Endpoint network sensor and related cybersecurity infrastructure
In one or more examples, an advanced form of network endpoint sensor is deployed to an endpoint device to provide local monitoring and reporting of network traffic flowing to and/or from the endpoint device. For example, such network endpoint sensors may reduce reliance on other types of monitoring component (such as mirrors/TAPs) and/or complement functionality of other type(s) of monitoring component (e.g. in a deployment with “roaming” endpoints). In one or more examples, network data may be linked or otherwise associated with endpoint data locally at an endpoint device. In one or more examples, such linking may be performed locally prior to reporting, response and/or remediation.
1. An endpoint agent comprising computer-readable instructions embodied in non-transitory media and configured, when executed on an endpoint device, to:
access local network traffic via a local traffic access function of an operating system (OS) of the endpoint device, the local network traffic formed of: outgoing packets sent from a network interface of the endpoint device to a packet-switched network and carrying outbound payload data generated by one or more processes executed on the endpoint device and managed by the OS, and/or incoming packets received at the network interface from the packet-switched network and carrying inbound payload data for processing by the one or more processes;
obtain, via the OS, a piece of endpoint data associated with one or more network packets of the local network traffic; and
report the local network traffic to a cybersecurity service remote from the endpoint device for use in performing a cybersecurity threat analysis, by transmitting to the cybersecurity service a series of network traffic records containing network data of the local network traffic, wherein at least one network traffic record of the series of network traffic records pertains to the one or more network packets with which the piece of endpoint data is associated, and the endpoint agent is configured to augment or enrich the at least one network traffic record with the piece of endpoint data, or link at least one of the network traffic records with at least one other record containing the piece endpoint data and transmitted from the endpoint device to the cybersecurity service.
2. The endpoint agent of claim 1 , wherein the piece of endpoint data comprises:
details of a process of the one or more processes that received and/or generated the one or more network packets.
3. The endpoint agent of claim 1 , wherein the piece of endpoint data comprises details of a parent process of the one or more processes, the parent process being a parent of another process of the one or more processes that received and/or generated the one or more network packets.
4. The endpoint agent of claim 1 , wherein the piece of endpoint data is associated with the one or more network packets by the OS, and the endpoint agent is configured to locate the piece of endpoint data via the OS.
5. The endpoint agent of claim 1 , configured to associate the one or more network packets with the piece of endpoint data, by monitoring via the OS local activity by the processes at the endpoint device.
6. The endpoint agent of claim 5 , configured to match an incident of local activity by a process of the one or more processes with the one or more network packets, and thereby associate the piece of endpoint data with the one or more network packets.
7. The endpoint agent of claim 6 , configured to match the incident of local activity with the one or more network packets based on:
a local timing of the incident of local activity and a local timing of the at least one packet, and/or
header information of the at least one packet and corresponding information obtained via said monitoring of local activity.
8. The endpoint agent of claim 6 , wherein the incident of local activity is the process establishing a flow, the at least one network traffic record identifying the flow and containing information about the process that established the flow.
9. The endpoint agent of claim 1 , wherein the piece of endpoint data comprises user information of a user account associated with the one or more network packets.
10. The endpoint agent of claim 1 , wherein the piece of endpoint data comprises information about a file associated with the one or more network packets.
11. The endpoint agent of claim 1 , wherein the network data contained in the series of network traffic records comprises payload metadata that does not duplicate all payload data carried in of the one or more network packets but summarizes the payload data carried in the one or more network packets.
12. The endpoint of agent of claim 1 , comprising local threat detection instructions configured to:
process the local network traffic and the endpoint data;
detect a cybersecurity security threat local to the endpoint device.
13. The endpoint agent of claim 1 , comprising local threat remediation instructions configured to implement a remediation action at the endpoint device in response to a remediation command.
14. The endpoint agent of claim 1 , wherein the network data has the form of network metadata summarizing the local network traffic.
15. The endpoint agent of claim 14 , wherein the network data is structured metadata generated based on one or more network data schemas applied to the local network traffic.
16. The endpoint agent of claim 14 , configured to generate network metadata summarizing the one or more network packets based on one or more network protocols associated with the one or more network packets.
17. The endpoint agent of claim 1 , wherein the piece of endpoint data forms part of a structured set of endpoint metadata generated based on one or more endpoint data schemas applied to raw endpoint data obtained via the OS.
18. An endpoint device comprising:
a memory embodying an endpoint agent in the form of computer-readable instructions;
one or more processing units configured to execute the endpoint; and
a network interface configured to send receive network traffic comprising incoming packets carrying inbound payload and outgoing packets carrying outbound payload data;
wherein the one or more processing units are configured to execute: an operating system (OS), and one or more processes managed by the OS and configured to process the inbound payload data and generate the outbound payload data;
wherein the endpoint agent is configured to cause the one or more processing units to:
obtain, via the OS, a piece of endpoint data associated with one or more network packets of the local network traffic; and
report the local network traffic to a cybersecurity service remote from the endpoint device for use in performing a cybersecurity threat analysis, by transmitting to the cybersecurity service a series of network traffic records containing network data of the local network traffic, wherein at least one network traffic record of the series of network traffic records pertains to the one or more network packets with which the piece of endpoint data is associated, and the endpoint agent is configured to augment or enrich the at least one network traffic record with the piece of endpoint data, or link at least one of the network traffic records with at least one other record containing the piece endpoint data and transmitted from the endpoint device to the cybersecurity service.
19. The endpoint device of claim 18 , wherein the piece of endpoint data comprises:
details of a process of the one or more processes that received and/or generated the one or more network packets.
20. The endpoint device of claim 18 , wherein the piece of endpoint data comprises details of a parent process of the one or more processes, the parent process being a parent of another process of the one or more processes that received and/or generated the one or more network packets.
21. The endpoint device of claim 18 , wherein the piece of endpoint data is associated with the one or more network packets by the OS, and the endpoint agent is configured to locate the piece of endpoint data via the OS.
22. The endpoint device of claim 18 , configured to associate the one or more network packets with the piece of endpoint data, by monitoring local activity by the processes at the endpoint device.