Dynamic data socket descriptor mirroring mechanism and use for security analytics

Abstract

According to another embodiment, a system includes a processing circuit and logic integrated with and/or executable by the processing circuit. The logic is configured to cause the processing circuit to receive, at a first host on which an application instance is operating, an application or data security policy for a first data socket descriptor indicating to perform one or more actions including to mirror one or more payloads received or transmitted by the first data socket descriptor of the application instance. The logic is also configured to cause the processing circuit to perform, by the first host, at least one action selected from a group of actions in response to the indication by the application and data security policy to perform the one or more actions, the group of actions including allow-and-analyze, drop-and-analyze, and mirror.

Dependencies are inferred from the claim text.