公开(公告)号：US20230222210A1

公开(公告)日：2023-07-13

申请号：US17701768

申请日：2022-03-23

Applicant: VMWARE, INC.

Inventor： Leena Shuklendu Soman ,  Bharath Kumar Chandrasekhar ,  Shirish Vijayvargiya ,  Vasantha Kumar Dhanasekar ,  Vaibhav Mohan Rekhate

IPC: G06F21/53 ,  G06F9/455

CPC classification number: G06F21/53 ,  G06F9/45558 ,  G06F2009/45562 ,  G06F2009/45587

Abstract: A method for automatically reregistering a clone virtual machine with a cloud security monitoring service is provided. The method generally includes detecting a connection between a cloud agent running in a virtual machine on a host and a hypervisor module on the host. In response to detecting the connection, the cloud agent queries the hypervisor module for one or more first identifiers of the virtual machine. The method generally includes checking a database, by the cloud agent, for one or more second identifiers stored in the database matching the one or more first identifiers received from the hypervisor module and, based on finding no second identifiers stored in the database matching the one or more first identifiers, sending a request to the cloud security monitoring service to register the virtual machine with the cloud security monitoring service.

公开(公告)号：US20220214904A1

公开(公告)日：2022-07-07

申请号：US17190463

申请日：2021-03-03

Applicant: VMWARE, INC.

Inventor： Bharath Kumar Chandrasekhar ,  Leena Shuklendu Soman ,  Vasantha Kumar Dhanasekar

IPC: G06F9/455 ,  G06F9/54 ,  G06F9/30

Abstract: The disclosure provides an approach for hypervisor-assisted security analysis. Embodiments include receiving, at a hypervisor on a host computer, events from one or more virtual computing instances (VCIs). Embodiments include analyzing, by the hypervisor, the events according to one or more rules to identify a subset of the events for additional analysis. Embodiments include compressing, by the hypervisor, the subset of the events by performing deduplication to produce a compressed subset of the events. Embodiments include transmitting, by the hypervisor, the compressed subset of the events over a network to a separate analysis component, wherein the separate analysis component performs the additional analysis.