Remote operations forensics
The present disclosure is related to endpoint monitoring and forensic artifact collection. In some embodiments, forensic artifacts and endpoint monitoring data are collected on an endpoint using the same agent. In some embodiments, forensic artifacts are chunked prior to being transferred to a cloud server for analysis. In some embodiments, forensic artifacts are categorized and processed according to the category. In some embodiments, the agent operates in memory and does not write to disk. In some embodiments, the agent does not write to disk during the transfer of forensic artifacts to a cloud server. In some embodiments, a cloud server can enable natural language queries of monitoring data and/or forensic artifacts. In some embodiments, the cloud server provides summaries. In some embodiments, the cloud server identifies the most relevant data in monitoring data and/or forensic artifacts.
1 . A computer-implemented method for forensic artifact collection, the computer-implemented method comprising:
collecting, by an agent installed on an endpoint, endpoint monitoring data;
transmitting, by the agent over a network, the endpoint monitoring data to a cloud server;
receiving, by the agent from the cloud server over the network, an indication of a security incident,
wherein the security incident is determined based at least in part on the endpoint monitoring data; and
in response to receiving the indication of the security incident:
identifying, by the agent, a set of forensic artifact types;
determining, by the agent, a set of forensic artifacts,
wherein each forensic artifact of the set of forensic artifacts is associated with at least one forensic artifact type of the set of forensic artifact types;
generating one or more batches,
wherein each batch of the one or more batches comprises a subset of the set of forensic artifacts,
wherein each batch of the one or more batches has a batch size that is less than or equal to a maximum batch size, and
wherein the maximum batch size is based at least in part on an amount of random access memory of the endpoint;
transmitting, by the agent, the set of forensic artifacts to a destination server,
wherein transmitting the set of forensic artifacts comprises transmitting the one or more batches,
wherein the set of forensic artifacts is stored in random access memory,
wherein identifying the set of forensic artifact types, determining the set of forensic artifacts, and transmitting the set of forensic artifacts to the destination server are performed without writing to a non-volatile storage medium of the endpoint.
2 . The computer-implemented method of claim 1 , wherein the set of forensic artifacts is determined based at least in part on the endpoint monitoring data,
wherein the endpoint monitoring data indicates at least one of a file operation or a network operation.
3 . The computer-implemented method of claim 1 , wherein the indication of the security incident comprises an indication of a type of the security incident,
wherein determining the set of forensic artifacts is based at least in part on the type of the security incident.
4 . The computer-implemented method of claim 3 , wherein to determine the set of forensic artifacts, the computer-implemented method further comprises:
determining a pre-defined rule based on the type of the security incident,
wherein the pre-defined rule specifies at least one of: a type of forensic artifact to collect, a log to collect, or a file to collect.
5 . The computer-implemented method of claim 1 , wherein transmitting the set of forensic artifacts to the destination server comprises:
creating a plurality of threads,
wherein a number of threads in the plurality of threads is based on a number of forensic artifact types included in the set of forensic artifact types;
wherein each thread of the plurality of threads is configured to transmit forensic artifacts having a particular forensic artifact type,
wherein transmitting forensic artifacts having the particular forensic artifact type comprises transmitting an indication of the particular forensic artifact type to the destination server.
6 . The computer-implemented method of claim 1 , further comprising receiving an indication of a network address of the destination server.
7 . The computer-implemented method of claim 6 , further comprising receiving a credential for accessing the destination server.
8 . The computer-implemented method of claim 1 , wherein the set of forensic artifacts comprises forensic artifacts created from an initial time to a current time, wherein the initial time is correlated with a time when the agent began operating on the endpoint.
9 . The computer-implemented method of claim 1 , wherein transmitting the set of forensic artifacts comprises transmitting a memory dump before transmitting other forensic artifacts of the set of forensic artifacts.
10 . The computer-implemented method of claim 1 , further comprising:
receiving, from the cloud server, a destination address for receiving the set of forensic artifacts; and
receiving, from the cloud server, a credential for transmitting the set of forensic artifacts to the destination address.
11 . A system for forensic artifact collection, the system comprising:
at least one processor; and
a non-volatile, computer-readable medium with instructions stored thereon which, when executed by the at least one processor, cause the system to:
collect, by an agent installed on the system, endpoint monitoring data;
transmit, by the agent over a network, the endpoint monitoring data to a cloud server;
receive, by the agent from the cloud server over the network, an indication of a security incident,
wherein the security incident is determined based at least in part on the endpoint monitoring data; and
in response to receiving the indication of the security incident:
identify, by the agent, a set of forensic artifact types;
determine, by the agent, a set of forensic artifacts,
wherein each forensic artifact of the set of forensic artifacts is associated with at least one forensic artifact type of the set of forensic artifact types;
generate one or more batches,
wherein each batch of the one or more batches comprises a subset of the set of forensic artifacts,
wherein each batch of the one or more batches has a batch size that is less than or equal to a maximum batch size, and
wherein the maximum batch size is based at least in part on an amount of random access memory of the system; and
transmit, by the agent, the set of forensic artifacts to a destination server,
wherein transmitting the set of forensic artifacts comprises transmitting the one or more batches,
wherein the set of forensic artifacts is stored in random access memory,
wherein identifying the set of forensic artifact types, determining the set of forensic artifacts, and transmitting the set of forensic artifacts to the destination server are performed without writing to a non-volatile storage medium of the system.
12 . The system of claim 11 , wherein the set of forensic artifacts is determined based at least in part on the endpoint monitoring data,
wherein the endpoint monitoring data indicates at least one of a file operation or a network operation.
13 . The system of claim 11 , wherein the indication of the security incident comprises an indication of a type of the security incident,
wherein determining the set of forensic artifacts is based at least in part on the type of the security incident.
14 . The system of claim 13 , wherein to determine the set of forensic artifacts, the instructions are further configured to cause the system to:
determine a pre-defined rule based on the type of the security incident,
wherein the pre-defined rule specifies at least one of: a type of forensic artifact to collect, a log to collect, or a file to collect.
15 . The system of claim 11 , wherein transmitting the set of forensic artifacts to the destination server comprises:
creating a plurality of threads,
wherein a number of threads in the plurality of threads is based on a number of forensic artifact types included in the set of forensic artifact types;
wherein each thread of the plurality of threads is configured to transmit forensic artifacts having a particular forensic artifact type,
wherein transmitting forensic artifacts having the particular forensic artifact type comprises transmitting an indication of the particular forensic artifact type to the destination server.
16 . The system of claim 11 , wherein the instructions are further configured to cause the system to receive an indication of a network address of the destination server.
17 . The system of claim 16 , wherein the instructions are further configured to cause the system to receive a credential for accessing the destination server.
18 . The system of claim 11 , wherein the set of forensic artifacts comprises forensic artifacts created from an initial time to a current time, wherein the initial time is correlated with a time when the agent began operating on the system.
19 . The system of claim 11 , wherein transmitting the set of forensic artifacts comprises transmitting a memory dump before transmitting other forensic artifacts of the set of forensic artifacts.
20 . The system of claim 11 , wherein the instructions are further configured to cause the system to:
receive, from the cloud server, a destination address for receiving the set of forensic artifacts; and
receive, from the cloud server, a credential for transmitting the set of forensic artifacts to the destination address.