Endpoint detection and response based on aggregated runtime execution data
A system and method for improved endpoint detection and response (EDR) in a cloud computing environment by decreasing network bandwidth usage are presented. The method includes: configuring a resource in a cloud computing environment to deploy thereon a runtime sensor, the runtime sensor configured to detect runtime data of the resource; configuring the runtime sensor to detect in the runtime data a plurality of events, each event sharing a common value; configuring the runtime sensor to generate an aggregated event record based on the detected plurality of events having a common value; receiving the aggregated event record from the runtime sensor; generating a plurality of unmerged event records based on the aggregated event record; and storing the unmerged event records in a cloud computing storage.
1 . A method for improved endpoint detection and response (EDR) in a cloud computing environment by decreasing network bandwidth usage, comprising:
configuring a resource in a cloud computing environment to deploy thereon a runtime sensor, the runtime sensor configured to detect runtime data of the resource;
configuring the runtime sensor to detect in the runtime data a plurality of events, each event associated with a software process executed on the resource of the cloud computing environment, wherein each event sharing a common value of the runtime data that is aggregated across multiple software processes;
configuring the runtime sensor to generate an aggregated event record based on the detected plurality of events having a common value;
receiving the aggregated event record from the runtime sensor;
generating a plurality of unmerged event records based on extracting different uncommon values from an aggregated data field of the aggregated event record; and
storing the unmerged event records in a cloud computing storage.
2 . The method of claim 1 , wherein generating the plurality of unmerged event records further comprises:
parsing the aggregated event record to detect an aggregated data field, the aggregated data field including a plurality of values; and
generating an unmerged event record of the plurality of unmerged event records based on: a value of the plurality of values, and another value of another data field of the aggregated event record.
3 . The method of claim 1 , further comprising:
applying a policy on the stored unmerged event records.
4 . The method of claim 1 , further comprising:
detecting an identifier of a resource in an unmerged event record;
inspecting the resource for a cybersecurity object;
detecting an event in another unmerged event record; and
initiating a remediation action based on a toxic combination, in response to detecting the cybersecurity object and the event.
5 . The method of claim 1 , further comprising:
detecting aggregable events based on a common value of a data of runtime data.
6 . The method of claim 1 , further comprising:
generating the aggregated event record based on a plurality of events, each event corresponding to a type of runtime process.
7 . The method of claim 1 , further comprising:
configuring the runtime sensor to periodically send an aggregated event record generated within a first time period.
8 . The method of claim 1 , further comprising:
generating an analysis report based on applying a predefined query on a database storing thereon the unmerged event records.
9 . The method of claim 1 , further comprising:
initiating a mitigation action in response to detecting a first event in the unmerged event records from a first resource and a second event in the unmerged event records from a second resource.
10 . A non-transitory computer-readable medium storing a set of instructions for improved endpoint detection and response (EDR) in a cloud computing environment by decreasing network bandwidth usage, the set of instructions comprising:
one or more instructions that, when executed by one or more processors of a device, cause the device to:
configure a resource in a cloud computing environment to deploy thereon a runtime sensor, the runtime sensor configured to detect runtime data of the resource;
configure the runtime sensor to detect in the runtime data a plurality of events, each event associated with a software process executed on the resource of the cloud computing environment, wherein each event sharing a common value of the runtime data that is aggregated across multiple software processes;
configure the runtime sensor to generate an aggregated event record based on the detected plurality of events having a common value;
receive the aggregated event record from the runtime sensor;
generate a plurality of unmerged event records based on an extraction of different uncommon values from an aggregated data field of the aggregated event record; and
store the unmerged event records in a cloud computing storage.
11 . A system for improved endpoint detection and response (EDR) in a cloud computing environment by decreasing network bandwidth usage comprising:
a processing circuitry;
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
configure a resource in a cloud computing environment to deploy thereon a runtime sensor, the runtime sensor configured to detect runtime data of the resource;
configure the runtime sensor to detect in the runtime data a plurality of events, each event associated with a software process executed on the resource of the cloud computing environment, wherein each event sharing a common value of runtime data that is aggregated across multiple software processes;
configure the runtime sensor to generate an aggregated event record based on the detected plurality of events having a common value;
receive the aggregated event record from the runtime sensor;
generate a plurality of unmerged event records based on an extraction of different uncommon values from an aggregated data field of the aggregated event record; and
store the unmerged event records in a cloud computing storage.
12 . The system of claim 11 , wherein the memory contains further instructions that, when executed by the processing circuitry for generating the plurality of unmerged event records, further configure the system to:
parse the aggregated event record to detect an aggregated data field, the aggregated data field including a plurality of values; and
generate an unmerged event record of the plurality of unmerged event records based on:
a value of the plurality of values, and another value of another data field of the aggregated event record.
13 . The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
apply a policy on the stored unmerged event records.
14 . The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
detect an identifier of a resource in an unmerged event record;
inspect the resource for a cybersecurity object;
detect an event in another unmerged event record; and
initiate a remediation action based on a toxic combination, in response to detecting the cybersecurity object and the event.
15 . The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
detect aggregable events based on a common value of a data of runtime data.
16 . The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
generate the aggregated event record based on a plurality of events, each event corresponding to a type of runtime process.
17 . The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
configure the runtime sensor to periodically send an aggregated event record generated within a first time period.
18 . The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
generate an analysis report based on applying a predefined query on a database storing thereon the unmerged event records.
19 . The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
initiate a mitigation action in response to detecting a first event in the unmerged event records from a first resource and a second event in the unmerged event records from a second resource.