中科微点-全球专利检索

  1. Login
  2. Sign Up

Search Results

75 records (took 0.036 seconds)

    SYSTEMS AND METHODS FOR INDICATING DEPLOYMENT OF APPLICATION FEATURES
    31.
    发明申请
    SYSTEMS AND METHODS FOR INDICATING DEPLOYMENT OF APPLICATION FEATURES 审中-公开

    公开(公告)号：US20190260819A1

    公开(公告)日：2019-08-22

    申请号：US16397434

    申请日：2019-04-29

    Applicant: SPLUNK INC.

    Inventor： Vijay Chauhan ,  Liu-Yuan Lai ,  Wenhui Yu ,  Luke Murphey ,  David Hazekamp

    IPC: H04L29/08

    Abstract: Provided are systems and methods for indicating deployment of application features. In one embodiment, a method is provided that includes determining available features of a current deployment of an application for receiving machine-generated data from one or more data sources of a data system, determining un-deployed features of the current deployment of the application, wherein the un-deployed features comprise one or more of the available features that is configured to use input data from a data source and wherein the input data is not available to the feature in the current deployment of the application, and causing display of a deployment graphical user interface (GUI) that comprises an indication of the un-deployed features.

    Systems and methods for indicating deployment of application features
    32.
    发明授权
    Systems and methods for indicating deployment of application features 有权

    公开(公告)号：US10320877B2

    公开(公告)日：2019-06-11

    申请号：US14690741

    申请日：2015-04-20

    Applicant: Splunk Inc.

    Inventor： Vijay Chauhan ,  Liu-Yuan Lai ,  Wenhui Yu ,  Luke Murphey ,  David Hazekamp

    IPC: H04L29/08

    Abstract: Provided are systems and methods for indicating deployment of application features. In one embodiment, a method is provided that includes determining available features of a current deployment of an application for receiving machine-generated data from one or more data sources of a data system, determining un-deployed features of the current deployment of the application, wherein the un-deployed features comprise one or more of the available features that is configured to use input data from a data source and wherein the input data is not available to the feature in the current deployment of the application, and causing display of a deployment graphical user interface (GUI) that comprises an indication of the un-deployed features.

    Detection of potential security threats based on categorical patterns
    33.
    发明授权
    Detection of potential security threats based on categorical patterns 有权

    公开(公告)号：US10091227B2

    公开(公告)日：2018-10-02

    申请号：US15339955

    申请日：2016-11-01

    Applicant: Splunk Inc.

    Inventor： Munawar Monzy Merza ,  John Coates ,  James M Hansen ,  Lucas Murphey ,  David Hazekamp ,  Michael Kinsley ,  Alexander Raitz

    IPC: H04L29/06 ,  G06F21/55 ,  G06F17/30

    Abstract: A metric value is determined for each event in a set of events that characterizes a computational communication or object. For example, a metric value could include a length of a URL or agent string in the event. A subset criterion is generated, such that metric values within the subset are relatively separated from a population's center (e.g., within a distribution tail). Application of the criterion to metric values produces a subset. A representation of the subset is presented in an interactive dashboard. The representation can include unique values in the subset and counts of corresponding event occurrences. Clients can select particular elements in the representation to cause more detail to be presented with respect to individual events corresponding to specific values in the subset. Thus, clients can use their knowledge system operations and observance of value frequencies and underlying events to identify anomalous metric values and potential security threats.

    Identifying possible security threats using event group summaries
    35.
    发明授权
    Identifying possible security threats using event group summaries 有权
    使用事件组摘要识别可能的安全威胁

    公开(公告)号：US09596252B2

    公开(公告)日：2017-03-14

    申请号：US15056999

    申请日：2016-02-29

    Applicant: Splunk Inc.

