Correlation rule builder

• US 20070192720A1
• Filed: 02/14/2006
• Published: 08/16/2007
• Est. Priority Date: 02/14/2006
• Status: Abandoned Application

• Current Assignee: TriGeo Network Security, Inc. (SolarWinds Corp.)
• Original Assignee: TriGeo Network Security, Inc. (SolarWinds Corp.)
• Inventors: Alsup, Marshal, Maloof, Michael, Beyl, Greg
• Application Number:
  US11/354,479
• Publication Number:
  US 20070192720A1
• Time in Patent Office: Days
• US Class Current: 715/769
• CPC Class Codes: G06F 3/0486 Drag-and-drop

Abstract

A correlation rule builder is disclosed which displays a graphical user interface that enables a user to construct rules, the program causing a computer to perform actions based on the rules. The interface allows a user to construct the rules by dragging-and-dropping objects from an object chooser panel and an expression object menu bar onto an expression panel. The objects include alerts, logical operators for the rules, and actions. A correlation box inside the expression panel allows the user to create expressions which are related by operators such as AND and OR; the correlated expressions must be satisfied for the chosen actions to occur. The rule builder also allows a user to create groups of expressions within the correlation box; the expressions within each group may be related by operators such as AND and OR, and the groups may be related to each other by operators such as AND and OR.

Claims

1. A method for constructing a correlation rule on a computer, the method comprising:

viewing a graphical user interface comprising an expression panel, an object chooser panel, and an expression object menu bar,

wherein the expression panel comprises an action box and a correlation box including a left field and an operator icon;

selecting one or more alert events by dragging and dropping the selected alert event(s) from the object chooser panel to the left field of the correlation box;

selecting an operator by clicking on the operator icon of the correlation box;

selecting one or more actions to be performed by the correlation rule by dragging and dropping the selected action(s) from the object chooser panel to the action box of the expression panel.

2. The method of claim 1, further comprising selecting one or more components or component fields by dragging and dropping the selected component(s) or component field(s) from the object chooser panel to a right field of the correlation box.

3. The method of claim 1, further comprising selecting one or more relational terms by dragging and dropping the selected relational term(s) from the expression object menu bar to the expression panel.

4. The method of claim 3, wherein the relational term(s) comprises an icon, text, and a tooltip.

5. The method of claim 1, further comprising requiring that the alert events occur within a specified time span by interacting with a correlation time box.

6. The method of claim 1, wherein the correlation box further comprises a plurality of nested correlation boxes, each nested correlation box comprising a left field and an operator icon.

7. A correlation rule builder comprising:

an object chooser panel displayed via a graphical user interface, the object chooser panel comprising a plurality of alert events;

an expression object menu bar displayed via the graphical user interface, the expression object menu bar comprising a plurality of relational terms; and

an expression panel displayed via the graphical user interface;

wherein the expression panel comprises an action box and a correlation box including a left field and an operator icon; and

wherein the graphical user interface is configured to enable a user to construct correlation rules by dragging and dropping alert events from the object chooser panel to the left field of the correlation box and by dragging and dropping actions from the object chooser panel to the expression panel.

8. The correlation rule builder of claim 7, wherein the objects received by the correlation box are related by objects dragged from the expression object menu bar.

9. The correlation rule builder of claim 7, wherein the graphical user interface is configured to enable a user to select an operator by clicking on the operator icon of the correlation box.

10. The correlation rule builder of claim 7, wherein the correlation box further comprises a right field and wherein the graphical user interface is configured to enable a user to select one or more components or component fields by dragging and dropping the selected component(s) or component field(s) from the object chooser panel to the right field of the correlation box.

11. The correlation rule builder of claim 7, wherein the graphical user interface is configured to enable a user to drag and drop relational terms from the expression object menu bar to the expression panel.

12. The correlation rule builder of claim 11, wherein the relational terms of the expression object menu bar comprise an icon, text, and a tooltip.

13. The correlation rule builder of claim 7, further comprising an undo/redo component comprising a store of information, a store of listeners, a maximum stack size, and a stack pointer.

14. The correlation rule builder of claim 7, wherein the correlation box further comprises a plurality of nested correlation boxes, each nested correlation box comprising a left field and an operator icon.

15. A machine readable medium comprising machine readable instructions for causing a computer to perform a method for constructing a correlation rule, the method comprising:

displaying a graphical user interface comprising an expression panel, an object chooser panel, and an expression object menu bar,

wherein the expression panel comprises an action box and a correlation box including a left field and an operator icon;

enabling a user to select one or more alert events by dragging and dropping the selected alert event(s) from the object chooser panel to the left field of the correlation box;

enabling a user to select an operator by clicking on the operator icon of the correlation box;

enabling a user to select one or more actions to be performed by the correlation rule by dragging and dropping the selected action(s) from the object chooser panel to the action box of the expression panel.

16. The machine readable medium of claim 15, wherein the method further comprises selecting one or more components or component fields by dragging and dropping the selected component(s) or component field(s) from the object chooser panel to a right field of the correlation box.

17. The machine readable medium of claim 15, wherein the method further comprises selecting one or more relational terms by dragging and dropping the selected relational term(s) from the expression object menu bar to the expression panel.

18. The machine readable medium of claim 17, wherein the relational terms comprise an icon, text, and a tooltip.

19. The machine readable medium of claim 15, wherein:

the correlation box further comprises a correlation time box, and

the method further comprises enabling the user to require that the alert events occur within a specified time span by interacting with the correlation time box.

20. The machine readable medium of claim 15, wherein the correlation box further comprises a plurality of nested correlation boxes, each nested correlation box comprising a left field and an operator icon.