Analysis of data flows in complex enterprise IT environments
The present technology enables identification, visualization, and analysis of data flows via network components in complex enterprise IT environments including but not limited to servers, workstations, switches, routers, wireless access points, traffic shapers, firewalls, storage systems and SAN systems. The technology is based on a combination of information collection, information filtering, mapping, grouping, marking, report generation, and verification.
1. A computer-implemented method for identifying, visualizing, and analyzing a networked computer environment, the method comprising:
collecting information about the networked computer environment, including network topology of network components and network connections via a network topology graph, network component dependencies, configurations, and attributes, software components, software objects, and data objects;
filtering one or more of the network connections from the information collected based on the software components, software objects, and data objects of certain types that are accessed via the network connections, thus resulting in filtered network connections;
identifying data flows between the software components, software objects, and data objects of the certain types over the filtered network connections;
mapping the data flows over the filtered network connections to the network components via the network topology graph in order to find paths between the software components, software objects, and data objects of the certain types, wherein each of the paths includes a set of the data flows mapped to a respective set of the network components;
marking the set of the data flows included in each of the paths with one or more attributes of the software components, software objects, and data objects of the certain types associated with each of the paths, thus resulting in marked data flows associated with each of the paths;
marking the respective set of the network components included in each of the paths with the one or more attributes of the marked data flows, thus resulting in marked network components associated with each of the paths;
defining and organizing data environments, security environments, and security zones to include the marked network components;
defining firewalls for the data environments, security environments, and security zones; and
displaying the networked computer environment including the data environments, security environments, and security zones, filtered network connections, and the marked data flows and the marked network components associated with each of the paths.
2. The computer-implemented method according to claim 1 , wherein finding paths between the software components, software objects, and data objects via the network topology graph is performed using a depth-first graph search algorithm.
3. The computer-implemented method according to claim 1 , wherein finding paths between the software components, software objects, and data objects further comprises:
analyzing routing and firewall rules of the network components as filtered; and
excluding network connections as filtered from mapping of the data flows according to the routing and firewall rules.
4. A computer-implemented system to identify, visualize, and analyze a networked computer environment, the system comprising:
a processing device; and
a memory storing instructions that, when executed by the processing device, cause the processing device to perform operations comprising:
collecting information about the networked computer environment, including network topology of network components and network connections via a network topology graph, network component dependencies, configurations and attributes, software components, software objects, and data objects;
filtering one or more of the network connections from the information collected based on the software components, software objects, and data objects of certain types that are accessed via the network connections, thus resulting in filtered network connections;
identifying data flows between the software components, software objects, and data objects of the certain types over the filtered network connections;
mapping the data flows over the filtered network connections to the network components via the network topology graph in order to find paths between the software components, software objects, and data objects of the certain types, wherein each of the paths includes a set of the data flows mapped to a respective set of the network components;
marking the set of the data flows included in each of the paths with one or more attributes of the software components, software objects, and data objects of the certain types associated with each of the paths, thus resulting in marked data flows associated with each of the paths;
marking the respective set of the network components included in each of the paths with the one or more attributes of the marked data flows, thus resulting in marked network components associated with each of the paths;
defining and organizing data environments, security environments, and security zones to include the marked network components;
defining firewalls for the data environments, security environments, and security zones; and
displaying the networked computer environment including the data environments, security environments, and security zones, filtered network connections, and the marked data flows and the marked network components associated with each of the paths.
5. The computer-implemented system according to claim 4 , wherein finding paths between the software components, software objects, and data objects via the network topology graph is performed using a depth-first graph search algorithm.
6. The computer-implemented system according to claim 4 , wherein finding paths between the software components, software objects, and data objects further comprises;
analyzing routing and firewall rules of the network as filtered; and
excluding network connections as filtered from mapping of the data flows according to the routing and firewall rules.