Enterprise-level network security data acquisition and management system

Abstract

The invention discloses an enterprise-level network security data acquisition management system. The system comprises a data acquisition module, a data analysis processing module and a security management representation module, Wherein the data acquisition module comprises a data acquisition port and a data acquisition agent module, and the data acquisition agent module comprises a data acquisition plug-in, a configuration management module and a control engine module; The configuration management module is used for configuring a distribution request; And the control engine module is used formonitoring the state of the acquisition thread, starting the configuration management module and performing acquisition control. The invention aims to solve the problem that the current enterprise network security data is poor in acquisition capability. A management acquisition model of a novel architecture is provided, the model performs data acquisition on security products with the same log generation mode by using one module, and bottom-layer details of data access of the security products can be effectively shielded by adopting an acquisition agent mode.

Description

technical field [0001] The invention relates to the technical field of enterprise network security, in particular to an enterprise-level network security data collection and management system. Background technique [0002] With the increasing popularity of network applications, network security issues are getting more and more attention. Various current network protection facilities such as data stream collectors, intrusion detection systems, virus detection systems, vulnerability scanning systems and firewalls have obtained part of network security data from different angles. [0003] Enterprises use the network security management platform to collect and manage network data, which can realize the collection and processing of security information, network status monitoring, intelligent log audit, security event management, etc., which effectively simplifies the enterprise network security management work, from Overall, the security level of the network has been improved. ...

AI Technical Summary

Problems solved by technology

[0004] Due to the wide variety of security devices and various information formats, how to realize the comprehensive collection and unified expression of security event information and asset environment information is an important issue in the field of enterprise network security management technology, which will directly affect the quality of enterprise network security management. Finally, the effect is achieved, but the existing enterprise security management products have limited data collection capabilities, and can only collect data for their own security equipment or products, ignoring many security products in the free software field. There is still no effective solution to the problem

Images