Software type and version identification for security operations
Disclosed herein are methods, systems, and processes to perform passive and realtime software identification and data collection for vulnerability management. Vulnerability management based on agent-collected event data involves monitoring a process start event associated with an application executing on a computing device that is part of a network, identifying a binary location of the process start event, and based on the binary location, identifying a software type of the application and a version of the software type. Vulnerability management based on event data in logs involves monitoring the process start event for configuration or file changes, generating fingerprint rules by mapping the configuration or files changes and the process start event associated with a software installation or an upgrade of the software, and processing log data to fingerprint the software type and the version of the software type. Agent-collected event data and event data in logs can be amalgamated to perform software and version identification for vulnerability management.
1. A computer-implemented method, comprising:
monitoring a process start event associated with an application for a configuration change or a file change;
generating a fingerprint rule by mapping the configuration change or the file change with a software installation or a software upgrade;
processing log data with the fingerprint rule to fingerprint a software type and a version of the software type;
identifying a vulnerability associated with the software type and the version of the software type;
identifying a binary location of the process start event;
determining the software type and the version of the software type based on the binary location of the process start event;
accessing a record of previously processed binaries;
determining if a binary in the binary location is part of the record; and
inhibiting processing of the binary in the binary location if the binary in the binary location is part of the record.
2. The computer-implemented method of claim 1 , further comprising:
quarantining the application.
3. The computer-implemented method of claim 1 , further comprising:
identifying the software type and the version of the software type based on a frequency of the process start event.
4. A system comprising:
one or more processors; and
a memory coupled to the one or more processors, wherein the memory stores program instructions executable by the one or more processors to:
identify a binary location of a process start event associated with an application;
determine that a binary in the binary location is not part of a record of previously processed binaries;
determine a software type and a version of a software type based on the binary location and a frequency of the process start event;
monitor the process start event for a configuration change or a file change;
generate a fingerprint rule by mapping the configuration change or the file change with a software installation or a software upgrade;
process log data with the fingerprint rule to fingerprint the software type and the version of the software type;
identify a vulnerability associated with the software type and the version of the software type; and
quarantine the application or one of more files associated with the application.