中科微点-全球专利检索

  1. Login
  2. Sign Up

Search Results

36 records (took 0.021 seconds)

    Automatic creation and updating of event group summaries
    21.
    发明授权
    Automatic creation and updating of event group summaries 有权

    公开(公告)号：US12034759B2

    公开(公告)日：2024-07-09

    申请号：US17507698

    申请日：2021-10-21

    Applicant: SPLUNK INC.

    Inventor： John Coates ,  Lucas Murphey ,  David Hazekamp ,  James Hansen

    IPC: H04L9/40 ,  G06F16/28 ,  G06F21/55

    CPC classification number: H04L63/1433 ,  G06F16/285 ,  G06F21/554 ,  H04L63/14 ,  H04L63/1408 ,  H04L63/1416 ,  G06F2221/034 ,  G06F2221/2151 ,  H04L63/20

    Abstract: A disclosed computer-implemented method includes receiving and indexing the raw data. Indexing includes dividing the raw data into time stamped searchable events that include information relating to computer or network security. Store the indexed data in an indexed data store and extract values from a field in the indexed data using a schema. Search the extracted field values for the security information. Determine a group of security events using the security information. Each security event includes a field value specified by a criteria. Present a graphical interface (GI) including a summary of the group of security events, other summaries of security events, and a remove element (associated with the summary). Receive input corresponding to an interaction of the remove element. Interacting with the remove element causes the summary to be removed from the GI. Update the GI to remove the summary from the GI.

    Security threat detection based o patterns in machine data events
    22.
    发明授权
    Security threat detection based o patterns in machine data events 有权

    公开(公告)号：US10567412B2

    公开(公告)日：2020-02-18

    申请号：US16100147

    申请日：2018-08-09

    Applicant: SPLUNK INC.

    Inventor： Munawar Monzy Merza ,  John Coates ,  James M Hansen ,  Lucas Murphey ,  David Hazekamp ,  Michael Kinsley ,  Alexander Raitz

    IPC: H04L29/06 ,  G06F21/55 ,  G06F16/2458

    Abstract: A metric value is determined for each event in a set of events that characterizes a computational communication or object. For example, a metric value could include a length of a URL or agent string in the event. A subset criterion is generated, such that metric values within the subset are relatively separated from a population's center (e.g., within a distribution tail). Application of the criterion to metric values produces a subset. A representation of the subset is presented in an interactive dashboard. The representation can include unique values in the subset and counts of corresponding event occurrences. Clients can select particular elements in the representation to cause more detail to be presented with respect to individual events corresponding to specific values in the subset. Thus, clients can use their knowledge system operations and observance of value frequencies and underlying events to identify anomalous metric values and potential security threats.

    Investigative and dynamic detection of potential security-threat indicators from events in big data
    25.
    发明授权
    Investigative and dynamic detection of potential security-threat indicators from events in big data 有权
    从大数据中的事件调查和动态检测潜在的安全威胁指标

    公开(公告)号：US09215240B2

    公开(公告)日：2015-12-15

    申请号：US13956252

    申请日：2013-07-31

    Applicant: Splunk Inc.

    Inventor： Munawar Monzy Merza ,  John Coates ,  James Hansen ,  Lucas Murphey ,  David Hazekamp ,  Michael Kinsley ,  Alexander Raitz

    IPC: H04L29/06 ,  G06F21/55

    CPC classification number: H04L63/1425 ,  G06F17/30551 ,  G06F21/552 ,  G06F2221/2151 ,  H04L63/1408 ,  H04L63/1416

    Abstract: A metric value is determined for each event in a set of events that characterizes a computational communication or object. For example, a metric value could include a length of a URL or agent string in the event. A subset criterion is generated, such that metric values within the subset are relatively separated from a population's center (e.g., within a distribution tail). Application of the criterion to metric values produces a subset. A representation of the subset is presented in an interactive dashboard. The representation can include unique values in the subset and counts of corresponding event occurrences. Clients can select particular elements in the representation to cause more detail to be presented with respect to individual events corresponding to specific values in the subset. Thus, clients can use their knowledge system operations and observance of value frequencies and underlying events to identify anomalous metric values and potential security threats.

    Abstract translation: 为表征计算通信或对象的一组事件中的每个事件确定度量值。 例如，度量值可以包括事件中的URL或代理字符串的长度。 生成子集标准，使得子集内的度量值与群体的中心（例如，分布尾部）相对分开。 将标准应用于度量值产生一个子集。 该子集的表示呈现在交互式仪表板中。 该表示可以包括子集中的唯一值和相应事件发生的计数。 客户端可以选择表示中的特定元素，以便相对于子集中的特定值对应的各个事件来呈现更多的细节。 因此，客户可以使用他们的知识系统操作和遵守价值频率和基础事件来识别异常度量值和潜在的安全威胁。

    AUTOMATIC CREATION AND UPDATING OF EVENT GROUP SUMMARIES
    26.
    发明公开
    AUTOMATIC CREATION AND UPDATING OF EVENT GROUP SUMMARIES 审中-公开

    公开(公告)号：US20240333752A1

    公开(公告)日：2024-10-03

    申请号：US18740314

    申请日：2024-06-11

    Applicant: SPLUNK INC.

