# US 11,122,071 B2 · Visibility and scanning of a variety of entities

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,122,071 B2
- Document ID: US11122071B2
- Status: Granted
- Kind: B2
- Application number: 16/023,553
- Filed: 2018-06-29
- Published: 2020-01-02
- Granted: 2021-09-14
- Earliest claimed: 2018-06-29
- Assignees: Forescout Technologies, Inc.
- Applicants: Forescout Technologies, Inc.
- Inventors: Anderson Lam; Sharad Singh; Mihael Sudakovitch
- Web page: https://patentgrep.com/patent/US11122071B2

## CPC

- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/1433: {Vulnerability analysis}
- G06F 21/55: Detecting local intrusion or implementing counter-measures
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 63/102: {Entity profiles}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 63/302: {gathering intelligence information for situation awareness or reconnaissance}
- H04L 63/306: {intercepting packet switched data communications, e.g. Web, Internet or IMS communications}
- H04L 63/308: {retaining data, e.g. retaining successful, unsuccessful communication attempts, internet access, or e-mail, internet telephony, intercept related information or call content}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Systems, methods, and related technologies for entity visibility are described. In certain aspects, information associated with a type of entity is accessed and a network is scanned for a plurality of entities. One or more entities are selected from plurality of entities based on the type of entity. Properties associated with the one or more selected entities are accessed. The information associated with the one or more selected entities and the one or more properties associated with the selected one or more entities are stored.

## Claims

### Claim 1

A method comprising:
accessing information associated with a type of entity to be monitored on a network;
scanning the network for a plurality of entities;
selecting, by a processing device, one or more entities of the plurality of entities based on the type of entity to be monitored on the network, wherein one of the one or more entities is a new entity;
accessing one or more properties associated, respectively, with the selected one or more entities, including the new entity, of the plurality of entities based on the type of entity to be monitored on the network;
accessing information associated with the new entity from another source based on the type of entity to be monitored on the network;
storing information associated with the one or more selected entities, including the new entity, of the plurality of entities and the one or more properties associated with the selected one or more entities; and
performing an action on an entity of the one or more selected entities of the plurality of entities based on a policy, wherein the action comprises preventing an account associated with a misconfigured firewall or router from accessing network resources.

### Claim 2 (depends on 1)

The method of claim 1, wherein the type of entity is independent of at least one of an interne protocol (IP) address or a media access control (MAC) address.

### Claim 3 (depends on 1)

The method of claim 1, wherein the one or more entities comprises an account.

### Claim 4 (depends on 1)

The method of claim 1, wherein the one or more entities comprises a cloud based storage resource.

### Claim 5 (depends on 1)

The method of claim 1, wherein the one or more entities comprises an indicator of compromise (IOC).

### Claim 6 (depends on 1)

The method of claim 1, wherein the one or more entities comprises a network device configuration.

### Claim 7 (depends on 1)

The method of claim 1, wherein the scanning of the network for a plurality of entities comprises communication with a plurality of devices, wherein each of the plurality of devices is operable to have at least one entity matching the type of entity.

### Claim 8

A system comprising:
a memory; and
a processing device, operatively coupled to the memory, to:
access information associated with a type of entity to be monitored on a network;
scan the network for a plurality of entities;
select one or more entities of the plurality of entities based on the type of entity to be monitored on the network, wherein one of the one or more entities is a new entity;
access one or more properties associated, respectively, with the selected one or more entities of the plurality of entities based on the type of entity to be monitored on the network;
access information associated with the new entity from another source based on the type of entity to be monitored on the network;
store information associated with the one or more selected entities, including the new entity, of the plurality of entities and the one or more properties associated with the selected one or more entities; and
perform an action on an entity of the one or more selected entities of the plurality of entities based on a policy, wherein the action comprises a poll for virtualization system information to determine a type of remediation action to take after checking permissions.

### Claim 9 (depends on 8)

The system of claim 8, wherein the type of entity is independent of at least one of an interne protocol (IP) address or a media access control (MAC) address.

### Claim 10 (depends on 8)

The system of claim 8, wherein the one or more entities comprises an account.

### Claim 11 (depends on 8)

The system of claim 8, wherein the one or more entities comprises a cloud based storage resource.

### Claim 12 (depends on 8)

The system of claim 8, the one or more entities comprises is an indicator of compromise (IOC).

### Claim 13 (depends on 8)

The system of claim 8, wherein the one or more entities comprises a network device configuration.

### Claim 14 (depends on 8)

The system of claim 8, wherein the scan of the network for a plurality of entities comprises communication with a plurality of devices.

### Claim 15

A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to:
access information associated with a type of entity to be monitored on a network;
scan the network for a plurality of entities;
select, using the processing device, one or more entities of the plurality of entities based on the type of entity to be monitored on the network, wherein one of the one or more entities is a new entity;
access one or more properties associated, respectively, with the selected one or more entities of the plurality of entities based on the type of entity to be monitored on the network;
access information associated with the new entity from another source based on the type of entity to be monitored on the network;
store information associated with the one or more selected entities, including the new entity, of the plurality of entities and the one or more properties associated with the selected one or more entities; and
perform an action on an entity of the one or more selected entities of the plurality of entities based on a policy, wherein the action comprises a poll for virtualization system information to determine a type of remediation action to take after checking permissions.

### Claim 16 (depends on 15)

The non-transitory computer readable medium of claim 15, wherein the type of entity is independent of at least one of an interne protocol (IP) address or a media access control (MAC) address.

### Claim 17 (depends on 15)

The non-transitory computer readable medium of claim 15, wherein the one or more entities comprises an account.