IoT device application workload capture

1. A system, comprising:

a processor configured to:

select a target IoT device, wherein the target IoT device is selected at least in part based on a configuration change associated with the target IoT device, wherein the configuration change comprises a change in use of an application by the target IoT device;

determine and tag a flow associated with the target IoT device;

admit packets from the tagged flow into a ring buffer;

receive an indication that an extraction should be performed on a portion of the packets included in the ring buffer; and

extract the portion of the packets; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system of claim 1 , wherein the target IoT device is selected at least in part based on a detection of an elevation of a risk score.

3. The system of claim 2 , wherein the risk score is elevated based at least in part on a determination of an applicability of a known exploit to the target IoT device.

4. The system of claim 2 , wherein the risk score is elevated based at least in part on an observation of an attempted exploit of the target IoT device.

5. The system of claim 1 , wherein the application is previously not used by the target IoT device and wherein the change includes the target IoT device using the application.

6. The system of claim 1 , wherein the target IoT device is selected at least in part based on a URL with which the target IoT device communicates.

7. The system of claim 1 , wherein the indication is received as part of a time-based trigger.

8. The system of claim 1 , wherein the indication is received in response to a generation of an alert.

9. The system of claim 1 , wherein the extracted portion of the packets is provided to a network traffic analysis system.

10. The system of claim 1 , wherein the processor is further configured to receive an indication to stop admitting packets associated with the target IoT device into the ring buffer.

11. The system of claim 10 , wherein the indication to stop admitting packets is received in response to a predefined number of sessions associated with the target IoT device.

12. A method, comprising:

selecting a target IoT device, wherein the target IoT device is selected at least in part based on a configuration change associated with the target IoT device, wherein the configuration change comprises a change in use of an application by the target IoT device;

determining and tagging a flow associated with the target IoT device;

admitting packets from the tagged flow into a ring buffer;

receiving an indication that an extraction should be performed on a portion of the packets included in the ring buffer; and

extracting the portion of the packets.

13. The method of claim 12 , wherein the target IoT device is selected at least in part based on a detection of an elevation of a risk score.

14. The method of claim 13 , wherein the risk score is elevated based at least in part on a determination of an applicability of a known exploit to the target IoT device.

15. The method of claim 13 , wherein the risk score is elevated based at least in part on an observation of an attempted exploit of the target IoT device.

16. The method of claim 12 , wherein the application is previously not used by the target IoT device and wherein the change includes the target IoT device using the application.

17. The method of claim 12 , wherein the target IoT device is selected at least in part based on a URL with which the target IoT device communicates.

18. The method of claim 12 , wherein the indication is received as part of a time-based trigger.

19. The method of claim 12 , wherein the indication is received in response to a generation of an alert.

20. The method of claim 12 , wherein the extracted portion of the packets is provided to a network traffic analysis system.

21. The method of claim 12 , further comprising receiving an indication to stop admitting packets associated with the target IoT device into the ring buffer.

22. The method of claim 21 , wherein the indication to stop admitting packets is received in response to a predefined number of sessions associated with the target IoT device.

23. A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:

selecting a target IoT device, wherein the target IoT device is selected at least in part based on a configuration change associated with the target IoT device, wherein the configuration change comprises a change in use of an application by the target IoT device;

determining and tagging a flow associated with the target IoT device;

admitting packets from the tagged flow into a ring buffer;

receiving an indication that an extraction should be performed on a portion of the packets included in the ring buffer; and

extracting the portion of the packets.