Application context via endpoint-aware traffic for enhanced security
Techniques for providing application context via endpoint-aware traffic for enhanced security are disclosed. In some embodiments, a system/process/computer program product for providing application context via endpoint-aware traffic for enhanced security includes collecting process information for a process at an endpoint; injecting the process information as metadata into network traffic associated with the process to generate endpoint-aware traffic; and processing the endpoint-aware traffic at a security platform or a security service to access more comprehensive information about the endpoint environment to apply a security policy based on a contextual application identifier (App-ID).
1 . A system, comprising:
a processor configured to:
collect process information for a process at an endpoint;
inject the process information as metadata into network traffic associated with the process to generate endpoint-aware traffic;
extract the process information and automatically group a plurality of traffic sessions sharing a common process identifier (PID) and/or a common parent process identifier (PPID) to be associated with a single application; and
process the endpoint-aware traffic at a security platform or a security service to access more comprehensive information about the endpoint to apply a security policy based on a contextual application identifier (App-ID), wherein the endpoint-aware traffic is processed at the security platform and/or the security service to provide contextual information associated with the network traffic for applying a security policy based on a contextual App-ID for the plurality of traffic sessions; and
a memory coupled to the processor and configured to provide the processor with instructions.
2 . The system of claim 1 , wherein the security platform includes a firewall, a network gateway firewall (NGFW), and/or another network device, and wherein the security service includes a cloud-based security service.
3 . The system of claim 1 , wherein the security platform and/or the security service monitors the endpoint-aware traffic, and wherein the security platform includes a firewall, a network gateway firewall (NGFW), and/or another network device, and wherein the security service includes a cloud-based security service.
4 . The system of claim 1 , wherein indicators are configured on the endpoint to collect the process information at the endpoint using an agent executed on the endpoint.
5 . The system of claim 1 , wherein indicators are configured on the endpoint to collect the process information at the endpoint, and wherein the process information includes a process identifier (PID), a process parent identifier (PPID), and a process name.
6 . The system of claim 1 , wherein the endpoint-aware traffic is processed at the security platform and/or the security service to provide contextual information associated with the network traffic for applying the security policy.
7 . The system of claim 1 , wherein the endpoint-aware traffic is processed at the security platform and/or the security service to provide contextual information associated with the network traffic for applying the security policy based on the contextual App-ID.
8 . The system of claim 1 , wherein identification of the contextual App-ID is performed prior to a start of a new session associated with network traffic for the new session, and wherein the identification of the contextual App-ID prior to the start of the new session reduces risks associated with data leakage by preventing a forwarding of any packets from the new session based on the contextual App-ID and the security policy.
9 . The system of claim 1 , wherein the processor is further configured to:
wherein if any of the network traffic within the group matches one or more existing App-ID signatures for identifying an application, then each of the plurality of traffic sessions associated with the group are automatically identified as being associated with the application.
10 . A method, comprising:
collecting process information for a process at an endpoint;
injecting the process information as metadata into network traffic associated with the process to generate endpoint-aware traffic;
extracting the process information and automatically group a plurality of traffic sessions sharing a common process identifier (PID) and/or a common parent process identifier (PPID) to be associated with a single application; and
processing the endpoint-aware traffic at a security platform or a security service to access more comprehensive information about the endpoint to apply a security policy based on a contextual application identifier (App-ID), wherein the endpoint-aware traffic is processed at the security platform and/or the security service to provide contextual information associated with the network traffic for applying a security policy based on a contextual App-ID for the plurality of traffic sessions.
11 . The method of claim 10 , wherein indicators are configured on the endpoint to collect the process information at the endpoint using an agent executed on the endpoint.
12 . The method of claim 10 , wherein indicators are configured on the endpoint to collect the process information at the endpoint, and wherein the process information includes a process identifier (PID), a process parent identifier (PPID), and a process name.
13 . The method of claim 10 , wherein the endpoint-aware traffic is processed at the security platform and/or the security service to provide contextual information associated with the network traffic for applying the security policy.
14 . The method of claim 10 , wherein the endpoint-aware traffic is processed at the security platform and/or the security service to provide contextual information associated with the network traffic for applying the security policy based on the contextual App-ID.
15 . The method of claim 10 , wherein identification of the contextual App-ID is performed prior to a start of a new session associated with network traffic for the new session, and wherein the identification of the contextual App-ID prior to the start of the new session reduces risks associated with data leakage by preventing a forwarding of any packets from the new session based on the contextual App-ID and the security policy.
16 . The method of claim 10 ,
wherein if any of the network traffic within the group matches one or more existing App-ID signatures for identifying an application, then each of the plurality of traffic sessions associated with the group are automatically identified as being associated with the application.
17 . A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
collecting process information for a process at an endpoint;
injecting the process information as metadata into network traffic associated with the process to generate endpoint-aware traffic;
extracting the process information and automatically group a plurality of traffic sessions sharing a common process identifier (PID) and/or a common parent process identifier (PPID) to be associated with a single application; and
processing the endpoint-aware traffic at a security platform or a security service to access more comprehensive information about the endpoint to apply a security policy based on a contextual application identifier (App-ID), wherein the endpoint-aware traffic is processed at the security platform and/or the security service to provide contextual information associated with the network traffic for applying a security policy based on a contextual App-ID for the plurality of traffic sessions.
18 . The computer program product of claim 17 , wherein indicators are configured on the endpoint to collect the process information at the endpoint using an agent executed on the endpoint.
19 . The computer program product of claim 17 , wherein the endpoint-aware traffic is processed at the security platform and/or the security service to provide contextual information associated with the network traffic for applying the security policy based on the contextual App-ID.
20 . The computer program product of claim 17 , wherein identification of the contextual App-ID is performed prior to a start of a new session associated with network traffic for the new session, and wherein the identification of the contextual App-ID prior to the start of the new session reduces risks associated with data leakage by preventing a forwarding of any packets from the new session based on the contextual App-ID and the security policy.
21 . The computer program product of claim 17 , wherein if any of the network traffic within the group matches one or more existing App-ID signatures for identifying an application, then each of the plurality of traffic sessions associated with the group are automatically identified as being associated with the application.