Security appliance to monitor networked computing environment
A system and method to evaluate a software defined infrastructure is disclosed. A security appliance is used to evaluate the software defined infrastructure. The security appliance includes a data ingestion and query engine. The data ingestion and query engine is configured to retrieve configuration and operational information associated with the software defined infrastructure, extract selective information from the retrieved configuration and operational information, and store extracted selective information in a plurality of data store. A policy compliance engine is configured to evaluate selectively stored information for compliance to a policy and generate a report based on the evaluation.
1. A method for evaluating a software defined infrastructure, comprising:
retrieving configuration and operational information associated with the software defined infrastructure by a security appliance;
extracting selective information from the retrieved configuration and operational information by the security appliance;
storing extracted selective information in a plurality of data store;
evaluating selectively stored information for compliance to a policy, by the security appliance; and
generating a report based on the evaluation,
wherein, configuration and operational information includes information related to asset configuration, audit event and network communication associated with the software defined infrastructure; and
wherein the generated report includes a message component, a network query component and an event query component, wherein the message component includes a textual description of a violation, wherein the network query component is configured to submit a query to the security appliance to retrieve associated network flow information related to the violation, and wherein the event query component is configured to submit a query to the security appliance to retrieve associated audit events related to the violation.
2. The method of claim 1 , further including presenting network flow information based on the network flow query received by the security appliance.
3. The method of claim 2 , wherein the network flow information is presented as a nodes table and an edges table.
4. The method of claim 2 , wherein the network flow information is presented as a directed graph, with a node representing a host and an edge representing a directed flow of network data.
5. The method of claim 1 , further including generating an inferred relationship rules table indicative of a relationship between a plurality of events, based on evaluation of retrieved audit events indicative of initiation of a plurality of infrastructure related activity; and generating a response to a query related to an asset based on the inferred relationship between the plurality of events.
6. The method of claim 1 , wherein an assigned permission to an asset is evaluated for its frequency of use and based on the evaluation, a dormant assigned permission to the asset is retired.
7. The method of claim 1 , further including:
generating a user baseline table based on evaluation of actions by a user over time;
monitoring user activity for a deviation from the baseline; and
generating a violation report based on the deviation from the baseline.
8. The method of claim 7 , further including:
providing a remediation configuration table, defining a remediation action based on a violation; and
initiating remediation action based on the violation report.
9. A security appliance to evaluate a software defined infrastructure, comprising:
a data ingestion and query engine configured to
retrieve configuration and operational information associated with the software defined infrastructure;
extract selective information from the retrieved configuration and operational information; and
store extracted selective information in a plurality of data store; and
a policy compliance engine configured to
evaluate selectively stored information for compliance to a policy; and
generate a report based on the evaluation,
wherein, configuration and operational information includes information related to asset configuration, audit event and network communication associated with the software defined infrastructure; and
wherein the generated report includes a message component, a network query component and an event query component, wherein the message component includes a textual description of a violation, wherein the network query component is configured to submit a query to the security appliance to retrieve associated network flow information related to the violation, and
wherein the event query component is configured to submit a query to the security appliance to retrieve associated audit events related to the violation.
10. The security appliance of claim 9 , further including a visualization engine configured to present network flow information based on the network flow query received by the security appliance.
11. The security appliance of claim 10 , wherein the network flow information is presented as a nodes table and an edges table.
12. The security appliance of claim 10 , wherein the network flow information is presented on a display device as a directed graph, with a node representing a host and an edge representing a directed flow of network data.
13. The security appliance of claim 9 , further including a machine learning engine configured to generate an inferred relationship rules table indicative of a relationship between a plurality of events, based on evaluation of retrieved audit events indicative of initiation of a plurality of infrastructure related activity; and
the data ingestion and query engine configured to generate a response to a query related to an asset based on the inferred relationship between the plurality of events.
14. The security appliance of claim 9 , wherein an assigned permission to an asset is evaluated by the data ingestion and query engine for its frequency of use and based on the evaluation, a dormant assigned permission to the asset is retired.
15. The security appliance of claim 9 , further including:
a machine learning engine configured to
generate a user baseline table based on evaluation of actions by a user over time;
monitor user activity for a deviation from the baseline; and
generate a violation report based on the deviation from the baseline.
16. The security appliance of claim 15 , further including:
a remediation engine with a remediation configuration table, remediation configuration table defining a remediation action based on a violation; and
the remediation engine configured to receive the violation report and initiate remediation action based on the violation report.