Agent-based monitoring of a registry space of a compute asset within a compute environment
An illustrative data platform is disclosed that may monitor a compute asset within a compute environment. This monitoring may include receiving registry data collected, by an agent deployed to the compute asset, from a registry space of the compute asset. Based on the registry data collected by the agent, the data platform may determine that a change within the registry space of the compute asset is associated with a security threat to the compute asset. Accordingly, based on the determining that the change within the registry space is associated with the security threat, the data platform may perform an action configured to facilitate remediation of the security threat. Corresponding methods, systems, and products are also disclosed.
1 . A method comprising:
monitoring, by a data platform, a compute asset within a compute environment, the monitoring including receiving registry data collected, by an agent deployed to the compute asset, from a registry space of the compute asset;
determining, by the data platform based on the registry data collected by the agent, that a change within the registry space of the compute asset is associated with a security threat to the compute asset, including determining that value data associated with an autorun registry key within the registry space has been changed to cause executable program code designated by the value data to automatically be executed upon occurrence of an autorun event associated with the autorun registry key; and
performing, by the data platform based on the determining that the change within the registry space is associated with the security threat, an action configured to facilitate remediation of the security threat.
2 . The method of claim 1 , wherein the agent deployed to the compute asset is configured to continuously monitor the registry space of the compute asset such that the receiving of the registry data collected by the agent and the determining that the change within the registry space is associated with the security threat are performed in substantially real time as the change within the registry space occurs.
3 . The method of claim 1 , wherein the autorun event associated with the autorun
registry key is a startup event that occurs when the compute asset is booted.
4 . The method of claim 1 , wherein the autorun event associated with the autorun registry key is a login event associated with a particular account, the login event occurring when the particular account is logged into on the compute asset.
5 . The method of claim 1 , wherein the autorun event associated with the autorun registry key is a process execution event associated with a particular software process, the process execution event occurring when the particular software process is executed on the compute asset.
6 . The method of claim 1 , wherein the compute asset is implemented as a physical or virtual computing device executing an operating system that implements the registry space within the operating system.
7 . The method of claim 1 , wherein the performing of the action configured to facilitate remediation of the security threat includes directing the agent to quarantine the compute asset such that communication between the compute asset and any entity other than the data platform is disallowed while the quarantining of the compute asset persists.
8 . The method of claim 1 , wherein the performing of the action configured to facilitate remediation of the security threat includes directing the agent to quarantine a particular software process associated with the security threat such that communication between the particular software process and any entity other than the data platform is disallowed while the quarantining of the particular software process persists.
9 . The method of claim 1 , wherein the performing of the action configured to facilitate remediation of the security threat includes generating an alert that is configured, when provided to a user, to inform the user of the security threat to the compute asset and to allow the user to select whether the data platform will direct the agent:
to quarantine the compute asset,
to quarantine a particular software process associated with the security threat, or
to abstain from quarantining the compute asset or any software process executing thereon.
10 . The method of claim 1 , wherein the performing of the action configured to facilitate remediation of the security threat includes generating an alert that is configured, when provided to a user, to inform the user of the security threat to the compute asset and to indicate the change within the registry space of the compute asset.
11 . The method of claim 1 , further comprising constructing, by the data platform, a graph based on data collected within the compute environment and provided to the data platform by the agent;
wherein:
the graph comprises a plurality of nodes connected by a plurality of edges, each node of the plurality of nodes represents a logical entity and each edge of the plurality of edges represents a behavioral relationship between nodes connected by the edge, and the determining that the change within the registry space is associated with the security threat is based on the graph.
12 . A system comprising:
a memory storing instructions; and
one or more processors communicatively coupled to the memory and configured to
execute the instructions to perform a process comprising:
monitoring a compute asset within a compute environment, the monitoring including receiving registry data collected, by an agent deployed to the compute asset, from a registry space of the compute asset;
determining, based on the registry data collected by the agent, that a change within the registry space of the compute asset is associated with a security threat to the compute asset, including determining that value data associated with an autorun registry key within the registry space has been changed to cause executable program code designated by the value data to automatically be executed upon occurrence of an autorun event associated with the autorun registry key; and
performing, based on the determining that the change within the registry space is associated with the security threat, an action configured to facilitate remediation of the security threat.
13 . A computer program product embodied in a non-transitory computer-readable storage medium and comprising computer instructions for performing a process comprising:
monitoring a compute asset within a compute environment, the monitoring including receiving registry data collected, by an agent deployed to the compute asset, from a registry space of the compute asset;
determining, based on the registry data collected by the agent, that a change within the registry space of the compute asset is associated with a security threat to the compute asset, including determining that value data associated with an autorun registry key within the registry space has been changed to cause executable program code designated by the value data to automatically be executed upon occurrence of an autorun event associated with the autorun registry key; and
performing, based on the determining that the change within the registry space is associated with the security threat, an action configured to facilitate remediation of the security threat.
14 . The computer program product of claim 13 , wherein the performing of the action configured to facilitate remediation of the security threat includes directing the agent to quarantine a particular software process associated with the security threat such that communication between the particular software process and any entity other than a data platform performing the process using the computer instructions is disallowed while the quarantining of the particular software process persists.
