公开(公告)号：US20180063167A1

公开(公告)日：2018-03-01

申请号：US15253438

申请日：2016-08-31

Applicant: SAP SE

Inventor： Marco Rodeck ,  Harish Mehta ,  Hartwig Seifert ,  Thomas Kunz ,  Eugen Pritzkau ,  Wei-Guo Peng ,  Lin Luo ,  Rita Merkel ,  Florian Chrosziel ,  Jona Hassforther ,  Thorsten Menke

IPC: H04L29/06

CPC classification number: H04L63/1416 ,  H04L63/083 ,  H04L63/108 ,  H04L63/1425 ,  H04L63/1483 ,  H04W12/00503

Abstract: Subnet information and location information is received from a database by a smart data streaming engine (SDS). A particular subnet of the subnet information is associated with a particular location of the location information by a globally unique location ID value. Log event data received in the SDS is normalized as normalized log event data. The normalized log event data is enriched with subnet and location information as enriched log event data and written into a log event persistence in the database. A subnet ID value retrieved from an enriched log event of the enriched log event data is used by an enterprise threat detection (ETD) system to determine a location associated with the enriched log event using a location ID value associated with the subnet ID.

公开(公告)号：US11252168B2

公开(公告)日：2022-02-15

申请号：US16125256

申请日：2018-09-07

Applicant: SAP SE

Inventor： Harish Mehta ,  Hartwig Seifert ,  Thomas Kunz ,  Anne Jacobi ,  Marco Rodeck ,  Florian Kraemer ,  Bjoern Brencher ,  Nan Zhang

IPC: H04L29/06

Abstract: A transfer of master data is executed in a backend computing system. The master data includes user data and system data. The transfer of master data includes receiving user data associated with a particular user identifier in the backend computing system, transferring the received user data to an event stream processor, receiving system data associated with a particular log providing computing system in the backend computing system, transferring the received user data to the event stream processor, and executing a transfer of log data associated with logs of computing systems connected to the backend computing system.

公开(公告)号：US10681064B2

公开(公告)日：2020-06-09

申请号：US15847450

申请日：2017-12-19

Applicant: SAP SE

Inventor： Wei-Guo Peng ,  Lin Luo ,  Eugen Pritzkau ,  Hartwig Seifert ,  Harish Mehta ,  Nan Zhang ,  Thorsten Menke ,  Jona Hassforther ,  Rita Merkel ,  Florian Chrosziel ,  Kathrin Nos ,  Marco Rodeck ,  Thomas Kunz

IPC: H04L29/06 ,  H04L12/24 ,  H04L12/26 ,  G06T11/20 ,  G06F16/901

Abstract: A filter is selected from one or more filters defined for an ETD Network Graph. Events are fetched from the selected log files based on the selected filter and entities identified based on the fetched Events. Relationships are determined between the identified entities, and the determined relationships and identified entities are displayed in the ETD Network Graph. An identified entity is selected to filter data in an ETD Event Series Chart. An Event is selected in the ETD Event Series Chart to display Event Attributes in an Event Attribute Dialog. An Event Attribute is selected in the Event Attribute Dialog to filter Events in the ETD Event Series Chart.

公开(公告)号：US10542016B2

公开(公告)日：2020-01-21

申请号：US15253438

申请日：2016-08-31

Applicant: SAP SE

Inventor： Marco Rodeck ,  Harish Mehta ,  Hartwig Seifert ,  Thomas Kunz ,  Eugen Pritzkau ,  Wei-Guo Peng ,  Lin Luo ,  Rita Merkel ,  Florian Chrosziel ,  Jona Hassforther ,  Thorsten Menke

IPC: H04L29/06

Abstract: Subnet information and location information is received from a database by a smart data streaming engine (SDS). A particular subnet of the subnet information is associated with a particular location of the location information by a globally unique location ID value. Log event data received in the SDS is normalized as normalized log event data. The normalized log event data is enriched with subnet and location information as enriched log event data and written into a log event persistence in the database. A subnet ID value retrieved from an enriched log event of the enriched log event data is used by an enterprise threat detection (ETD) system to determine a location associated with the enriched log event using a location ID value associated with the subnet ID.

公开(公告)号：US10536476B2

公开(公告)日：2020-01-14

申请号：US15216201

申请日：2016-07-21

Applicant: SAP SE

Inventor： Eugen Pritzkau ,  Kathrin Nos ,  Marco Rodeck ,  Florian Chrosziel ,  Jona Hassforther ,  Rita Merkel ,  Thorsten Menke ,  Thomas Kunz ,  Hartwig Seifert ,  Harish Mehta ,  Wei-Guo Peng ,  Lin Luo ,  Nan Zhang ,  Hristina Dinkova

IPC: H04L29/06 ,  H04L29/08

Abstract: A computer-implemented method generates a trigger registration for a selected triggering type. The generated trigger registration is stored in a triggering persistency. A received event from an event persistency is analyzed and data associated with the analyzed event is compared with the triggering persistency. Based on the comparison and using a pattern execution framework, an enterprise threat detection (ETD) pattern is processed to perform actions responsive to the received event.

