Telemetry collection and policy enforcement using asset tagging
According to one or more embodiments of the disclosure, a networking device receives a policy for an endpoint in a network. The policy specifies one or more component tags and one or more activity tags that were assigned to the endpoint based on deep packet inspection of traffic associated with the endpoint. The networking device identifies a set of tags for a particular traffic flow in the network associated with the endpoint. The set of tags comprises one or more component tags or activity tags associated with the particular traffic flow. The networking device makes a determination that the particular traffic flow violates the policy based on the set of tags comprising a tag that is not in the policy. The networking device initiates, based on the determination that the particular traffic flow violates the policy, a corrective measure with respect to the particular traffic flow.
1. A method comprising:
receiving, at a networking device in a network, a policy for an endpoint device in the network, the policy specifying one or more component tags and one or more activity tags that were assigned to the endpoint device based on deep packet inspection of traffic associated with the endpoint device, wherein the one or more component tags that were assigned to the endpoint device are indicative of at least one of: a device type of the endpoint device or software executed by the endpoint device;
identifying, by the networking device, a set of tags for a particular traffic flow in the network associated with the endpoint device based on receiving, from a telemetry exporter in the network, a traffic flow record for the particular traffic flow, wherein the set of tags are embedded in the traffic flow record, and wherein the set of tags comprises one or more component tags or activity tags associated with the particular traffic flow;
making, by the networking device, a determination that the particular traffic flow violates the policy based on the set of tags for the particular traffic flow comprising a tag that is not in the policy, wherein the determination that the particular traffic flow violates the policy is made by comparing the set of tags for the particular traffic flow with the one or more component tags and the one or more activity tags specified by the policy; and
initiating, by the networking device and based on the determination that the particular traffic flow violates the policy, a corrective measure with respect to the particular traffic flow.
2. The method as in claim 1 , wherein initiating the corrective measure comprises:
blocking, by the networking device, the particular traffic flow from being delivered to the endpoint device.
3. The method as in claim 1 , wherein the networking device comprises a router or network switch.
4. The method as in claim 1 , wherein the policy is indicative of a baseline behavioral profile for the endpoint device, and wherein making the determination that the particular traffic flow violates the policy comprises:
computing, based on the baseline behavioral profile for the endpoint device, a probability that the set of tags is indicative of an anomalous behavior of the endpoint device.
5. The method as in claim 4 , wherein the anomalous behavior of the endpoint device corresponds to the endpoint device attempting to install software to another endpoint device in the network.
6. The method as in claim 4 , wherein the probability is computed using a Naïve Bayes classifier.
7. The method as in claim 1 , wherein the one or more activity tags that were assigned to the endpoint device based on deep packet inspection of traffic associated with the endpoint device are indicative of a behavior of the endpoint device.
8. An apparatus, comprising:
one or more network interfaces to communicate with a network;
a processor coupled to the one or more network interfaces and configured to execute one or more processes; and
a memory configured to store a process that is executable by the processor, the process when executed configured to:
receive a policy for an endpoint device in a network, the policy specifying one or more component tags and one or more activity tags that were assigned to the endpoint device based on deep packet inspection of traffic associated with the endpoint device, wherein the one or more component tags that were assigned to the endpoint device are indicative of at least one of: a device type of the endpoint device or software executed by the endpoint device;
identify a set of tags for a particular traffic flow in the network associated with the endpoint device based on receiving, from a telemetry exporter in the network, a traffic flow record for the particular traffic flow, wherein the set of tags are embedded in the traffic flow record, and wherein the set of tags comprises one or more component tags or activity tags associated with the particular traffic flow;
make a determination that the particular traffic flow violates the policy based on the set of tags for the particular traffic flow comprising a tag that is not in the policy, wherein the determination that the particular traffic flow violates the policy is made by comparing the set of tags for the particular traffic flow with the one or more component tags and the one or more activity tags specified by the policy; and
initiate, based on the determination that the particular traffic flow violates the policy, a corrective measure with respect to the particular traffic flow.
9. The apparatus as in claim 8 , wherein the apparatus initiates the corrective measure by:
blocking the particular traffic flow from being delivered to the endpoint device.
10. The apparatus as in claim 8 , wherein the apparatus comprises a router or network switch.
11. The apparatus as in claim 8 , wherein the policy is indicative of a baseline behavioral profile for the endpoint device, and wherein the apparatus makes the determination that the particular traffic flow violates the policy by:
computing, based on the baseline behavioral profile for the endpoint device, a probability that the set of tags is indicative of an anomalous behavior of the endpoint device.
12. The apparatus as in claim 11 , wherein the anomalous behavior of the endpoint device corresponds to the endpoint device attempting to install software to another endpoint device in the network.
13. The apparatus as in claim 11 , wherein the probability is computed using a Naïve Bayes classifier.
14. The apparatus as in claim 8 , wherein the one or more activity tags that were assigned to the endpoint device based on deep packet inspection of traffic associated with the endpoint device are indicative of a behavior of the endpoint device.
15. A tangible, non-transitory, computer-readable medium storing program instructions that cause a device in a network to execute a process comprising:
receiving a policy for an endpoint device in the network, the policy specifying one or more component tags and one or more activity tags that were assigned to the endpoint device based on deep packet inspection of traffic associated with the endpoint device, wherein the one or more component tags that were assigned to the endpoint device are indicative of at least one of: a device type of the endpoint device or software executed by the endpoint device;
identifying a set of tags for a particular traffic flow in the network associated with the endpoint device based on receiving, from a telemetry exporter in the network, a traffic flow record for the particular traffic flow, wherein the set of tags are embedded in the traffic flow record, and wherein the set of tags comprises one or more component tags or activity tags associated with the particular traffic flow;
making a determination that the particular traffic flow violates the policy based on the set of tags for the particular traffic flow comprising a tag that is not in the policy, wherein the determination that the particular traffic flow violates the policy is made by comparing the set of tags for the particular traffic flow with the one or more component tags and the one or more activity tags specified by the policy; and
initiating, based on the determination that the particular traffic flow violates the policy, a corrective measure with respect to the particular traffic flow.
16. The medium as in claim 15 , wherein initiating the corrective measure comprises:
blocking the particular traffic flow from being delivered to the endpoint device.
17. The medium as in claim 15 , wherein the policy is indicative of a baseline behavioral profile for the endpoint device, and wherein making the determination that the particular traffic flow violates the policy comprises:
computing, based on the baseline behavioral profile for the endpoint device, a probability that the set of tags is indicative of an anomalous behavior of the endpoint device.