Rapid7, Inc.

Niall Cochrane

Ralph McTeggart

Martin Hutchings

Sarah Addis

Luis Ramos Dos Santos Lopes

Jeff Myers

Daniel Skelton

Ryan Williams

Darragh Delaney

Erran Carey

John Brosnan

Lars-Kristian Svenoy

Dan-Adrian Moinescu

Andriy Lyubka

Morgan Doyle

Luke Coughlan

Gianpaolo Tedesco

Luis Lopes

Gianni Tedesco

Luke Coughlin

Disclosed herein are methods, systems, and processes for centralized containerized deployment of network traffic sensors to network sensor hosts for deep packet inspection (DPI) that supports various other cybersecurity operations. A network sensor package containing a pre-configured network sensor container is received by a network sensor host from a network sensor deployment server. Installation of the network sensor package on the network sensor host causes execution of the network sensor container that further causes deployment of an on-premise network sensor along with a network sensor management system, a DPI system, and an intrusion detection/prevention (IDS/IPS) system. The configurable on-premise network sensor is deployed on multiple operating system distributions of the network sensor host and generates actionable network metadata using DPI techniques for optimized log search and management and improved intrusion detection and response (IDR) operations.

Managed deployment and configuration of network sensors

A modification to an applied ruleset intended for consumption by intrusion detection systems (IDSs) is detected. A service event that is configured to push the applied ruleset to a set of test network sensors associated with the IDSs is triggered. A service subscribed to the service event updates the set of test network sensors with the applied ruleset and designates a configuration version to the applied ruleset. A notification is received from the set of test network sensors that the applied ruleset has been tested and is ready for deployment to other network sensors and a request is received to deploy the applied ruleset to a set of network sensors. A determination is made whether the request includes the configuration version designated to the applied ruleset by the service. If the request includes the configuration version designated to the applied ruleset, the request to deploy the applied ruleset to the set of network sensors is authorized. If the request does not include the configuration version designated to the applied ruleset, the request to deploy the applied ruleset to the set of network sensors is denied.

Secure verification of detection rules on test sensors

Secure configuration of a network sensor on a network sensor host

New intrusion detection system (IDS) rules to be deployed on an IDS that generates alerts based on an applied ruleset are accessed. A trial window that includes incorporating the new IDS rules into a candidate list to enable summarization and filtering of the alerts is started and the applied ruleset that includes existing IDS rules is supplemented with the candidate list that includes the new IDS rules. The applied ruleset is transmitted to a network sensor associated with the IDS upon the supplementation and alerts generated based on network events implicated by both the existing IDS rules and the new IDS rules in the applied ruleset are received from the IDS. Upon completion of the trial window, a set of alerts generated only by the new IDS rules in the applied ruleset are designated as suppressed alerts and a set of new IDS rules is eliminated from the applied ruleset upon determining that the set of new IDS rules generate a subset of alerts that exceed an alert threshold. The update and modified applied ruleset is then transmitted to the network sensor associated with the IDS.

Curating actionable intrusion detection system rules

Deployable network sensor for multiple platforms

Network sensor deployment for deep packet inspection

Growing community of inventors

Belfast, United Kingdom

Niall Cochrane