US 12,003,485 B2
Outbound/inbound lateral traffic punting based on process risk
Ho Yu Lam, Santa Clara, CA (US); Robert Earle Ashley, Santa Clara, CA (US); Paul Theodore Mathison, San Jose, CA (US); Qiuming Li, San Jose, CA (US); and Taylor Ettema, San Jose, CA (US)
Assigned to Palo Alto Networks, Inc., Santa Clara, CA (US)
Filed by Palo Alto Networks, Inc., Santa Clara, CA (US)
Filed on Feb. 23, 2023, as Appl. No. 18/113,524.
Application 18/113,524 is a continuation of application No. 17/133,047, filed on Dec. 23, 2020, granted, now 11,616,761.
Application 17/133,047 is a continuation of application No. 15/705,516, filed on Sep. 15, 2017, granted, now 10,931,637, issued on Feb. 23, 2021.
Prior Publication US 2023/0208809 A1, Jun. 29, 2023
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); H04L 47/20 (2022.01); H04L 67/14 (2022.01)
CPC H04L 63/0245 (2013.01) [H04L 63/0263 (2013.01); H04L 47/20 (2013.01); H04L 63/145 (2013.01); H04L 63/20 (2013.01); H04L 67/14 (2013.01)] 19 Claims
OG exemplary drawing
 
1. A system, comprising:
a processor of a network device configured to:
receive process identification (ID) information from an endpoint (EP) agent executed on an EP device on an enterprise network, wherein the process ID information identifies a process that is associated with a network session, wherein the network session is an outbound network session or an inbound network session on the EP device on the enterprise network, wherein the process ID information indicates that it is a known process, an unknown process, or a known but unexpected process, wherein the process ID information is stored as a digest of a file name of a binary/executable associated with the process that initiated the network session, and wherein the EP agent selected the network session for punting to the network device for inspection;
monitor network communications associated with the network session at the network device to identify an application identification (APP ID) for the network session; and
perform an action based on a security policy using the process ID information and the APP ID, wherein the security policy includes an EP security policy, wherein the EP agent implements the EP security policy to selectively punt the network session to the network device on the enterprise network, wherein the network device includes a firewall, wherein the security policy includes a fine-grained firewall policy, and wherein the firewall implements the fine-grained firewall policy; and
a memory coupled to the processor and configured to provide the processor with instructions.