Consistent monitoring and analytics for security insights for network and security functions for a security service
Techniques for providing consistent monitoring and analytics for security insights for network and security functions for a security service are disclosed. In some embodiments, a system/process/computer program product for providing consistent monitoring and analytics for security insights for network and security functions for a security service includes receiving a flow at a software-defined wide area network (SD-WAN) device; inspecting the flow to determine whether the flow is associated with a split tunnel; and monitoring the flow at the SD-WAN device to collect security information associated with the flow for reporting to a security service.
1 . A system comprising:
a processor configured to:
receive a flow at a virtual private network (VPN) client on an endpoint device;
inspect the flow to determine whether the flow is associated with a split tunnel;
monitor the flow at the VPN client to collect security information associated with the flow for reporting to a security service, comprising to:
collect flow data with security context using the VPN client, wherein the flow data includes the following: an ingress IP address, an egress IP address, an ingress port number, an egress port number, a protocol, and session data usage and time related statistics; and
communicate the collected security information associated with the flow to the security service after a session associated with the flow is ended, comprising to:
send, using the VPN client, the flow data with the security context to the security service, wherein the security service is a cloud-based security service; and
a memory coupled to the processor and configured to provide the processor with instructions.
2 . The system recited in claim 1 , wherein the flow is associated with a whitelist policy and is allowed to bypass the security service based on a security policy.
3 . The system recited in claim 1 , wherein the flow is associated with the split tunnel and is allowed to bypass the security service based on a security policy.
4 . The system recited in claim 1 , wherein the processor is further configured to:
periodically communicate the collected security information associated with the flow from the VPN client to the security service.
5 . The system recited in claim 1 , wherein the security service is the cloud-based security service that is provided using a public cloud service provider.
6 . The system recited in claim 1 , wherein the security service is the cloud-based security service that is provided using a plurality of public cloud service providers.
7 . The system recited in claim 1 , wherein another flow is a site to site tunnel that bypasses the security service, and wherein the VPN client collects security information associated with the another flow for reporting to the security service.
8 . A method, comprising:
receiving a flow at a virtual private network (VPN) client on an endpoint device;
inspecting the flow to determine whether the flow is associated with a split tunnel;
monitoring the flow at the VPN client to collect security information associated with the flow for reporting to a security service, comprising to:
collecting flow data with security context using the VPN client, wherein the flow data includes the following: an ingress IP address, an egress IP address, an ingress port number, an egress port number, a protocol, and session data usage and time related statistics; and
communicating the collected security information associated with the flow to the security service after a session associated with the flow is ended, comprising:
sending, using the VPN client, the flow data with security context to the security service, wherein the security service is a cloud-based security service.
9 . The method of claim 8 , wherein the flow is associated with a whitelist policy and is allowed to bypass the security service based on a security policy.
10 . The method of claim 8 , wherein the flow is associated with the split tunnel and is allowed to bypass the security service based on a security policy.
11 . The method of claim 8 , further comprising:
periodically communicating the collected security information associated with the flow from the VPN client to the security service.
12 . The method of claim 8 , wherein the security service is the cloud-based security service that is provided using a plurality of public cloud service providers.
13 . The method of claim 8 , wherein another flow is a site to site tunnel that bypasses the security service, and wherein the VPN client collects security information associated with the another flow for reporting to the security service.
14 . A computer program product, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:
receiving a flow at a virtual private network (VPN) client on an endpoint device;
inspecting the flow to determine whether the flow is associated with a split tunnel;
monitoring the flow at the VPN client to collect security information associated with the flow for reporting to a security service, comprising to:
collecting flow data with security context using the VPN client, wherein the flow data includes the following: an ingress IP address, an egress IP address, an ingress port number, an egress port number, a protocol, and session data usage and time related statistics; and
communicating the collected security information associated with the flow to the security service after a session associated with the flow is ended, comprising:
sending, using the VPN client, the flow data with security context to the security service, wherein the security service is a cloud-based security service.
15 . The computer program product recited in claim 14 , wherein the flow is associated with a whitelist policy and is allowed to bypass the security service based on a security policy.
16 . The computer program product recited in claim 14 , wherein the flow is associated with the split tunnel and is allowed to bypass the security service based on a security policy.
17 . The computer program product recited in claim 14 , further comprising computer instructions for:
periodically communicating the collected security information associated with the flow to the security service.
18 . The computer program product recited in claim 14 , wherein the security service is the cloud-based security service that is provided using a plurality of public cloud service providers.
19 . The computer program product recited in claim 14 , wherein another flow is a site to site tunnel that bypasses the security service, and wherein the VPN client collects security information associated with the another flow for reporting to the security service.
20 . A system comprising:
a processor configured to:
receive a flow at a virtual private network (VPN) client on an endpoint device;
analyze the flow to determine whether the flow is associated with a split tunnel, comprising to:
extract meta data information associated with the flow without performing deep packet inspection to independently determine the meta data information, wherein the meta data information includes one or more of the following: an application identifier (APP ID), User ID, Device ID, and/or Content ID;
compare the extracted meta data information with meta data information associated with a whitelist policy; and
in the event that the extracted meta data information matches the meta data information associated with the whitelist policy, determine that the flow is associated with the split tunnel; and
mirror the flow from the VPN client to a security service, wherein the security service monitors the flow mirrored from the VPN client to collect security information associated with the flow for reporting; and
a memory coupled to the processor and configured to provide the processor with instructions.
21 . A method, comprising:
receiving a flow at a virtual private network (VPN) client on an endpoint device;
analyzing the flow to determine whether the flow is associated with a split tunnel, comprising:
extracting meta data information associated with the flow without performing deep packet inspection to independently determine the meta data information, wherein the meta data information includes one or more of the following: an application identifier (APP ID), User ID, Device ID, and/or Content ID;
comparing the extracted meta data information with meta data information associated with a whitelist policy; and
in the event that the extracted meta data information matches the meta data information associated with the whitelist policy, determining that the flow is associated with the split tunnel; and
mirroring the flow from the VPN client to a security service, wherein the security service monitors the flow mirrored from the VPN client to collect security information associated with the flow for reporting.
22 . A computer program product, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:
receiving a flow at a virtual private network (VPN) client on an endpoint device;
analyzing the flow to determine whether the flow is associated with a split tunnel, comprising:
extracting meta data information associated with the flow without performing deep packet inspection to independently determine the meta data information, wherein the meta data information includes one or more of the following: an application identifier (APP ID), User ID, Device ID, and/or Content ID;
comparing the extracted meta data information with meta data information associated with a whitelist policy; and
in the event that the extracted meta data information matches the meta data information associated with the whitelist policy, determining that the flow is associated with the split tunnel; and
mirroring the flow from the VPN client to a security service, wherein the security service monitors the flow mirrored from the VPN client to collect security information associated with the flow for reporting.