公开(公告)号：US10530794B2

公开(公告)日：2020-01-07

申请号：US15639907

申请日：2017-06-30

Applicant: SAP SE

Inventor： Eugen Pritzkau ,  Joscha Philipp Bohn ,  Daniel Kartmann ,  Wei-Guo Peng ,  Hristina Dinkova ,  Lin Luo ,  Thomas Kunz ,  Marco Rodeck ,  Hartwig Seifert ,  Harish Mehta ,  Nan Zhang ,  Rita Merkel ,  Florian Chrosziel

IPC: H04L29/06 ,  G06F16/33 ,  G06F3/0482

Abstract: Search results are received from an initiated free text search of log data from one or more logs, where the free text is performed using search terms entered into a free text search graphical user interface. A set of at least one search result is selected from the search results containing an event desired to be identified in a completed enterprise threat detection (ETD) pattern. A forensic lab application is rendered to complete an ETD pattern. An event filter is added for an event type based on normalized log data to a path. A relative ETD pattern time range is set and an ETD pattern is completed based on the added event filter.

公开(公告)号：US10482241B2

公开(公告)日：2019-11-19

申请号：US15246053

申请日：2016-08-24

Applicant: SAP SE

Inventor： Wei-Guo Peng ,  Eugen Pritzkau ,  Lin Luo ,  Hartwig Seifert ,  Marco Rodeck ,  Thomas Kunz ,  Harish Mehta ,  Florian Chrosziel ,  Rita Merkel ,  Jona Hassforther ,  Thorsten Menke ,  Nan Zhang ,  Kathrin Nos ,  Hristina Dinkova

IPC: G06F3/048 ,  G06F21/55

Abstract: A path associated with a set of selected log data is defined. An indication is received on a graphical user interface (GUI) to generate a bubblegram associated with the path, wherein the bubblegram comprises one or more bubbles, each bubble representing a particular dimension associated with the selected path. The one or more bubbles are rendered on the GUI according to a performed ranking of the one or more bubbles. A bubble is selected to generate a filter for the path based on the dimension associated with the bubble. A subsequent bubblegram is rendered based on a narrowed set of the selected log data.

公开(公告)号：US10075462B2

公开(公告)日：2018-09-11

申请号：US14978984

申请日：2015-12-22

Applicant: SAP SE

Inventor： Harish Mehta ,  Hartwig Seifert ,  Thomas Kunz ,  Anne Jacobi ,  Marco Rodeck ,  Florian Kraemer ,  Björn Brencher ,  Nan Zhang

IPC: H04L29/06

CPC classification number: H04L63/1425 ,  H04L63/1416

Abstract: A transfer of master data is executed in a backend computing system. The master data includes user data and system data. The transfer of master data includes receiving user data associated with a particular user identifier in the backend computing system, transferring the received user data to an event stream processor, receiving system data associated with a particular log providing computing system in the backend computing system, transferring the received user data to the event stream processor, and executing a transfer of log data associated with logs of computing systems connected to the backend computing system.

公开(公告)号：US20180059876A1

公开(公告)日：2018-03-01

申请号：US15246053

申请日：2016-08-24

Applicant: SAP SE

Inventor： Wei-Guo Peng ,  Eugen Pritzkau ,  Lin Luo ,  Hartwig Seifert ,  Marco Rodeck ,  Thomas Kunz ,  Harish Mehta ,  Florian Chrosziel ,  Rita Merkel ,  Jona Hassforther ,  Thorsten Menke ,  Nan Zhang ,  Kathrin Nos ,  Hristina Dinkova

IPC: G06F3/0482 ,  G06F3/0484

CPC classification number: G06F21/552 ,  G06F16/248 ,  G06F16/26 ,  G06F21/00

Abstract: A path associated with a set of selected log data is defined. An indication is received on a graphical user interface (GUI) to generate a bubblegram associated with the path, wherein the bubblegram comprises one or more bubbles, each bubble representing a particular dimension associated with the selected path. The one or more bubbles are rendered on the GUI according to a performed ranking of the one or more bubbles. A bubble is selected to generate a filter for the path based on the dimension associated with the bubble. A subsequent bubblegram is rendered based on a narrowed set of the selected log data.

公开(公告)号：US20180027002A1

公开(公告)日：2018-01-25

申请号：US15216046

申请日：2016-07-21

Applicant: SAP SE

Inventor： Marco Rodeck ,  Florian Chrosziel ,  Jona Hassforther ,  Rita Merkel ,  Thorsten Menke ,  Thomas Kunz ,  Hartwig Seifert ,  Harish Mehta ,  Wei-Guo Peng ,  Lin Luo ,  Eugen Pritzkau

IPC: H04L29/06 ,  G06F17/30 ,  G06F3/0482 ,  H04L29/08 ,  H04L12/26

CPC classification number: H04L63/1425 ,  G06F16/287 ,  H04L41/142 ,  H04L43/028 ,  H04L43/045 ,  H04L43/16 ,  H04L63/1433 ,  H04L67/02 ,  H04L67/146 ,  H04L67/24

Abstract: A selection of data types is defined from available log data for an evaluation of events associated with an entity. One or more evaluations are defined that are associated with the entity. Reference data is generated from the selection of data types based on the one or more defined evaluations. The one or more evaluations are grouped into a pattern. A visualization is initiated for display in a graphical user interface of a normalized score for the entity for each evaluation associated with the pattern against a determined anomaly threshold.