公开(公告)号：US20190268361A1

公开(公告)日：2019-08-29

申请号：US16281277

申请日：2019-02-21

申请人： CrowdStrike, Inc.

发明人： David Blewett ,  Brian Concannon ,  John Lee ,  Kris Merritt ,  Andrew Roden

IPC分类号： H04L29/06 ,  G06F17/27 ,  G06F16/248 ,  G06F9/451

摘要： Example techniques herein filter and classify security-relevant events from monitored computing devices. A control unit can receive event records of various types, each event record associated with a monitored device. The control unit can provide, for each event record matching a corresponding pattern of a pattern set associated with the respective event type, a respective match record. Each match record can include an identifier of the corresponding pattern and data of the respective event record. The control unit can provide, for each match record satisfying a corresponding condition of a condition set, a respective candidate record including a tag associated with the corresponding condition. The control unit can provide, for each candidate record satisfying a tag criterion, a result record. Some examples can receive a modification record and use it to provide an updated condition set used for determining candidate records.

公开(公告)号：US11310248B2

公开(公告)日：2022-04-19

申请号：US16281277

申请日：2019-02-21

申请人： CrowdStrike, Inc.

发明人： David Blewett ,  Brian Concannon ,  John Lee ,  Kris Merritt ,  Andrew Roden

IPC分类号： H04L12/00 ,  H04L29/06 ,  G06F9/451 ,  G06F16/248 ,  G06F21/55 ,  H04W12/12 ,  G06F40/205

摘要： Example techniques herein filter and classify security-relevant events from monitored computing devices. A control unit can receive event records of various types, each event record associated with a monitored device. The control unit can provide, for each event record matching a corresponding pattern of a pattern set associated with the respective event type, a respective match record. Each match record can include an identifier of the corresponding pattern and data of the respective event record. The control unit can provide, for each match record satisfying a corresponding condition of a condition set, a respective candidate record including a tag associated with the corresponding condition. The control unit can provide, for each candidate record satisfying a tag criterion, a result record. Some examples can receive a modification record and use it to provide an updated condition set used for determining candidate records.