Directing audited data traffic to specific repositories
First Claim
1. A computer-implemented method for auditing data traffic, the computer-implemented process comprising:
- monitoring data traffic on a network and collecting data access elements thereof;
comparing the collected data access elements to security rules;
sending a first audit data collection to a first repository based on a first security rule of the security rules,wherein the first security rule;
defines a first condition based on a first data access element of the collected data access elements,defines the first audit data collection,designates the first audit data collection as a default audit data collection for a first user, anddesignates the first repository as a default repository for the first user,wherein the first audit data collection includes a second data access element of the collected data access elements andwherein the sending occurs in response to one or more of the collected data access elements of a data access by the first user matching the first condition in the first security rule and the sending directs the first audit data collection to the first repository responsive to the designation of the first repository in the first security rule; and
sending, for the data access by the first user, a second audit data collection to a second repository based on a second security rule of the security rules,wherein the second security rule;
defines a second condition based on a third data access element of the collected data access elements,defines the second audit data collection anddesignates the second repository as a repository for the second audit data collection,wherein the second audit data collection includes a fourth data access element of the collected data access elements andwherein the sending the second audit data collection to the second repository occurs in response to one or more of the collected data access elements of the data access by the first user matching the second condition in the second security rule and the sending the second audit data collection directs the second audit data collection to the second repository responsive to the designation of the second repository in the second security rule,wherein the third data access element is different than the fourth data access element, andwherein the third data access element is a database table name and the fourth data access element is an IP address from which the database table is accessed.
1 Assignment
0 Petitions
Accused Products
Abstract
Data traffic is monitored on a network with data access elements thereof collected and compared to security rules. An audit data collection is sent to a repository responsive to data access elements matching a condition of the security rules, where security rules having the condition designate the audit data collection and repository. A tag to data traffic is applied responsive to the matching condition. Comparing of collected data access elements to the corresponding security rules having the matching condition is discontinued responsive to applying the tag. The tag indicates a repository and the data traffic includes a connection and session. An audit data collection is sent to the repository indicated by the tag for a data access responsive to the tag in the tagged data traffic. The method continues sending audit data for future data accesses in the tagged data traffic without comparing to the corresponding security rules again.
52 Citations
15 Claims
-
1. A computer-implemented method for auditing data traffic, the computer-implemented process comprising:
-
monitoring data traffic on a network and collecting data access elements thereof; comparing the collected data access elements to security rules; sending a first audit data collection to a first repository based on a first security rule of the security rules, wherein the first security rule; defines a first condition based on a first data access element of the collected data access elements, defines the first audit data collection, designates the first audit data collection as a default audit data collection for a first user, and designates the first repository as a default repository for the first user, wherein the first audit data collection includes a second data access element of the collected data access elements and wherein the sending occurs in response to one or more of the collected data access elements of a data access by the first user matching the first condition in the first security rule and the sending directs the first audit data collection to the first repository responsive to the designation of the first repository in the first security rule; and sending, for the data access by the first user, a second audit data collection to a second repository based on a second security rule of the security rules, wherein the second security rule; defines a second condition based on a third data access element of the collected data access elements, defines the second audit data collection and designates the second repository as a repository for the second audit data collection, wherein the second audit data collection includes a fourth data access element of the collected data access elements and wherein the sending the second audit data collection to the second repository occurs in response to one or more of the collected data access elements of the data access by the first user matching the second condition in the second security rule and the sending the second audit data collection directs the second audit data collection to the second repository responsive to the designation of the second repository in the second security rule, wherein the third data access element is different than the fourth data access element, and wherein the third data access element is a database table name and the fourth data access element is an IP address from which the database table is accessed. - View Dependent Claims (2, 3, 4, 5)
-
-
6. A system comprising:
-
at least one hardware computing processor; and a computer-readable storage media connected to the at least one hardware computing processor, wherein the computer-readable storage media has stored thereon a data traffic auditing program for controlling the at least one hardware computing processor, and wherein the at least one hardware computing processor is operative with the program to execute the program to; monitor data traffic on a network and collecting data access elements thereof; compare the collected data access elements to security rules; send a first audit data collection to a first repository based on a first security rule of the security rules, wherein the first security rule; defines a first condition based on a first data access element of the collected data access elements, defines the first audit data collection, designates the first audit data collection as a default audit data collection for a first user, and designates the first repository as a default repository for the first user, wherein the first audit data collection includes a second data access element of the collected data access elements and wherein the sending occurs in response to one or more of the collected data access elements of a data access by the first user matching the first condition in the first security rule and the sending directs the first audit data collection to the first repository responsive to the designation of the first repository in the first security rule; and send, for the data access by the first user, a second audit data collection to a second repository based on a second security rule of the security rules, wherein the second security rule; defines a second condition based on a third data access element of the collected data access elements, defines the second audit data collection and designates the second repository as a repository for the second audit data collection, wherein the second audit data collection includes a fourth data access element of the collected data access elements and wherein the sending the second audit data collection to the second repository occurs in response to one or more of the collected data access elements of the data access by the first user matching the second condition in the second security rule and the sending the second audit data collection directs the second audit data collection to the second repository responsive to the designation of the second repository in the second security rule, wherein the third data access element is different than the fourth data access element, and wherein the third data access element is a database table name and the fourth data access element is an IP address from which the database table is accessed. - View Dependent Claims (7, 8, 9, 10)
-
-
11. A non-transitory computer program product for auditing data traffic, the computer program product comprising:
-
a non-transitory computer-readable storage medium; and computer-readable program code embodied in the non-transitory computer-readable storage medium, wherein the computer-readable program code is configured to cause at least one computing processor to; monitor data traffic on a network and collecting data access elements thereof; compare the collected data access elements to security rules; send a first audit data collection to a first repository based on a first security rule of the security rules, wherein the first security rule; defines a first condition based on a first data access element of the collected data access elements, defines the first audit data collection, designates the first audit data collection as a default audit data collection for a first user, and designates the first repository as a default repository for the first user, wherein the first audit data collection includes a second data access element of the collected data access elements and wherein the sending occurs in response to one or more of the collected data access elements of a data access by the first user matching the first condition in the first security rule and the sending directs the first audit data collection to the first repository responsive to the designation of the first repository in the first security rule; and send, for the data access by the first user, a second audit data collection to a second repository based on a second security rule of the security rules, wherein the second security rule; defines a second condition based on a third data access element of the collected data access elements, defines the second audit data collection and designates the second repository as a repository for the second audit data collection, wherein the second audit data collection includes a fourth data access element of the collected data access elements and wherein the sending the second audit data collection to the second repository occurs in response to one or more of the collected data access elements of the data access by the first user matching the second condition in the second security rule and the sending the second audit data collection directs the second audit data collection to the second repository responsive to the designation of the second repository in the second security rule, wherein the third data access element is different than the fourth data access element, and wherein the third data access element is a database table name and the fourth data access element is an IP address from which the database table is accessed. - View Dependent Claims (12, 13, 14, 15)
-
Specification