Endpoint assessment deduplication
Security compliance may be facilitated for multiple endpoints associated with a network. Multiple batch endpoint assessments may be performed. Each batch endpoint assessment of the multiple batch endpoint assessments may include receiving multiple status indicators associated with at least a subset of endpoints of the multiple endpoints. For each batch endpoint assessment of the multiple batch endpoint assessments, a status may be assigned to each endpoint of the multiple endpoints based on the plurality of status indicators. A state may be generated for each endpoint of the multiple endpoints based on the statuses assigned to the multiple endpoints.
1 . A method of endpoint compliance evaluation and remediation for a network of endpoints having changing network communication states, the method comprising:
performing a first batch endpoint assessment at a first time during which a first subset and a third subset of the endpoints are active, and a second subset of the endpoints is inactive;
responsive to the first batch endpoint assessment, receiving a first set of assessment indicators from each of the endpoints, the first set including an indication of a compliant state from the first subset and the third subset that are active and an indication of a communicative state from the second subset that is inactive;
generating a first device status array based on the first set, the first device status array indicating statuses of the endpoints at the first time;
performing a second batch endpoint assessment at a second time, the second time being during an assessment period and following the first time, wherein the second subset and the third subset are active at the second time and the first subset is inactive at the second time;
responsive to the second batch endpoint assessment, receiving a second set of assessment indicators from each of the endpoints, the second set including an indication of a compliant state from the second and the third subsets that are active and an indication of a communicative state from the first subset that is inactive;
generating a second device status array based on the second set, the second device status array indicating the statuses of the endpoints at the second time;
generating a final device status array, the generating including populating the final device status array with the first device status array;
deduplicating statuses of the endpoints in the first set of assessment indicators and the second set of assessment indicators, wherein the deduplication includes:
comparing the second device status array and the first device status array to identify a compliant state difference between the first batch endpoint assessment and the second batch endpoint assessment; and
responsive to the identified compliant state difference of a particular endpoint including a change from a noncompliant state or a non-communicative state to a compliant state, updating a status of the particular endpoint to the compliant state in the final device status array; and
after the assessment period:
determining whether a second endpoint has a noncompliant state; and
responsive to the second endpoint having the noncompliant state, mitigating the second endpoint by initiating an action at the second endpoint to change a state of the second endpoint and bring the second endpoint into compliance.
2 . The method of claim 1 , wherein the deduplicating includes responsive to the identified compliant state difference of the particular endpoint including a change from a compliant state to a noncompliant state or to a non-communicative state, not updating a status of the particular endpoint in the final device status array.
3 . The method of claim 2 , wherein the deduplicating includes responsive to the identified compliant state difference of the particular endpoint including a change from a noncompliant state to a non-communicative state or from non-communicative state to a noncompliant state, updating the status of the particular endpoint to the state at the second time in the final device status array.
4 . The method of claim 1 , further comprising prior to the first batch endpoint assessment communicating a command to the endpoints to perform an action, wherein the first batch endpoint assessment is configured to determine whether the command is implemented at the endpoints.
5 . The method of claim 1 , wherein the assessment period includes three days.
6 . The method of claim 1 , wherein:
the first subset includes endpoints that interface with the network in a first geographic location; and
the second subset includes endpoints that interface with the network in a second geographic location that is geographically distinct from the first geographic location.
7 . The method of claim 1 , wherein:
the first subset includes endpoints associated with a first subset of users who interface with the network during a period of time including the first time; and
the second subset includes endpoints associated with a second subset of users who interface with the network during a period of time including the second time and that does not include the first time.
8 . The method of claim 1 , wherein the mitigating includes one or more or a combination of:
communicating a patch for installation;
modifying a setting at the second endpoint;
deleting a file or program on the second endpoint; and
installing a file or program on the second endpoint.
9 . One or more computer-readable media configured to cause a system to perform or control operations of endpoint compliance evaluation and remediation for a network of endpoints having changing network communication states, the operations comprising:
performing a first batch endpoint assessment at a first time during which a first subset and a third subset of the endpoints are active, and a second subset of the endpoints is inactive;
responsive to the first batch endpoint assessment, receiving a first set of assessment indicators from each of the endpoints, the first set including an indication of a compliant state from the first subset and the third subset that are active and an indication of a communicative state from the second subset that is inactive;
generating a first device status array based on the first set, the first device status array indicating statuses of the endpoints at the first time;
performing a second batch endpoint assessment at a second time, the second time being during an assessment period and following the first time, wherein the second subset and the third subset are active at the second time and the first subset is inactive at the second time;
responsive to the second batch endpoint assessment, receiving a second set of assessment indicators from each of the endpoints, the second set including an indication of a compliant state from the second and the third subsets that are active and an indication of a communicative state from the first subset that is inactive;
generating a second device status array based on the second set, the second device status array indicating the statuses of the endpoints at the second time;
generating a final device status array, the generating including populating the final device status array with the first device status array;
deduplicating statuses of the endpoints in the first set of assessment indicators and the second set of assessment indicators, wherein the deduplication includes:
comparing the second device status array and the first device status array to identify a compliant state difference between the first batch endpoint assessment and the second batch endpoint assessment; and
responsive to the identified compliant state difference of a particular endpoint including a change from a noncompliant state or a non-communicative state to a compliant state, updating a status of the particular endpoint to the compliant state in the final device status array; and
after the assessment period:
determining whether a second endpoint has a noncompliant state; and
responsive to the second endpoint having the noncompliant state, mitigating the second endpoint by initiating an action at the second endpoint to change a state of the second endpoint and bring the second endpoint into compliance.
10 . The computer-readable media of claim 9 , wherein the deduplicating includes responsive to the identified compliant state difference of the particular endpoint including a change from a compliant state to a noncompliant state or to a non-communicative state, not updating a status of the particular endpoint in the final device status array.
11 . The computer-readable media of claim 10 , wherein the deduplicating includes responsive to the identified compliant state difference of the particular endpoint including a change from a noncompliant state to a non-communicative state or from non-communicative state to a noncompliant state, updating the status of the particular endpoint to the state at the second time in the final device status array.
12 . The computer-readable media of claim 9 , further comprising prior to the first batch endpoint assessment communicating a command to the endpoints to perform an action, wherein the first batch endpoint assessment is configured to determine whether the command is implemented at the endpoints.
13 . The computer-readable media of claim 9 , wherein the assessment period includes three days.
14 . The computer-readable media of claim 9 , wherein:
the first subset includes endpoints that interface with the network in a first geographic location; and
the second subset includes endpoints that interface with the network in a second geographic location that is geographically distinct from the first geographic location.
15 . The computer-readable media of claim 9 , wherein:
the first subset includes endpoints associated with a first subset of users who interface with the network during a period of time including the first time; and
the second subset includes endpoints associated with a second subset of users who interface with the network during a period of time including the second time and that does not include the first time.
16 . The computer-readable media of claim 9 , wherein the mitigating includes one or more or a combination of:
communicating a patch for installation;
modifying a setting at the second endpoint;
deleting a file or program on the second endpoint; and
installing a file or program on the second endpoint.