Monitoring device, monitoring method, and monitoring program
A monitoring device includes processing circuitry configured to a configuration management tool and is used when a configuration of a device to be monitored is updated, analyze the operation instruction information, and extract a part where the configuration of the device to be monitored changes and content of the change; and create a determination criterion that defines a determination method for detecting modification of data of the device to be monitored on the basis of the part where the configuration of the device to be monitored changes and the content of the change.
1 . A monitoring device comprising:
processing circuitry configured to:
acquire operation instruction information that is input to a configuration management tool and is used when a configuration of a device to be monitored is updated, analyze the operation instruction information, and extract a part where the configuration of the device to be monitored changes and content of the change;
acquire vulnerability information corresponding to the operation instruction information and the part where the configuration of the device to be monitored changes; and
create a determination criterion that defines a determination method for detecting modification of data of the device to be monitored on the basis of the part where the configuration of the device to be monitored changes, the content of the change, and the vulnerability information,
wherein the determination criterion includes integrity information to check the configuration of the device and an indication of a frequency with which the configuration of the device is to be checked.
2 . The monitoring device according to claim 1 , wherein the processing circuitry is further configured to in a case where it is identified that the configuration of the device to be monitored regularly changes by analyzing the operation instruction information, create the determination criterion that reflects a changed configuration again.
3 . The monitoring device according to claim 1 , wherein the processing circuitry is further configured to compare pieces of configuration information of a plurality of devices to be monitored with each other identify a part common to a plurality of pieces of configuration information, and create a determination criterion that defines a determination method for detecting modification of the part common to the plurality of pieces of configuration information.
4 . The monitoring device according to claim 1 wherein the processing circuitry is further configured to detect modification of data of the device to be monitored on the basis of the determination criterion.
5 . The monitoring device according to claim 1 , wherein the determination criterion includes, based on the vulnerability information, a priority setting indicating whether checking integrity of the configuration of the device or the frequency of checking the configuration of the device is prioritized.
6 . The monitoring device according to claim 1 , wherein the integrity information includes a hash value.
7 . A monitoring method comprising:
acquiring operation instruction information that is input to a configuration management tool and is used when a configuration of a device to be monitored is updated, analyzing the operation instruction information, and extracting a part where the configuration of the device to be monitored changes and content of the change;
acquiring vulnerability information corresponding to the operation instruction information and the part where the configuration of the device to be monitored changes; and
creating a determination criterion that defines a determination method for detecting modification of data of the device to be monitored on the basis of the part where the configuration of the device to be monitored changes, the content of the change, and the vulnerability information,
wherein the determination criterion includes integrity information to check the configuration of the device and an indication of a frequency with which the configuration of the device is to be checked.
8 . A non-transitory computer-readable recording medium storing therein a monitoring program that causes a computer to execute a process comprising:
acquiring operation instruction information that is input to a configuration management tool and is used when a configuration of a device to be monitored is updated, analyzing the operation instruction information, and extracting a part where the configuration of the device to be monitored changes and content of the change;
acquiring vulnerability information corresponding to the operation instruction information and the part where the configuration of the device to be monitored changes; and
creating a determination criterion that defines a determination method for detecting modification of data of the device to be monitored on the basis of the part where the configuration of the device to be monitored changes, the content of the change, and the vulnerability information,
wherein the determination criterion includes integrity information to check the configuration of the device and an indication of a frequency with which the configuration of the device is to be checked.