System and method for selectively grouping and managing program files

Abstract

A method in one embodiment includes determining a frequency range corresponding to a subset of a plurality of program files on a plurality of hosts in a network environment. The method also includes generating a first set of counts including a first count that represents an aggregate amount of program files in a first grouping of one or more program files of the subset, where each of the one or more program files of the first grouping includes a first value of a primary attribute. In specific embodiments, each program file is unknown. In further embodiments, the primary attribute is one of a plurality of file attributes provided in file metadata. Other specific embodiments include either blocking or allowing execution of each of the program files of the first grouping. More specific embodiments include determining a unique identifier corresponding to at least one program file of the first grouping.

1 .- 20 . (canceled) 
     
     
         21 . One or more non-transitory computer readable media that includes code for execution and when executed by a processor is operable to perform operations comprising:
 providing for display on a display device first information indicating a subset of program files, the subset of program files associated with a greylist of program files and stored on at least one host of a plurality of hosts in a network environment, wherein the first information includes one or more groupings of the subset of program files based on a first file attribute;   receiving an indication of a program file associated with a first grouping being selected;   providing for display on a display device second information indicating one or more identifiers of, respectively, one or more hosts with the program file stored therein; and   receiving an indication of an action being selected to apply a level of permission to the program file on each of the one or more hosts.   
     
     
         22 . The one or more non-transitory computer readable media of  claim 21 , wherein the level of permission includes one of allowing execution of the program file, quarantining the program file, or blocking execution of the program file. 
     
     
         23 . The one or more non-transitory computer readable media of  claim 21 , wherein each grouping of the one or more groupings is associated with a different value of the first file attribute. 
     
     
         24 . The one or more non-transitory computer readable media of  claim 23 , wherein the first file attribute is a vendor of the program file. 
     
     
         25 . The one or more non-transitory computer readable media of  claim 23 , wherein the first file attribute includes a product name and a version of the program file. 
     
     
         26 . The one or more non-transitory computer readable media of  claim 21 , wherein the plurality of hosts includes one of:
 (a) all hosts in the network environment,   (b) hosts located in one or more geographical locations associated with the network environment, or   (c) hosts related to one or more business units of an organization associated with the network environment.   
     
     
         27 . The one or more non-transitory computer readable media of  claim 21 , the processor being operable to perform further operations comprising:
 receiving an indication that the plurality of hosts was selected by a user.   
     
     
         28 . The one or more non-transitory computer readable media of  claim 21 , wherein the subset of program files is a proper subset of a plurality of program files in the network environment, wherein the plurality of program files includes another subset of program files classified as whitelist program files. 
     
     
         29 . The one or more non-transitory media of  claim 21 , the processor being operable to perform further operations comprising:
 providing for display on a display device a frequency range corresponding to the subset of program files, wherein the frequency range indicates a prevalence of each program file of the subset across the plurality of hosts.   
     
     
         30 . The one or more non-transitory computer readable media of  claim 21 , the processor being operable to perform further operations comprising:
 generating a set of counts, wherein each count represents an aggregate amount of program files associated with a respective grouping of the one or more groupings.   
     
     
         31 . An apparatus, comprising:
 a program file grouping module;   a memory element for storing a program file inventory of a plurality of program files associated with a plurality of hosts in a network environment; and   a processor operable to execute instructions associated with the program file grouping module and the memory element, including:
 providing for display on a display device first information indicating a subset of program files, the subset of program files associated with a greylist of program files and stored on at least one host of the plurality of hosts, wherein the first information includes one or more groupings of the subset of program files based on a first file attribute; 
 receiving an indication of a program file associated with a first grouping being selected; 
 providing for display on a display device second information indicating one or more identifiers of, respectively, one or more hosts with the program file stored therein; and 
 receiving an indication of an action being selected to apply a level of permission to the program file on each of the one or more hosts. 
   
     
     
         32 . The apparatus of  claim 31 , wherein the level of permission includes one of allowing execution of the program file, quarantining the program file, or blocking execution of the program file. 
     
     
         33 . The apparatus of  claim 31 , wherein each grouping of the one or more groupings is associated with a different value of the first file attribute. 
     
     
         34 . The apparatus of  claim 33 , wherein the first file attribute is a vendor of the program file. 
     
     
         35 . The apparatus of  claim 33 , wherein the first file attribute includes a product name and a version of the program file. 
     
     
         36 . The apparatus of  claim 31 , wherein the processor is operable to execute further instructions associated with the program file grouping module and the memory element, including:
 receiving an indication that the plurality of hosts was selected by a user.   
     
     
         37 . The apparatus of  claim 31 , wherein the processor is operable to execute further instructions associated with the program file grouping module and the memory element, including:
 providing for display on a display device a frequency range corresponding to the subset of program files, wherein the frequency range indicates a prevalence of each program file of the subset across the plurality of hosts.   
     
     
         38 . A method, comprising:
 providing for display on a display device first information indicating a subset of program files, the subset of program files associated with a greylist of program files and stored on at least one host of a plurality of hosts in a network environment, wherein the first information includes one or more groupings of the subset of program files based on a first file attribute;   receiving an indication of a program file associated with a first grouping being selected;   providing for display on a display device second information indicating one or more identifiers of, respectively, one or more hosts with the program file stored therein; and   receiving an indication of an action being selected to apply a level of permission to the program file on each of the one or more hosts.   
     
     
         39 . The method of  claim 38 , further comprising:
 providing for display on a display device a frequency range corresponding to the subset of program files, wherein the frequency range indicates a prevalence of each program file of the subset across the plurality of hosts.   
     
     
         40 . The method of  claim 38 , further comprising:
 generating a set of counts, wherein each count represents an aggregate amount of program files associated with a respective grouping of the one or more groupings.