Generating machine data collection scripts from security policy content

Abstract

A script generation service is disclosed that parses a security policy to identify data objects controlled by the policy and generate data collection commands in a shell scripting language to collect states of the data objects from machines. In embodiments, the security policy is written in a policy specification language that allows data objects to be specified using references to object entities, variables, other objects, transformation functions, and/or state filters. The generation service is capable of resolving these types of references either during the script generation process or using commands in the generated script. In embodiments, the generated scripts are pushed to data collection agents executing on machines in a monitored network, which can execute the scripts as authenticated processes to collect and return machine state data about the machines. The machine state data is then assessed to identify possible security policy violations.