公开(公告)号：US20180069887A1

公开(公告)日：2018-03-08

申请号：US15799906

申请日：2017-10-31

Applicant: Splunk Inc,

Inventor： Vijay Chauhan ,  Cary Noel ,  Wenhui Yu ,  Luke Murphey ,  Alexander Raitz ,  David Hazekamp

IPC: H04L29/06 ,  G06F21/62 ,  G06F17/30 ,  H04L12/26 ,  G06F3/0484 ,  G06F17/24

CPC classification number: H04L63/1425 ,  G06F3/0484 ,  G06F17/241 ,  G06F17/30551 ,  G06F17/30554 ,  G06F17/30557 ,  G06F21/629 ,  G06F2221/2151 ,  H04L43/026 ,  H04L43/06

Abstract: Techniques and mechanisms are disclosed that enable network security analysts and other users to efficiently conduct network security investigations and to produce useful representations of investigation results. As used herein, a network security investigation generally refers to an analysis by an analyst (or team of analysts) of one or more detected network events that may pose internal and/or external threats to a computer network under management. A network security application provides various interfaces that enable users to create investigation timelines, where the investigation timelines display a collection of events related to a particular network security investigation. A network security application further provides functionality to monitor and log user interactions with the network security application, where particular logged user interactions may also be added to one or more investigation timelines.

公开(公告)号：US20180069886A1

公开(公告)日：2018-03-08

申请号：US15799167

申请日：2017-10-31

Applicant: Splunk Inc.

Inventor： Vijay Chauhan ,  Devendra M. Badhani ,  Luke K. Murphey ,  David Hazekamp

IPC: H04L29/06

CPC classification number: H04L63/1425 ,  H04L63/0218 ,  H04L63/0236

Abstract: The disclosed embodiments provide a system that facilitates the processing of network data. During operation, the system provides a risk-identification mechanism for identifying a security risk from time-series event data generated from network packets captured by one or more remote capture agents distributed across a network. Next, the system provides a capture trigger for generating additional time-series event data from the network packets on the one or more remote capture agents based on the security risk, wherein the additional time-series event data includes one or more event attributes.

公开(公告)号：US09596253B2

公开(公告)日：2017-03-14

申请号：US14528918

申请日：2014-10-30

Applicant: Splunk Inc.

Inventor： Vijay Chauhan ,  Devendra M. Badhani ,  Luke K. Murphey ,  David Hazekamp

IPC: H04L29/06

CPC classification number: H04L63/1425 ,  H04L63/0218 ,  H04L63/0236

Abstract: The disclosed embodiments provide a system that facilitates the processing of network data. During operation, the system provides a risk-identification mechanism for identifying a security risk from time-series event data generated from network packets captured by one or more remote capture agents distributed across a network. Next, the system provides a capture trigger for generating additional time-series event data from the network packets on the one or more remote capture agents based on the security risk, wherein the additional time-series event data includes one or more event attributes.

Abstract translation: 所公开的实施例提供了有助于网络数据的处理的系统。 在运行期间，系统提供一种风险识别机制，用于从由分布在网络上的一个或多个远程捕获代理捕获的网络分组产生的时间序列事件数据中识别安全风险。 接下来，系统提供捕获触发器，用于基于安全风险从一个或多个远程捕获代理上的网络分组生成附加的时间序列事件数据，其中附加的时间序列事件数据包括一个或多个事件属性。

公开(公告)号：US20160147769A1

公开(公告)日：2016-05-26

申请号：US14977432

申请日：2015-12-21

Applicant: Splunk Inc.

Inventor： Lucas Murphey ,  David Hazekamp

IPC: G06F17/30

CPC classification number: G06F16/24578 ,  G06F16/215 ,  G06F16/22 ,  G06F16/2358 ,  G06F16/24565 ,  G06F16/2477 ,  G06F16/951

Abstract: Systems and methods for assigning scores to objects based on evaluating triggering conditions applied to datasets produced by search queries in data aggregation and analysis systems. An example method may comprise: executing, by one or more processing devices, a search query to produce a dataset comprising one or more data items derived from source data; and responsive to determining that at least a portion of the dataset satisfies a triggering condition, modifying a score assigned to an object to which the portion of the dataset pertains.

Abstract translation: 根据对数据汇总和分析系统中搜索查询产生的数据集的触发条件进行评估，为对象分配分数的系统和方法。 示例性方法可以包括：由一个或多个处理设备执行搜索查询以产生包括从源数据导出的一个或多个数据项的数据集; 并且响应于确定所述数据集的至少一部分满足触发条件，修改分配给所述数据集的所述部分所属对象的得分。

公开(公告)号：US09215240B2

公开(公告)日：2015-12-15

申请号：US13956252

申请日：2013-07-31

Applicant: Splunk Inc.

Inventor： Munawar Monzy Merza ,  John Coates ,  James Hansen ,  Lucas Murphey ,  David Hazekamp ,  Michael Kinsley ,  Alexander Raitz

IPC: H04L29/06 ,  G06F21/55

CPC classification number: H04L63/1425 ,  G06F17/30551 ,  G06F21/552 ,  G06F2221/2151 ,  H04L63/1408 ,  H04L63/1416

Abstract: A metric value is determined for each event in a set of events that characterizes a computational communication or object. For example, a metric value could include a length of a URL or agent string in the event. A subset criterion is generated, such that metric values within the subset are relatively separated from a population's center (e.g., within a distribution tail). Application of the criterion to metric values produces a subset. A representation of the subset is presented in an interactive dashboard. The representation can include unique values in the subset and counts of corresponding event occurrences. Clients can select particular elements in the representation to cause more detail to be presented with respect to individual events corresponding to specific values in the subset. Thus, clients can use their knowledge system operations and observance of value frequencies and underlying events to identify anomalous metric values and potential security threats.

Abstract translation: 为表征计算通信或对象的一组事件中的每个事件确定度量值。 例如，度量值可以包括事件中的URL或代理字符串的长度。 生成子集标准，使得子集内的度量值与群体的中心（例如，分布尾部）相对分开。 将标准应用于度量值产生一个子集。 该子集的表示呈现在交互式仪表板中。 该表示可以包括子集中的唯一值和相应事件发生的计数。 客户端可以选择表示中的特定元素，以便相对于子集中的特定值对应的各个事件来呈现更多的细节。 因此，客户可以使用他们的知识系统操作和遵守价值频率和基础事件来识别异常度量值和潜在的安全威胁。