    Inventor： John Coates ,  Lucas Murphey ,  David Hazekamp ,  James Hansen

    IPC: G06F11/00 ,  H04L29/06 ,  G06F21/55

    CPC classification number: H04L63/1433 ,  G06F17/30598 ,  G06F21/554 ,  G06F2221/034 ,  G06F2221/2151 ,  H04L63/14 ,  H04L63/1408 ,  H04L63/1416 ,  H04L63/20

    Abstract: A disclosed computer-implemented method includes receiving and indexing the raw data. Indexing includes dividing the raw data into time stamped searchable events that include information relating to computer or network security. Store the indexed data in an indexed data store and extract values from a field in the indexed data using a schema. Search the extracted field values for the security information. Determine a group of security events using the security information. Each security event includes a field value specified by a criteria. Present a graphical interface (GI) including a summary of the group of security events, other summaries of security events, and a remove element (associated with the summary). Receive input corresponding to an interaction of the remove element. Interacting with the remove element causes the summary to be removed from the GI. Update the GI to remove the summary from the GI.

    Abstract translation: 所公开的计算机实现的方法包括接收和索引原始数据。 索引包括将原始数据划分为包含与计算机或网络安全相关的信息的时间戳搜索事件。 将索引数据存储在索引数据存储中，并使用模式从索引数据中的字段中提取值。 搜索提取的字段值以获取安全信息。 使用安全信息确定一组安全事件。 每个安全事件都包括由条件指定的字段值。 提供包括安全事件组的摘要，安全事件的其他摘要和删除元素（与摘要相关联）的图形界面（GI）。 接收与删除元素的交互相对应的输入。 与删除元素进行交互会导致摘要从GI中移除。 更新GI以从GI中删除摘要。

    Creating Timeline Views of Information Technology Event Investigations
    36.
    发明申请
    Creating Timeline Views of Information Technology Event Investigations 有权
    创建信息技术事件调查的时间表视图

    公开(公告)号：US20170048264A1

    公开(公告)日：2017-02-16

    申请号：US15339952

    申请日：2016-11-01

    Applicant: Splunk Inc,

    Inventor： Vijay Chauhan ,  Cary Noel ,  Wenhui Yu ,  Luke Murphey ,  Alexander Raitz ,  David Hazekamp

    IPC: H04L29/06 ,  G06F17/30 ,  G06F21/62 ,  G06F17/24 ,  G06F3/0484

    CPC classification number: H04L63/1425 ,  G06F3/0484 ,  G06F17/241 ,  G06F17/30551 ,  G06F17/30554 ,  G06F17/30557 ,  G06F21/629 ,  G06F2221/2151 ,  H04L43/06

    Abstract: Techniques and mechanisms are disclosed that enable network security analysts and other users to efficiently conduct network security investigations and to produce useful representations of investigation results. As used herein, a network security investigation generally refers to an analysis by an analyst (or team of analysts) of one or more detected network events that may pose internal and/or external threats to a computer network under management. A network security application provides various interfaces that enable users to create investigation timelines, where the investigation timelines display a collection of events related to a particular network security investigation. A network security application further provides functionality to monitor and log user interactions with the network security application, where particular logged user interactions may also be added to one or more investigation timelines.

    Abstract translation: 公开了技术和机制，使网络安全分析师和其他用户有效地进行网络安全调查并产生调查结果的有用表示。 如本文所使用的，网络安全调查通常是指分析者（或分析师小组）对可能对管理的计算机网络造成内部和/或外部威胁的一个或多个检测到的网络事件的分析。 网络安全应用程序提供各种接口，使用户能够创建调查时间表，其中调查时间表显示与特定网络安全调查相关的事件的集合。 网络安全应用程序还提供监视和记录与网络安全应用程序的用户交互的功能，其中特定记录的用户交互也可以被添加到一个或多个调查时间线。

    Assigning scores to objects based on search query results
    37.
    发明授权
    Assigning scores to objects based on search query results 有权
    基于搜索查询结果为对象分配分数

    公开(公告)号：US09251221B1

    公开(公告)日：2016-02-02

    申请号：US14447995

    申请日：2014-07-31

    Applicant: Splunk Inc.

    Inventor： Lucas Murphey ,  David Hazekamp

    IPC: G06F15/173 ,  G06F17/30

    CPC classification number: G06F17/3053 ,  G06F17/30303 ,  G06F17/30312 ,  G06F17/30368 ,  G06F17/3051 ,  G06F17/30551 ,  G06F17/30864

    Abstract: Systems and methods for assigning scores to objects based on evaluating triggering conditions applied to datasets produced by search queries in data aggregation and analysis systems. An example method may comprise: executing, by one or more processing devices, a search query to produce a dataset comprising one or more data items derived from source data; and responsive to determining that at least a portion of the dataset satisfies a triggering condition, modifying a score assigned to an object to which the portion of the dataset pertains.

