Management of actions in a computing environment based on asset classification
AssigneeSplunk Inc.
InventorsSourabh Satish, Oliver Friedrichs, Atif Mahadik, Govind Salinas
Life of this patent
Estimating the term…
Abstract
Systems, methods, and software described herein provide for responding to security threats in a computing environment based on the classification of computing assets in the environment. In one example, a method of operating an advisement computing system includes identifying a security threat for an asset in the computing environment, and identifying a classification for the asset in relation to other assets within the computing environment. The method further provides determining a rule set for the security threat based on the classification for the asset and initiating a response to the security threat based on the rule set.
Claims26
A method comprising:
- identifying, by an advisement system executing on a server in a computing environment comprising a plurality of computing assets, an incident associated with a computing asset of the plurality of computing assets;
- determining a classification for the computing asset, wherein the classification for the computing asset is determined based on data indicating that the computing asset is associated with more incoming network connections than outgoing network connections, wherein the data is collected prior to the identification of the incident, and wherein the classification is selected from a set of classifications including:
- a target asset, a source asset, or an infrastructure asset;
- determining a response to the incident based on the classification, wherein the response includes one or more actions;
- and
- implementing, by the advisement system, the one or more actions to respond to the incident.
A computing system comprising:
- one or more non-transitory computer readable storage media;
- a processing system operatively coupled to the one or more non-transitory computer readable storage media;
- and
- program instructions stored on the one or more non-transitory computer readable storage media that, when read and executed by the processing system, direct the processing system to at least:
- identify, by an advisement system executing on the processing system in a computing environment comprising a plurality of computing assets, an incident associated with a computing asset of the plurality of computing assets;
- determine a classification for the computing asset, wherein the classification for the computing asset is determined based on data indicating that the computing asset is associated with more incoming network connections than outgoing network connections, wherein the data is collected prior to the identification of the incident, and wherein the classification is selected from a set of classifications including:
- a target asset, a source asset, or an infrastructure asset;
- determine a response to the incident based on the classification, wherein the response includes one or more actions;
- and
- implement, by the advisement system, the one or more actions to respond to the incident.
A non-transitory computer-readable storage medium storing instructions which, when executed by one or more processors, cause performance of operations comprising:
- identifying, by an advisement system executing in a computing environment comprising a plurality of computing assets, an incident associated with a computing asset of the plurality of computing assets;
- determining a classification for the computing asset, wherein the classification for the computing asset is determined based on data indicating that the computing asset is associated with more incoming network connections than outgoing network connections, and wherein the data is collected prior to the identification of the incident, and wherein the classification is selected from a set of classifications including:
- a target asset, a source asset, or an infrastructure asset;
- determining a response to the incident based on the classification, wherein the response includes one or more actions;
- and
- implementing, by the advisement system, the one or more actions to respond to the incident.
Dependencies are inferred from the claim text.