US 2019/0245759 A1 · REAL-TIME CONFIGURATION DISCOVERY AND MANAGEMENT

Abstract

Embodiments are directed to monitoring network traffic in a network. A network monitoring engine may monitor networks to collect characteristics associated with network flows. The network monitoring engine may be arranged to identify entities on the network based on characteristics associated with the network flows. The network monitoring engine may provide entity profiles based on the identified entities and the characteristics. A configuration management engine may compare the entity profiles with configuration item (CI) entries in a database. The configuration management engine may provide discrepancy notices based on differences discovered during the comparison. Accordingly, the network monitoring engine may execute one or more policies to perform one or more additional actions based on the one or more discrepancies notices. Also, the configuration management engine may perform audits of an organization's information technology infrastructure to identify one or more violations of compliance policies.

Claims20

Dependent claims

A method for monitoring network traffic in a network, wherein one or more processors in a network computer execute instructions to perform actions, comprising:

passively monitoring the network to provide a plurality of characteristics associated with one or more network flows, wherein the passive monitoring avoids decryption of encrypted packets in the one or more network flows;
employing one or more of the plurality of characteristics to determine one or more entities on the network, wherein one or more profiles for the one or more determined entities are based on the one or more characteristics;
comparing the one or more profiles to configuration information associated with previously determined entities, wherein the comparison is employed to determine one or more differences between the one or more profiles and the configuration information;
and
providing notification of the one or more determined differences between the one or more profiles and the configuration information.

2 more elements

A processor readable non-transitory storage media that includes instructions for monitoring network traffic over a network between one or more computers, wherein execution of the instructions by one or more processors on one or more network monitoring computers (NMCs) performs actions, comprising:

passively monitoring the network to provide a plurality of characteristics associated with one or more network flows, wherein the passive monitoring avoids decryption of encrypted packets in the one or more network flows;
employing one or more of the plurality of characteristics to determine one or more entities on the network, wherein one or more profiles for the one or more determined entities are based on the one or more characteristics;
comparing the one or more profiles to configuration information associated with previously determined entities, wherein the comparison is employed to determine one or more differences between the one or more profiles and the configuration information;
and
providing notification of the one or more determined differences between the one or more profiles and the configuration information.

2 more elements

Dependencies are inferred from the claim text.

Real-time configuration discovery and management

Life of this patent

Real-time configuration discovery and management

Life of this patent

Abstract

Claims20