Honeypot asset cloning
Disclosed herein are methods, systems, and processes for performing honeypot asset cloning in cybersecurity computing environments. A computing asset and associated configuration information is identified along with configuration requirements for a honeypot. The configuration is modified to generate replication configuration information based partly on the configuration requirements. The replication configuration information is deployed in the network. A request to manage a configuration deployment in the network is received. In response to the request, the computing asset is configured based on the configuration information and the honeypot is generated based on the replication configuration information. The configuration is normalized and mapping information that is part of the configuration information that is supported by the honeypot is identified. A value in the configuration is replaced with another value associated with the part of the configuration information that is supported by the honeypot.
1. A computer-implemented method, comprising:
identifying a computing asset and configuration information associated with the computing asset in a network;
identifying one or more configuration requirements for a security appliance;
modifying the configuration information associated with the computing asset to generate replication configuration information based partly on the one or more configuration requirements;
deploying the replication configuration information in the network;
receiving a request to manage a configuration deployment in the network;
in response to receiving the request,
configuring the computing asset based on the configuration information, and
generating the security appliance based on the replication configuration information;
normalizing the configuration information associated with the computing asset;
identifying mapping information that is part of the configuration information that is supported by the security appliance; and
replacing a value in the configuration information with another value associated with the part of the configuration information that is supported by the security appliance.
2. The computer-implemented method of claim 1 , further comprising:
generating a configuration file based on the replication configuration information; and
generating the security appliance using the configuration file, wherein
a portion of the security appliance is a copy of the computing asset.
3. The computer-implemented method of claim 1 , wherein
the configuration information for the computing asset comprises at least an operating system version, a service banner, an open port, or a media access control (MAC) address.
4. The computer-implemented method of claim 1 , further comprising:
distributing, via a component manager, the configuration information and the replication configuration information in the network;
receiving the request at a resource manager that is configured to manage computing resource provisioning and computing resource usage for the computing asset and the security appliance;
transmitting the request from the resource manager to the component manager; and
storing the configuration information and the replication configuration information in a data store.
5. The computer-implemented method of claim 1 , further comprising:
configuring the security appliance to emulate one or more services provided by the computing asset;
receiving, at the security appliance, network data indicative of one or more attacks or one or more anomalous activities intended for the one or more services provided by the computing asset; and
generating a remediation action to minimize security risk from the one or more attacks or the one or more anomalous activities.
6. A non-transitory computer readable storage medium comprising program instructions executable to:
identify a computing asset and configuration information associated with the computing asset in a network;
identify one or more configuration requirements for a security appliance;
modify the configuration information associated with the computing asset to generate replication configuration information based partly on the one or more configuration requirements;
deploy the replication configuration information in the network;
receive a request to manage a configuration deployment in the network;
in response to receiving the request,
configure the computing asset based on the configuration information, and
generate the security appliance based on the replication configuration information;
normalize the configuration information associated with the computing asset;
identify mapping information that is part of the configuration information that is supported by the security appliance; and
replace a value in the configuration information with another value associated with the part of the configuration information that is supported by the security appliance.
7. The non-transitory computer readable storage medium of claim 6 , further comprising:
generating a configuration file based on the replication configuration information; and
generating the security appliance using the configuration file, wherein
a portion of the security appliance is a copy of the computing asset.
8. The non-transitory computer readable storage medium of claim 6 , wherein
the configuration information for the computing asset comprises at least an operating system version, a service banner, an open port, or a media access control (MAC) address.
9. The non-transitory computer readable storage medium of claim 6 , further comprising:
distributing, via a component manager, the configuration information and the replication configuration information in the network;
receiving the request at a resource manager that is configured to manage computing resource provisioning and computing resource usage for the computing asset and the security appliance;
transmitting the request from the resource manager to the component manager; and
storing the configuration information and the replication configuration information in a data store.
10. The non-transitory computer readable storage medium of claim 6 , further comprising:
configuring the security appliance to emulate one or more services provided by the computing asset;
receiving, at the security appliance, network data indicative of one or more attacks or one or more anomalous activities intended for the one or more services provided by the computing asset; and
generating a remediation action to minimize security risk from the one or more attacks or the one or more anomalous activities.
11. A system comprising:
one or more processors; and
a memory coupled to the one or more processors, wherein the memory stores program instructions executable by the one or more processors to:
identify a computing asset and configuration information associated with the computing asset in a network;
identify one or more configuration requirements for a security appliance;
modify the configuration information associated with the computing asset to generate replication configuration information based partly on the one or more configuration requirements;
deploy the replication configuration information in the network;
receive a request to manage a configuration deployment in the network;
in response to receiving the request,
configure the computing asset based on the configuration information, and
generate the security appliance based on the replication configuration information;
normalize the configuration information associated with the computing asset;
identify mapping information that is part of the configuration information that is supported by the security appliance; and
replace a value in the configuration information with another value associated with the part of the configuration information that is supported by the security appliance.
12. The system of claim 11 , further comprising:
generating a configuration file based on the replication configuration information; and
generating the security appliance using the configuration file, wherein
a portion of the security appliance is a copy of the computing asset.
13. The system of claim 11 , wherein
the configuration information for the computing asset comprises at least an operating system version, a service banner, an open port, or a media access control (MAC) address.
14. The system of claim 11 , further comprising:
distributing, via a component manager, the configuration information and the replication configuration information in the network;
receiving the request at a resource manager that is configured to manage computing resource provisioning and computing resource usage for the computing asset and the security appliance;
transmitting the request from the resource manager to the component manager; and
storing the configuration information and the replication configuration information in a data store.
15. The system of claim 11 , further comprising:
configuring the security appliance to emulate one or more services provided by the computing asset;
receiving, at the security appliance, network data indicative of one or more attacks or one or more anomalous activities intended for the one or more services provided by the computing asset; and
generating a remediation action to minimize security risk from the one or more attacks or the one or more anomalous activities.