System and method for improving security intelligence through inventory discovery

Patent metadata

Field	Value
Publication number	US-9871814-B2
Application number	US-201514797010-A
Country	US
Kind code	B2
Filing date	Jul 10, 2015
Priority date	Jul 10, 2015
Publication date	Jan 16, 2018
Grant date	Jan 16, 2018

Abstract

A system for monitoring devices in a network comprising a coordinator operating on a first processor and configured to detect a plurality of active devices and to install an audit agent on each of the plurality of active devices. The audit agents configured to obtain configuration data for the active device that they are installed on using a processor of the active device, and to obtain configuration for each of a plurality of passive devices that the active device can access, where the passive devices are unable to support installation of an audit agent, and to transmit the configuration data to the coordinator. The coordinator configured to receive the configuration data for the active device and for the passive devices and to store the configuration data in a format that allows the configuration data to be selectively retrieved for the active device and the passive devices.

First claim

What is claimed is:

1. A system to monitor devices in a network, the system comprising:
a coordinator server device that is configured to detect a plurality of active devices and to cause an installation of an audit agent on each of the plurality of active devices,
wherein each of the plurality of active devices includes a respective processor configured to execute a respective audit agent to perform operations comprising:
obtain first configuration data for the respective active device that the audit agent is installed on using a processor of the respective active device,
obtain second configuration data for each of a plurality of passive devices that the respective active device can access, wherein the passive devices are characterized as being unable to support installation of the audit agent; and
transmit the first configuration data and the second configuration data to the coordinator server device,
wherein the coordinator server device is configured to receive the first configuration data for the plurality of active devices and the second configuration data for the passive devices and to store the first configuration data and the second configuration data in a format that allows the first configuration data and the second configuration data to be selectively retrieved for the plurality of active devices and the passive devices.

2. The system of claim 1 wherein the coordinator server device is configured to store a software database in the audit agents as a function of the respective active device associated with each respective audit agent.

3. The system of claim 1 wherein the coordinator server device is configured to store registry data in the respective audit agent as a function of the respective active device associated with each respective audit agent.

4. The system of claim 1 wherein the coordinator server device is configured to store service data in the respective audit agents as a function of the respective active device associated with each respective audit agent.

5. The system of claim 1 wherein the coordinator server device is configured to install an audit agent in a device image, wherein the device image comprises one or more relocatable processes configured to operate on a server.

6. The system of claim 1 wherein the coordinator server device is configured to cause an installation of an audit agent in a virtual machine.

7. The system of claim 1 wherein the coordinator server device is configured to modify a parameter of a software application operating on one or more of the active devices.

8. The system of claim 1 wherein the coordinator server device is configured to modify an update parameter of a software application operating on one or more of the active devices to request authorization from an operator device prior to installing an update.

9. The system of claim 1 wherein the coordinator server device is configured to modify one or more operating functions of the audit agents.

10. A method to monitor devices in a network, the method comprising:
detecting a plurality of active devices using a first processor of a coordinator server device;
causing an installation of an audit agent on each of the plurality of active devices using the first processor;
obtaining first configuration data from each audit agent for the active device that each audit agent is installed on;
obtaining second configuration data for each of a plurality of passive devices that each active device can access, wherein the passive devices are characterized as being unable to support installation of the audit agent;
receiving the first configuration data for the active devices and the second configuration data for the passive devices at the coordinator server device; and
storing the first configuration data for the active devices and the second configuration data for the passive devices in a data storage device in a format accessible by the coordinator server device that allows the first configuration data for the active devices and the second configuration data for the passive devices to be selectively retrieved for the active devices and the passive devices.

11. The method of claim 10 further comprising storing a software database in one or more of the audit agents as a function of the active device associated with each audit agent.

12. The method of claim 10 further comprising storing registry data in one or more of the audit agents as a function of the active device associated with each audit agent.

13. The method of claim 10 further comprising storing service data in one or more of the audit agents as a function of the active device associated with each audit agent.

14. The method of claim 10 further comprising installing an audit agent in a device image, wherein the device image comprises one or more relocatable processes configured to operate on a server.

15. The method of claim 10 further comprising installing an audit agent in a virtual machine.

16. The method of claim 10 further comprising modifying a parameter of a software application configured to operate on one or more of the active devices.

17. The method of claim 10 further comprising modifying an update parameter of a software application configured to operate on one or more of the active devices to request authorization from an operator prior to installing an update.

18. The method of claim 10 further comprising modifying one or more operating functions of the audit agents.

19. The method of claim 10 wherein the first and second configuration data is periodically transmitted from one or more of the audit agents to the coordinator server device.

Assignees

• Dell Products Lp
• Quest Software Inc

Inventors

• Seigel Jake

Classifications

• H04L41/12

  Discovery or management of network topologies · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• G06F8/61

  Installation · CPC title

• H04L67/24

  Electricity · mapped topic

• H04L67/54

  Presence management, e.g. monitoring or registration for receipt of user log-on information, or the connection status of the users · CPC title