    Abstract translation: 根据对数据汇总和分析系统中搜索查询产生的数据集的触发条件进行评估，为对象分配分数的系统和方法。 示例性方法可以包括：由一个或多个处理设备执行搜索查询以产生包括从源数据导出的一个或多个数据项的数据集; 并且响应于确定所述数据集的至少一部分满足触发条件，修改分配给所述数据集的所述部分所属对象的得分。

    INVESTIGATIVE AND DYNAMIC DETECTION OF POTENTIAL SECURITY-THREAT INDICATORS FROM EVENTS IN BIG DATA
    38.
    发明申请
    INVESTIGATIVE AND DYNAMIC DETECTION OF POTENTIAL SECURITY-THREAT INDICATORS FROM EVENTS IN BIG DATA 有权
    来自大数据事件的潜在安全威胁指标的调查和动态检测

    公开(公告)号：US20130326620A1

    公开(公告)日：2013-12-05

    申请号：US13956252

    申请日：2013-07-31

    Applicant: Splunk Inc.

    Inventor： Munawar Monzy Merza ,  John Coates ,  James Hansen ,  Lucas Murphey ,  David Hazekamp ,  Michael Kinsley ,  Alexander Raitz

    IPC: H04L29/06

    CPC classification number: H04L63/1425 ,  G06F17/30551 ,  G06F21/552 ,  G06F2221/2151 ,  H04L63/1408 ,  H04L63/1416

    Abstract: A metric value is determined for each event in a set of events that characterizes a computational communication or object. For example, a metric value could include a length of a URL or agent string in the event. A subset criterion is generated, such that metric values within the subset are relatively separated from a population's center (e.g., within a distribution tail). Application of the criterion to metric values produces a subset. A representation of the subset is presented in an interactive dashboard. The representation can include unique values in the subset and counts of corresponding event occurrences. Clients can select particular elements in the representation to cause more detail to be presented with respect to individual events corresponding to specific values in the subset. Thus, clients can use their knowledge system operations and observance of value frequencies and underlying events to identify anomalous metric values and potential security threats.

    Abstract translation: 为表征计算通信或对象的一组事件中的每个事件确定度量值。 例如，度量值可以包括事件中的URL或代理字符串的长度。 生成子集标准，使得子集内的度量值与群体的中心（例如，分布尾部）相对分开。 将标准应用于度量值产生一个子集。 该子集的表示呈现在交互式仪表板中。 该表示可以包括子集中的唯一值和相应事件发生的计数。 客户端可以选择表示中的特定元素，以便相对于子集中的特定值对应的各个事件来呈现更多的细节。 因此，客户可以使用他们的知识系统操作和遵守价值频率和基础事件来识别异常度量值和潜在的安全威胁。

    BLACKLISTING AND WHITELISTING OF SECURITY-RELATED EVENTS
    39.
    发明申请
    BLACKLISTING AND WHITELISTING OF SECURITY-RELATED EVENTS 有权

    公开(公告)号：US20130318604A1

    公开(公告)日：2013-11-28

    申请号：US13956285

    申请日：2013-07-31

    Applicant: Splunk Inc.

    Inventor： John Coates ,  Lucas Murphey ,  David Hazekamp ,  James Hansen

    IPC: H04L29/06

    CPC classification number: H04L63/1433 ,  G06F17/30598 ,  G06F21/554 ,  G06F2221/034 ,  G06F2221/2151 ,  H04L63/14 ,  H04L63/1408 ,  H04L63/1416 ,  H04L63/20

    Abstract: A disclosed computer-implemented method includes receiving and indexing the raw data. Indexing includes dividing the raw data into time stamped searchable events that include information relating to computer or network security. Store the indexed data in an indexed data store and extract values from a field in the indexed data using a schema. Search the extracted field values for the security information. Determine a group of security events using the security information. Each security event includes a field value specified by a criteria. Present a graphical interface (GI) including a summary of the group of security events, other summaries of security events, and a remove element (associated with the summary). Receive input corresponding to an interaction of the remove element. Interacting with the remove element causes the summary to be removed from the GI. Update the GI to remove the summary from the GI.

Patent Agency Ranking