Searchable investigation history for event data store
First Claim
Patent Images
1. A method comprising:
- receiving, by a processing device as part of an investigation, a first query comprising a first field value and a first time period, wherein the first field value comprises an internet protocol (IP) address, a port, or a user identification (ID);
performing, by the processing device, a first search of a data store to identify a first plurality of events having the first time period and at least one field that comprises the first field value;
generating, by the processing device, a first search object comprising the first field value;
generating, by the processing device, a first search event comprising the first field value and a reference to the first search object;
receiving, by the processing device, an indication of one or more search objects that contributed to a resolution of the investigation, the one or more search objects comprising the first search object;
generating, by the processing device, a resolution object, the resolution object comprising a resolution object identifier, resolution information and references to the one or more search objects;
generating, by the processing device, a resolution event associated with the resolution object; and
writing at least one of an event entry for the first search event or an event entry for the resolution event to the data store, wherein the event entry for the first search event is indexed in the data store based on the first field value.
3 Assignments
0 Petitions
Accused Products
Abstract
A processing device receives a first query comprising a first field value and a first time period. The processing device performs a first search of a data store to identify a first plurality of events having the first time period and at least one field that comprises the first field value. The processing device generates a first search object comprising the first field value. The processing device generates a search event comprising the first field value and a reference to the first search object. An event entry for the first search event is then written to the data store. Future searches may return both the first search event and other events.
-
Citations
20 Claims
-
1. A method comprising:
-
receiving, by a processing device as part of an investigation, a first query comprising a first field value and a first time period, wherein the first field value comprises an internet protocol (IP) address, a port, or a user identification (ID); performing, by the processing device, a first search of a data store to identify a first plurality of events having the first time period and at least one field that comprises the first field value; generating, by the processing device, a first search object comprising the first field value; generating, by the processing device, a first search event comprising the first field value and a reference to the first search object; receiving, by the processing device, an indication of one or more search objects that contributed to a resolution of the investigation, the one or more search objects comprising the first search object; generating, by the processing device, a resolution object, the resolution object comprising a resolution object identifier, resolution information and references to the one or more search objects; generating, by the processing device, a resolution event associated with the resolution object; and writing at least one of an event entry for the first search event or an event entry for the resolution event to the data store, wherein the event entry for the first search event is indexed in the data store based on the first field value. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9)
-
-
10. A computer readable storage medium comprising instructions that, when executed by a processing device, cause the processing device to perform operations comprising:
receiving, by the processing device as part of an investigation, a first query comprising a first field value and a first time period, wherein the first field value comprises an internet protocol (IP) address, a port, or a user identification (ID); performing, by the processing device, a first search of a data store to identify a first plurality of events having the first time period and at least one field that comprises the first field value; generating, by the processing device, a first search object comprising the first field value; generating, by the processing device, a first search event comprising the first field value and a reference to the first search object; receiving, by the processing device, an indication of one or more search objects that contributed to a resolution of the investigation, the one or more search objects comprising the first search object; generating, by the processing device, a resolution object, the resolution object comprising a resolution object identifier, a resolution information and references to the one or more search objects; generating, by the processing device, a resolution event associated with the resolution object; and writing at least one of an event entry for the first search event or an event entry for the resolution event to the data store, wherein the event entry for the first search event is indexed in the data store based on the first field value. - View Dependent Claims (11, 12, 13, 14, 15)
-
16. A system comprising:
-
a data store to store a plurality of events; and a computing device, operatively coupled to the data store, to; receive as part of an investigation a first query comprising a plurality of field values and a first time period, wherein the field values comprise an internet protocol (IP) address, a port, or a user identification (ID); perform a first search of the data store to identify a first subset of the plurality of events having the first time period and the plurality of field values; generate a first search object comprising the plurality of field values; generate a first search event comprising a second time period that at least partially overlaps the first time period, a reference to the first search object, and the plurality of field values; receive an indication of one or more search objects that contributed to a resolution of the investigation, the one or more search objects comprising the first search object; generate a resolution object, the resolution object comprising a resolution object identifier, resolution information and references to the one or more search objects; generate a resolution event associated with the resolution object; and write at least one of a plurality of event entries for the first search event or a plurality of event entries for the resolution event to the data store, wherein a separate event entry is written to the data store for each field value of the plurality of field values. - View Dependent Claims (17, 18, 19, 20)
-
Specification