Systems and methods for integrating cloud services with information management systems

Patent metadata

Field	Value
Publication number	US-9912638-B2
Application number	US-201514597623-A
Country	US
Kind code	B2
Filing date	Jan 15, 2015
Priority date	Apr 30, 2012
Publication date	Mar 6, 2018
Grant date	Mar 6, 2018

Abstract

Systems and methods of integrating log data from a cloud system with an internal management system are described, wherein the cloud system is located externally from a secure network which contains the internal management system. The systems and methods include receiving log data from a cloud system through a secure connection between the secure network and the cloud system; buffering the received log data; filtering the buffered, received log data; and transmitting the filtered, buffered, received log data to the internal management system in a format associated with the internal management system.

First claim

What is claimed is:

1. A method of integrating log data from a cloud system with an internal management system, wherein the cloud system is located externally from a secure network which contains the internal management system, the method comprising:
receiving log data from a cloud log in a cloud system through a secure connection between an agent in the secure network and the cloud system, wherein the cloud log stores the log data related to processing in the cloud system;
buffering the received log data at the agent and controlling the flow from the cloud log to the agent based on the buffering;
filtering the buffered, received log data at the agent; and
transmitting the filtered, buffered, received log data by the agent via simple, insecure protocols inside the secure network to the internal management system in a format of a plurality of formats associated with the internal management system,
wherein the agent is configured to receive the log data in real time from the cloud log and to provide to the internal management system, and wherein the agent is configured to control the flow by monitoring a flow rate and causing the flow to change based thereon to accommodate the log data in real time.

2. The method of claim 1 , wherein the internal management system is a Security Information and Event Management (SIEM) system, and the method is performed via the agent comprising an external service bridge which is located within the secure network.

3. The method of claim 2 , wherein the external service bridge is any of a server, an appliance, a service operating on a virtual machine, and a service operating on a hardware device inside the secure network.

4. The method of claim 1 , wherein the log data undergoes a first line of filtering in the cloud system and a second line of filtering within the secure network, prior to being sent to the internal management system.

5. The method of claim 1 , wherein the cloud system is configured to proactively detect and preclude distribution of security threats between users associated with the secure network and the Internet, and wherein the security threats comprise any of malware, spyware, viruses, trojans, botnets, email spam, data leakage, policy violations, and other undesirable content.

6. The method of claim 1 , wherein the format is American Standard Code for Information Interchange (ASCII) format and the transmitting is over a Transmission Control Protocol (TCP) connection inside the secure network.

7. The method of claim 1 , wherein the internal management system is configured to perform any of data aggregation, correlation, alerting, dashboard, compliance, and retention of data.

8. The method of claim 1 , wherein the internal management system is a first internal management system of a plurality of internal management systems, and the method further comprising:
transmitting the filtered, buffered, received log data accordingly to each of the plurality of internal management systems in an associated format.

9. The method of claim 8 , wherein a record of the filtered, buffered, received log data is sent to at least two of the plurality of internal management systems.

10. A system configured to integrate log data from a cloud system with an internal management system, wherein the cloud system is located externally from a secure network which contains the internal management system, the system comprising:
a network interface communicatively coupled to the secure network and the cloud system;
a processor communicatively coupled to the network interface and a data store; and
memory storing instructions that, when executed, cause the processor to
obtain log data from a cloud log in the cloud system through a secure connection, via the network interface, between an agent in the secure network and the cloud system, wherein the cloud log stores the log data related to processing in the cloud system;
buffer the received log data at the agent in the data store and control the flow from the cloud log to the agent based on the buffer;
filter the buffered, received log data at the agent; and
cause transmission of the filtered, buffered, received log data by the agent to the internal management system, via the network interface and via simple, insecure protocols inside the secure network, in a format associated with the internal management system,

wherein the agent is configured to receive the log data in real time from the cloud log and to provide to the internal management system, and wherein the agent is configured to control the flow by monitoring a flow rate and causing the flow to change based thereon to accommodate the log data in real time.

11. The system of claim 10 , wherein the internal management system is a Security Information and Event Management (SIEM) system, and the agent is an external service bridge which is located within the secure network.

12. The system of claim 11 , wherein the external service bridge is any of a server, an appliance, a service operating on a virtual machine, and a service operating on a hardware device inside the secure network.

13. The system of claim 10 , wherein the log data undergoes a first line of filtering in the cloud system and a second line of filtering within the secure network, prior to being sent to the internal management system.

14. The system of claim 10 , wherein the cloud system is configured to proactively detect and preclude distribution of security threats between users associated with the secure network and the Internet, and wherein the security threats comprise any of malware, spyware, viruses, trojans, botnets, email spam, data leakage, policy violations, and other undesirable content.

15. The system of claim 10 , wherein the format is American Standard Code for Information Interchange (ASCII) format and the network interface is configured to transmit over a Transmission Control Protocol (TCP) connection inside the secure network to the internal management system.

16. The system of claim 10 , wherein the internal management system is configured to perform any of data aggregation, correlation, alerting, dashboard, compliance, and retention of data.

17. The system of claim 10 , wherein the internal management system is a first internal management system of a plurality of internal management systems, and the instructions, when executed, further cause the processor to:
cause transmission of the filtered, buffered, received log data accordingly to each of the plurality of internal management systems in an associated format.

18. The system of claim 17 , wherein a record of the filtered, buffered, received log data is sent to at least two of the plurality of internal management systems.

Assignees

• Kailash Kailash
• Balaiah Chakkaravarthy Periyasamy
• Pangeni Sushil
• Sinha Amit
• Crank Samuel John
• Apte Manoj
• Narasimhan Sridhar
• Zscaler Inc

Inventors

• Kailash Kailash
• Balaiah Chakkaravarthy Periyasamy
• Pangeni Sushil
• Sinha Amit
• Crank Samuel John
• Apte Manoj
• Narasimhan Sridhar

Classifications

• H04L41/0213

  Standardised network management protocols, e.g. simple network management protocol [SNMP] · CPC title

• H04L41/5096

  wherein the managed service relates to distributed or central networked applications · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• H04L63/0209 Primary

  Architectural arrangements, e.g. perimeter networks or demilitarized zones · CPC title

• H04L43/0817

  by checking functioning · CPC title