IP Library Granted Patent US 11,860,752
Granted Patent B2
US 11,860,752 · App. 17/644,476 · Granted Jan 2, 2024

Agentless system and method for discovering and inspecting applications and services in compute environments

Inventors: Eyal Mamo (Tel Aviv, IL); Amir Sidis (Tel Aviv, IL); Omri Ivanir (Tel Aviv, IL)
Assignee: BIONIC STORK LTD.
G06F11/3006H04L63/123H04L67/141
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 11,860,752
App. No.
17/644,476
Granted
Jan 2, 2024
Kind
B2
Abstract

A system and method for agentless discovery and inspection of applications and services in a compute environment includes establishing a connection with a first workload in a first compute environment. The first compute environment includes a plurality of workloads. The system causes installation of a collector on the first workload, wherein the collector, when executed, is configured to collect data from the first workload. Collected data is received from the collector, and the collector is configured to remove the executable code of the collector upon completing data collection. Access is provided to the collected data for an asset monitoring system, wherein the asset monitoring system is configured to discover from the collected data at least an application executed on the first workload.

Claims (71)

1. A method for agentless discovery in compute environments, comprising:

establishing a connection with a first workload in a first compute environment, the first compute environment including a plurality of workloads;

causing installation of a non-persistent collector executable code on the first workload, wherein the non-persistent collector executable code, when executed, is configured to collect data from the first workload;

receiving collected data from the non-persistent collector installed on the first workload;

determining that data collection is completed;

upon determining that the data collection is completed, configuring the non-persistent collector to remove the executable code from the first workload, the first workload being an agentless workload without the executable code; and

providing access to the collected data for an asset monitoring system, wherein the asset monitoring system is configured to discover from the collected data at least an application executed on the first workload.

2. The method of claim 1 , wherein the collected data includes any of: binary code of an application on the first workload, a software library, an error log, a script code, a configuration file, and credentials.

3. The method of claim 1 , wherein the first compute environment comprises a network, and a portion of the plurality of workloads are each a computer server connected to the network.

4. The method of claim 3 , further comprising:

receiving secure shell (SSH) login credentials for a first computer server of the portion of the plurality of workloads;

establishing an SSH session with the first computer server;

configuring the first computer server to install the collector, wherein executable code of the collector is transferred over the SSH session;

receiving the collected data over the SSH session; and

terminating the SSH session in response to receiving all the collected data.

5. The method of claim 1 , wherein the first compute environment includes a cloud computing environment.

6. The method of claim 5 , further comprising:

installing a daemonset collector in a container cluster, wherein the container cluster includes a plurality of nodes and being implemented in the cloud computing environment;

configuring the daemonset collector to periodically install the collector on each node of the container cluster; and

receiving from each collector collected data, wherein each collector collects data from at least a pod of a node on which the collector is installed.

7. The method of claim 1 , further comprising:

receiving a request to check a collector version;

sending an updated executable code, in response to determining that the collector version supersedes a version of the executable code of the collector.

8. The method of claim 1 , further comprising:

installing a collector;

sending a request to an API of a cloud computing environment to access a serverless function implemented in the cloud computing environment; and

collecting data from the serverless function.

9. The method of claim 1 , further comprising:

installing a collector;

sending a request to an application programming interface (API) of a cloud computing environment to access a platform as a service (PaaS) implemented in the cloud computing environment; and

collecting data from the PaaS.

10. The method of claim 1 , wherein the method is performed by an asset monitoring server connected to the first compute environment.

11. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:

establishing a connection with a first workload in a first compute environment, the first compute environment including a plurality of workloads;

causing installation of a non-persistent collector executable code on the first workload, wherein the non-persistent collector executable code, when executed, is configured to collect data from the first workload;

receiving collected data from the non-persistent collector installed on the first workload;

determining that data collection is complete;

upon determining that the data collection is completed, configuring the non-persistent collector to remove the executable code from the first workload, the first workload being an agentless workload without the executable code; and

providing access to the collected data for an asset monitoring system, wherein the asset monitoring system is configured to discover from the collected data at least an application executed on the first workload.

12. A system for agentless discovery in compute environments, comprising:

a processing circuitry; and

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

establish a connection with a first workload in a first compute environment, the first compute environment including a plurality of workloads;

cause installation of a non-persistent collector executable code on the first workload, wherein the non-persistent collector executable code, when executed, is configured to collect data from the first workload;

receive collected data from the non-persistent collector installed on the first workload;

determine that data collection is complete;

upon determining that the data collection is completed, configure the non-persistent collector to remove the executable code from the first workload, the first workload being an agentless workload without the executable code; and

provide access to the collected data for an asset monitoring system, wherein the asset monitoring system is configured to discover from the collected data at least an application executed on the first workload.

13. The system of claim 12 , wherein the first compute environment comprises a network, and a portion of the plurality of workloads are each a computer server connected to the network.

14. The system of claim 13 , wherein the memory contains further instructions that, when executed by the processing circuitry, further configure the system to:

receive secure shell (SSH) login credentials for a first computer server of the portion of the plurality of workloads;

establish an SSH session with the first computer server;

configure the first computer server to install the collector, wherein executable code of the collector is transferred over the SSH session;

receive the collected data over the SSH session; and

terminate the SSH session in response to receiving all the collected data.

15. The system of claim 12 , wherein the first compute environment includes a cloud computing environment.

16. The system of claim 15 , wherein the memory contains further instructions that, when executed by the processing circuitry, further configure the system to:

install a daemonset collector in a container cluster, wherein the container cluster includes a plurality of nodes and being implemented in the cloud computing environment;

configure the daemonset collector to periodically install the collector on each node of the container cluster; and

receive from each collector collected data, wherein each collector collects data from at least a pod of a node on which the collector is installed.

17. The system of claim 12 , wherein the memory contains further instructions that, when executed by the processing circuitry, further configure the system to:

receive a request to check a collector version; and

send an updated executable code, in response to determining that the collector version supersedes a version of the executable code of the collector.

18. The system of claim 12 , wherein the memory contains further instructions that, when executed by the processing circuitry, further configure the system to:

install a collector; and

send a request to an API of a cloud computing environment to access a serverless function implemented in the cloud computing environment; and

collecting data from the serverless function.

19. The system of claim 12 , wherein the memory contains further instructions that, when executed by the processing circuitry, further configure the system to:

install a collector;

send a request to an application programming interface (API) of a cloud computing environment to access a platform as a service (PaaS) implemented in the cloud computing environment; and

collecting data from the PaaS.

Assignments (3)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Feb 7, 2025
From: BIONIC STORK LTD.
To: CROWDSTRIKE, INC.
Reel/Frame 070147/0938 →
CORRECTIVE ASSIGNMENT TO CORRECT THE DOCKET NUMBER PREVIOUSLY RECORDED AT REEL: 058400 FRAME: 0469. ASSIGNOR(S) HEREBY CONFIRMS THE ASSIGNMENT. Recorded Dec 20, 2021
From: MAMO, EYAL; SIDIS, AMIR; IVANIR, OMRI
To: BIONIC STORK LTD.
Reel/Frame 059128/0549 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Dec 15, 2021
From: MAMO, EYAL; SIDIS, AMIR; IVANIR, OMRI
To: BIONIC STORK LTD.
Reel/Frame 058400/0469 →
Continuity (1)
Related Publication 20230185687A1 · Jun 15, 2023