Rapid7, Inc.

Andreas Galauner

Paul Deardorff

Derek M Abdine

Mark Momburg

Tom Sellers

Methods and systems for monitoring network activity. Various embodiments may deploy virtual security appliances to a certain location or with a specific configuration based on data regarding previous attacks and attacker activity. Accordingly, the deployed virtual security appliance(s) are better suited to gather more useful behavior regarding threat actor behavior and attacks.

Virtual security appliances for eliciting attacks

Disclosed herein are methods, systems, and processes for performing honeypot asset cloning in cybersecurity computing environments. A computing asset and associated configuration information is identified along with configuration requirements for a honeypot. The configuration is modified to generate replication configuration information based partly on the configuration requirements. The replication configuration information is deployed in the network. A request to manage a configuration deployment in the network is received. In response to the request, the computing asset is configured based on the configuration information and the honeypot is generated based on the replication configuration information. The configuration is normalized and mapping information that is part of the configuration information that is supported by the honeypot is identified. A value in the configuration is replaced with another value associated with the part of the configuration information that is supported by the honeypot.

Honeypot asset cloning

Approaches provide for a management component to manage distribution of configuration information or other information in a network environment. For example, a request to deploy a security appliance configured to replicate functionality, behavior, and/or an identity of a computing device is received. The request includes selection criteria specifying one or more computing devices to replicate. Using the selection criteria, a computing device is identified as well as information associated with the computing device. The identified information is modified based on configuration requirements for a security appliance. The modified information is used to generate configuration information which is used to perform one of a number of actions, including, for example, configuring the security appliance or generating a new security appliance, among other such actions, where at least a portion of the operating behavior, functionality, or identification information of the security appliance substantially matches that of the identified computing device.

Growing community of inventors

Aachen, Germany

Andreas Galauner