15 . A method comprising:
monitoring, by a data platform, a compute asset within a compute environment, the monitoring including receiving registry data collected, by an agent deployed to the compute asset, from a registry space of the compute asset;
constructing, by the data platform, a graph based on the collected registry data and provided to the data platform by the agent, wherein the graph comprises a plurality of nodes connected by a plurality of edges, each node of the plurality of nodes represents a logical entity and each edge of the plurality of edges represents a behavioral relationship between nodes connected by the edge;
determining, by the data platform, based on the graph, that a change within the registry space of the compute asset is associated with a security threat to the compute asset; and
performing, by the data platform based on the determining that the change within the registry space is associated with the security threat, an action configured to facilitate remediation of the security threat.
16 . The method of claim 15 , wherein the agent deployed to the compute asset is configured to continuously monitor the registry space of the compute asset such that the receiving of the registry data collected by the agent and the determining that the change within the registry space is associated with the security threat are performed in substantially real time as the change within the registry space occurs.
17 . The method of claim 15 , wherein the determining that the change within the registry space is associated with the security threat includes determining that executable program code has been stored in the registry space that was not previously stored in the registry space.
18 . The method of claim 15 , wherein the compute asset is implemented as a physical or virtual computing device executing an operating system that implements the registry space within the operating system.
19 . The method of claim 15 , wherein the performing of the action configured to facilitate remediation of the security threat includes directing the agent to quarantine the compute asset such that communication between the compute asset and any entity other than the data platform is disallowed while the quarantining of the compute asset persists.
20 . The method of claim 15 , wherein the performing of the action configured to facilitate remediation of the security threat includes directing the agent to quarantine a particular software process associated with the security threat such that communication between the particular software process and any entity other than the data platform is disallowed while the quarantining of the particular software process persists.
21 . The method of claim 15 , wherein the performing of the action configured to facilitate remediation of the security threat includes generating an alert that is configured, when provided to a user, to inform the user of the security threat to the compute asset and to allow the user to select whether the data platform will direct the agent:
to quarantine the compute asset,
to quarantine a particular software process associated with the security threat, or
to abstain from quarantining the compute asset or any software process executing thereon.
22 . The method of claim 15 , wherein the performing of the action configured to facilitate remediation of the security threat includes generating an alert that is configured, when provided to a user, to inform the user of the security threat to the compute asset and to indicate the change within the registry space of the compute asset.
23 . A system comprising:
a memory storing instructions; and
one or more processors communicatively coupled to the memory and configured to
execute the instructions to perform a process comprising:
monitoring a compute asset within a compute environment, the monitoring including receiving registry data collected, by an agent deployed to the compute asset, from a registry space of the compute asset;
constructing a graph based on the collected registry data, wherein the graph comprises a plurality of nodes connected by a plurality of edges, each node of the plurality of nodes represents a logical entity and each edge of the plurality of edges represents a behavioral relationship between nodes connected by the edge;
determining, based on the graph, that a change within the registry space of the compute asset is associated with a security threat to the compute asset; and
performing, based on the determining that the change within the registry space is associated with the security threat, an action configured to facilitate remediation of the security threat.
24 . The system of claim 23 , wherein the determining that the change within the registry space is associated with the security threat includes determining that executable program code has been stored in the registry space that was not previously stored in the registry space.
25 . The system of claim 23 , wherein the determining that the change within the registry space is associated with the security threat includes determining that value data associated with an autorun registry key within the registry space has been changed to cause executable program code designated by the value data to automatically be executed upon occurrence of an autorun event associated with the autorun registry key.
26 . A computer program product embodied in a non-transitory computer-readable storage medium and comprising computer instructions for performing a process comprising:
monitoring a compute asset within a compute environment, the monitoring including receiving registry data collected, by an agent deployed to the compute asset, from a registry space of the compute asset;
constructing a graph based on the collected registry data, wherein the graph comprises a plurality of nodes connected by a plurality of edges, each node of the plurality of nodes represents a logical entity and each edge of the plurality of edges represents a behavioral relationship between nodes connected by the edge;
determining, based on the graph, that a change within the registry space of the compute asset is associated with a security threat to the compute asset; and
performing, based on the determining that the change within the registry space is associated with the security threat, an action configured to facilitate remediation of the security threat.
27 . The computer program product of claim 26 , wherein the determining that the change within the registry space is associated with the security threat includes determining that executable program code has been stored in the registry space that was not previously stored in the registry space.
28 . The computer program product of claim 26 , wherein the determining that the change within the registry space is associated with the security threat includes determining that value data associated with an autorun registry key within the registry space has been changed to cause executable program code designated by the value data to automatically be executed upon occurrence of an autorun event associated with the autorun registry key.
29 . The computer program product of claim 26 , wherein the performing of the action configured to facilitate remediation of the security threat includes directing the agent to quarantine a particular software process associated with the security threat such that communication between the particular software process and any entity other than a data platform performing the process using the computer instructions is disallowed while the quarantining of the particular software process persists.