    Inventor： John Coates ,  Lucas Murphey ,  David Hazekamp ,  James Hansen

    IPC: H04L9/40 ,  G06F16/28 ,  G06F21/55

    CPC classification number: H04L63/1433 ,  G06F16/285 ,  G06F21/554 ,  H04L63/14 ,  H04L63/1408 ,  H04L63/1416 ,  G06F2221/034 ,  G06F2221/2151 ,  H04L63/20

    Abstract: A disclosed computer-implemented method includes receiving and indexing the raw data. Indexing includes dividing the raw data into time stamped searchable events that include information relating to computer or network security. Store the indexed data in an indexed data store and extract values from a field in the indexed data using a schema. Search the extracted field values for the security information. Determine a group of security events using the security information. Each security event includes a field value specified by a criteria. Present a graphical interface (GI) including a summary of the group of security events, other summaries of security events, and a remove element (associated with the summary). Receive input corresponding to an interaction of the remove element. Interacting with the remove element causes the summary to be removed from the GI. Update the GI to remove the summary from the Gl.

    Graphical display suppressing events indicating security threats in an information technology system
    27.
    发明授权
    Graphical display suppressing events indicating security threats in an information technology system 有权

    公开(公告)号：US11178167B2

    公开(公告)日：2021-11-16

    申请号：US16526354

    申请日：2019-07-30

    Applicant: SPLUNK INC.

    Inventor： John Coates ,  Lucas Murphey ,  David Hazekamp ,  James Hansen

    IPC: H04L29/06 ,  G06F16/28 ,  G06F21/55

    Abstract: A disclosed computer-implemented method includes receiving and indexing the raw data. Indexing includes dividing the raw data into time stamped searchable events that include information relating to computer or network security. Store the indexed data in an indexed data store and extract values from a field in the indexed data using a schema. Search the extracted field values for the security information. Determine a group of security events using the security information. Each security event includes a field value specified by a criteria. Present a graphical interface (GI) including a summary of the group of security events, other summaries of security events, and a remove element (associated with the summary). Receive input corresponding to an interaction of the remove element. Interacting with the remove element causes the summary to be removed from the GI. Update the GI to remove the summary from the GI.

    Detection of potential security threats in machine data based on pattern detection
    28.
    发明授权
    Detection of potential security threats in machine data based on pattern detection 有权

    公开(公告)号：US11134094B2

    公开(公告)日：2021-09-28

    申请号：US16777544

    申请日：2020-01-30

    Applicant: SPLUNK INC.

    Inventor： Munawar Monzy Merza ,  John Coates ,  James M Hansen ,  Lucas Murphey ,  David Hazekamp ,  Michael Kinsley ,  Alexander Raitz

    IPC: H04L29/06 ,  G06F21/55 ,  G06F16/2458

    Abstract: A metric value is determined for each event in a set of events that characterizes a computational communication or object. For example, a metric value could include a length of a URL or agent string in the event. A subset criterion is generated, such that metric values within the subset are relatively separated from a population's center (e.g., within a distribution tail). Application of the criterion to metric values produces a subset. A representation of the subset is presented in an interactive dashboard. The representation can include unique values in the subset and counts of corresponding event occurrences. Clients can select particular elements in the representation to cause more detail to be presented with respect to individual events corresponding to specific values in the subset. Thus, clients can use their knowledge system operations and observance of value frequencies and underlying events to identify anomalous metric values and potential security threats.

    GRAPHICAL DISPLAY SUPPRESSING EVENTS INDICATING SECURITY THREATS IN AN INFORMATION TECHNOLOGY SYSTEM
    29.
    发明申请
    GRAPHICAL DISPLAY SUPPRESSING EVENTS INDICATING SECURITY THREATS IN AN INFORMATION TECHNOLOGY SYSTEM 审中-公开

    公开(公告)号：US20190356690A1

    公开(公告)日：2019-11-21

    申请号：US16526354

    申请日：2019-07-30

    Applicant: SPLUNK INC.

    Inventor： John Coates ,  Lucas Murphey ,  David Hazekamp ,  James Hansen

    IPC: H04L29/06 ,  G06F21/55 ,  G06F16/28

    Abstract: A disclosed computer-implemented method includes receiving and indexing the raw data. Indexing includes dividing the raw data into time stamped searchable events that include information relating to computer or network security. Store the indexed data in an indexed data store and extract values from a field in the indexed data using a schema. Search the extracted field values for the security information. Determine a group of security events using the security information. Each security event includes a field value specified by a criteria. Present a graphical interface (GI) including a summary of the group of security events, other summaries of security events, and a remove element (associated with the summary). Receive input corresponding to an interaction of the remove element. Interacting with the remove element causes the summary to be removed from the GI. Update the GI to remove the summary from the GI.

Patent Agency Ranking