employing one or more of the plurality of characteristics to determine one or more unknown entities on the network, wherein one or more profiles are determined for the one or more determined entities based on the one or more characteristics;
comparing the one or more profiles to configuration information associated with one or more previously determined other entities, wherein the comparison is employed to determine one or more differences between the one or more profiles and the configuration information; and
providing notification of the one or more determined entities and the differences between the one or more profiles for the one or more determined entities and the configuration information for the previously determined other entities.
2. The method of claim 1 , wherein the comparing further comprises:
determining the one or more differences based on employing the one or more profiles to identify one or more errors or omissions in a database for the configuration information.
3. The method of claim 1 , further comprising:
remediating the one or more determined differences by correcting one or more errors or omissions identified in a database for the configuration information based on the one or more profiles.
4. The method of claim 1 , further comprising:
in response to the one or more determined differences, performing one or more audits including a software license audit, a device license audit, an inventory audit, a security audit, or an entity relationship audit; and
employing the one or more audits to identify each determined difference that violates one or more policies.
5. The method of claim 1 , further comprising:
providing one or more device profiles that correspond to one or more network devices that are determined based on the passive monitoring of the network;
providing one or more application profiles that correspond to one or more applications that are determined based on the passive monitoring of the network; and
providing the one or more profiles based on an association of the one or more device profiles with the one or more application profiles.
6. The method of claim 1 , wherein the comparing further comprises:
employing one or more items in a database to determine configuration information that is unassociated with the one or more profiles.
7. The method of claim 1 , wherein determining the one or more entities, further comprises:
employing one or more metrics for the one or more network flows to determine the one or more entities, wherein the one or more metrics include number of connections, traffic rate, traffic direction information, duration of connections, security credentials, secure cipher suites used, types of protocols, or errors.
8. A network monitoring computer (NMC) on a network, comprising:
a memory that stores at least instructions; and
one or more processors that execute instructions that perform actions, including:
passively monitoring the network to provide a plurality of characteristics associated with one or more network flows, wherein the passive monitoring avoids decryption of encrypted packets in the one or more network flows;
employing one or more of the plurality of characteristics to determine one or more unknown entities on the network, wherein one or more profiles are determined for the one or more determined entities based on the one or more characteristics;
comparing the one or more profiles to configuration information associated with one or more previously determined other entities, wherein the comparison is employed to determine one or more differences between the one or more profiles and the configuration information; and
providing notification of the one or more determined entities and the differences between the one or more profiles for the one or more determined entities and the configuration information for the previously determined other entities.
9. The NMC of claim 8 , wherein the comparing further comprises:
determining the one or more differences based on employing the one or more profiles to identify one or more errors or omissions in a database for the configuration information.
10. The NMC of claim 8 , further comprising:
remediating the one or more determined differences by correcting one or more errors or omissions identified in a database for the configuration information based on the one or more profiles.
11. The NMC of claim 8 , further comprising:
in response to the one or more determined differences, performing one or more audits including a software license audit, a device license audit, an inventory audit, a security audit, or an entity relationship audit; and
employing the one or more audits to identify each determined difference that violates one or more policies.
12. The NMC of claim 8 , further comprising:
providing one or more device profiles that correspond to one or more network devices that are determined based on the passive monitoring of the network;
providing one or more application profiles that correspond to one or more applications that are determined based on the passive monitoring of the network; and
providing the one or more profiles based on an association of the one or more device profiles with the one or more application profiles.
13. The NMC of claim 8 , wherein the comparing further comprises:
employing one or more items in a database to determine configuration information that is unassociated with the one or more profiles.
14. The NMC of claim 8 , wherein determining the one or more entities, further comprises:
employing one or more metrics for the one or more network flows to determine the one or more entities, wherein the one or more metrics include number of connections, traffic rate, traffic direction information, duration of connections, security credentials, secure cipher suites used, types of protocols, or errors.
15. A processor readable non-transitory storage media that includes instructions for monitoring network traffic over a network between one or more computers, wherein execution of the instructions by one or more processors on one or more network monitoring computers (NMCs) performs actions, comprising:
passively monitoring the network to provide a plurality of characteristics associated with one or more network flows, wherein the passive monitoring avoids decryption of encrypted packets in the one or more network flows;
employing one or more of the plurality of characteristics to determine one or more unknown entities on the network, wherein one or more profiles are determined for the one or more determined entities based on the one or more characteristics;
comparing the one or more profiles to configuration information associated with one or more previously determined other entities, wherein the comparison is employed to determine one or more differences between the one or more profiles and the configuration information; and
providing notification of the one or more determined entities and the differences between the one or more profiles for the one or more determined entities and the configuration information for the previously determined other entities.
16. The media of claim 15 , wherein the comparing further comprises:
determining the one or more differences based on employing the one or more profiles to identify one or more errors or omissions in a database for the configuration information.
17. The media of claim 15 , further comprising:
remediating the one or more determined differences by correcting one or more errors or omissions identified in a database for the configuration information based on the one or more profiles.
18. The media of claim 15 , further comprising:
in response to the one or more determined differences, performing one or more audits including a software license audit, a device license audit, an inventory audit, a security audit, or an entity relationship audit; and
employing the one or more audits to identify each determined difference that violates one or more policies.
19. The media of claim 15 , further comprising:
providing one or more device profiles that correspond to one or more network devices that are determined based on the passive monitoring of the network;
providing one or more application profiles that correspond to one or more applications that are determined based on the passive monitoring of the network; and
providing the one or more profiles based on an association of the one or more device profiles with the one or more application profiles.
20. The media of claim 15 , wherein determining the one or more entities, further comprises:
employing one or more metrics for the one or more network flows to determine the one or more entities, wherein the one or more metrics include number of connections, traffic rate, traffic direction information, duration of connections, security credentials, secure cipher suites used, types of protocols, or errors.