Endpoint security architecture with programmable logic engine
The present invention provides an integrated, context-aware, security system that provides an adaptive endpoint security agent architecture model for a continuously monitoring and recording activity across an enterprise, specifically monitoring activity on endpoints, and subsequently detecting and blocking any malicious processes that may otherwise invade the enterprise and cause issues. The endpoint security agent architecture exposes a well-defined, public interface to the event data generated by the endpoint security agent in the form of a custom programming language by which a user can define the logic that the endpoint security agent executes in response to event data to perform detection of and response to suspicious activity.
1. A system for providing an integrated security management framework for an enterprise having a plurality of endpoint devices, each endpoint device comprising a deployed endpoint agent configured to continuously monitor and record activity on the respective endpoint device and further execute one or more sets of detection and response logic rules for managing the detection of, and response to, any activity associated with the respective endpoint device that poses a potential security threat to the enterprise, the system comprising:
a server configured to communicate and exchange data with the one or more of the endpoint devices over a network, the server comprising a hardware processor coupled to non-transitory, computer-readable memory containing instructions executable by the processor to cause the server to:
provide a security management platform comprising an interface with which an authorized user can interact to monitor endpoint agent activity and manage functionality of at least one endpoint agent deployed on one of the one or more endpoint devices;
provide an integrated development environment (IDE) operably coupled to the interface;
receive, from the authorized user via the interface, input comprising custom, declarative programming language input to the IDE to write, develop, and/or modify, on-the-fly, one or more customized sets of detection and response logic rules to be executed by an endpoint agent; and
output, to the endpoint agent, a customized set of detection and response logic rules.
2. The system of claim 1 , wherein the system further comprises the plurality of endpoint devices.
3. The system of claim 2 , wherein each response logic rule has an associated action to be performed by an endpoint device in response to an event matching the response logic rule, and wherein:
each endpoint device has a learning mode in which the endpoint device sends, to the server over the network, a message comprising a copy of an event that matched the response logic rule, metadata describing said response logic rule, and a flag indicating that the endpoint device did not execute the action associated with the response logic rule in response to the event matching the response logic rule.
4. The system of claim 1 , wherein the server is configured to receive, from the endpoint agent, security data based on execution of one or more sets of detection and response logic rules.
5. The system of claim 1 , wherein the one or more customized sets of detection and response logic rules are generated based on a custom, declarative programming language, wherein the custom, declarative programming language is compiled, via a compiler module, into byte code, wherein the compiler module is configured to output a compiled rule set.
6. The system of claim 5 , wherein the customized set of detection and response logic rules outputted from the server comprises a compiled rule set embedded into an installer executable by the endpoint agent to thereby transmit the compiled rule set to the endpoint agent such that the endpoint agent executes the associated customized set of detection and response logic rules.
7. The system of claim 1 , wherein the authorized user is an individual or group tasked with managing the enterprise's security posture and the enterprise comprises at least one of a business entity, company, organization, and government agency.
8. A non-transitory computer-readable medium having computer-executable code thereon to provide an integrated security management framework for an enterprise having a plurality of endpoint devices, the computer-executable code, when executed by the server, causing a server to:
communicate and exchange data with one or more of the endpoint devices over a network, each endpoint device comprising a deployed endpoint agent configured to continuously monitor and record activity on the respective endpoint device and further execute one or more sets of detection and response logic rules for managing the detection of, and response to, activity associated with the respective endpoint device that poses a potential security threat to the enterprise;
provide a security management platform comprising an interface with which an authorized user can interact to monitor endpoint agent activity and manage functionality of at least one endpoint agent deployed on one of the one or more endpoint devices;
provide an integrated development environment (IDE) operably coupled to the interface;
receive, from the authorized user via the interface, input comprising custom, declarative programming language input to the IDE to write, develop, and/or modify, on-the-fly, one or more customized sets of detection and response logic rules to be executed by an endpoint agent; and
output, to the endpoint agent, a customized set of detection and response logic rules.
9. The non-transitory computer-readable medium of claim 8 , wherein the computer-executable code further comprises code that, when executed by the server, configures the server to receive, from an endpoint agent, security data based on execution of one or more sets of detection and response logic rules.
10. The non-transitory computer-readable medium of claim 8 , wherein the computer-executable code further comprises code that, when executed by the server, configures the server to compile a rule set of detection and response logic rules into an installer executable by the endpoint agent to thereby transmit the compiled rule set to the endpoint agent such that the endpoint agent executes the associated customized set of detection and response logic rules.
11. The non-transitory computer-readable medium of claim 8 , wherein the computer-executable code further comprises code that, when executed by the server, configures the server to:
compile, into byte code, one or more customized sets of detection and response logic rules generated based on a custom, declarative programming language; and to
output a compiled rule set to an endpoint agent.
12. The non-transitory computer-readable medium of claim 8 , wherein one or more of the sets of detection and response logic rules comprises at least one rule statement comprising match criteria and an associated action.
13. The non-transitory computer-readable medium of claim 12 , wherein said one or more sets of detection and response logic rules are configured to cause an endpoint agent to:
compare event data with the match criteria; and
determine an associated action to be performed by the endpoint agent based on a positive correlation of the event data with the match criteria.
14. The non-transitory computer-readable medium of claim 12 , wherein the associated action is selected from the group consisting of a suppress action, an alert action, a forward action, a block action, a killprocess action, an isolate action, and a set action.
15. A system for providing an integrated security management framework for an enterprise having a plurality of endpoint devices, each endpoint device comprising a deployed endpoint agent configured to continuously monitor and record activity on the respective endpoint device and further execute one or more sets of detection and response logic rules for managing the detection of, and response to, any activity associated with the respective endpoint device that poses a potential security threat to the enterprise, the system comprising:
means for communicating with the one or more of the endpoint devices over a network;
means for providing a security management platform comprising an interface with which an authorized user can interact to monitor endpoint agent activity and manage functionality of at least one endpoint agent deployed on one of the one or more endpoint devices;
means for providing an integrated development environment (IDE) operably coupled to the interface;
means for receiving, from the authorized user via the interface, input comprising custom, declarative programming language input to the IDE to write, develop, and/or modify, on-the-fly, one or more customized sets of detection and response logic rules to be executed by an endpoint agent; and
means for outputting, to the endpoint agent, a customized set of detection and response logic rules.
16. The system of claim 15 , wherein the system further comprises the plurality of endpoint devices.
17. The system of claim 16 , wherein each response logic rule has an associated action to be performed by an endpoint device in response to an event matching the response logic rule, and wherein:
each endpoint device has a learning mode in which the endpoint device sends, to a server over the network, a message comprising a copy of an event that matched the response logic rule, metadata describing said response logic rule, and a flag indicating that the endpoint device did not execute the action associated with the response logic rule in response to the event matching the response logic rule.
18. The system of claim 15 , further comprising means for receiving, from the endpoint agent, security data based on execution of one or more sets of detection and response logic rules.
19. The system of claim 15 , wherein the one or more customized sets of detection and response logic rules are generated based on a custom, declarative programming language, wherein the custom, declarative programming language is compiled, by a means for compiling, into byte code, wherein the means for compiling is configured to output a compiled rule set.
20. The system of claim 15 , wherein the authorized user is an individual or group tasked with managing the enterprise's security posture and the enterprise comprises at least one of a business entity, company, organization, and government agency.