METHOD AND SYSTEM FOR ANALYZING DATA RELATED TO AN EVENT

• US 20090198651A1
• Filed: 02/01/2008
• Published: 08/06/2009
• Est. Priority Date: 02/01/2008
• Status: Active Grant

• Current Assignee: Fireeye Security Holdings US LLC
• Original Assignee: Mandiant LLC (Alphabet Inc.)
• Inventors: Wilson, Theodore, Cunningham, Sean, Frazier, Matthew, Shiffer, Jason, Helvey, Eric, Hogsten, Scott
• Granted Patent: US 8,566,476 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/00 Information retrieval; Database structures therefor; File system structures therefor
• CPC Class Codes: G06F 16/254 Extract, transform and load [ETL] procedures, e.g. ETL data flows in data warehouses
• CPC Class Codes: G06F 16/27 Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor

Abstract

A system and method for analyzing data from a plurality of computer environments. A user may search for computer environments that meet a certain criterion. The computer environments are authenticated and data is copied from the computer environments to a memory location. The data may be marked so that a user may determine which computer environment provided the data. The user may add notations to the data during a review. Changes to data on the computer environments may be provided to a user using a syndication feed.

Claims

1. A method of analyzing data related to an event comprising:

(a) copying a plurality of files from a plurality of storage devices to a memory location;

(b) converting the plurality of files to a predetermined unified format;

(c) analyzing the plurality of files; and

(d) providing a report to a user based on the analysis.

2. The method of claim 1 wherein analyzing the data comprises sorting the data using a variable.

3. The method of claim 1 wherein the event is a user request.

4. The method of claim 1 wherein the event is a response to an incident.

5. The method of claim 1 wherein analyzing the data comprises sorting the data into data groups based on one or more variables.

6. The method of claim 5 comprising comparing the data groups and providing a report to the user showing the union of two groups.

7. The method of claim 5 comprising comparing the data groups and providing a report to the user showing the intersection of two groups.

8. The method of claim 5 comprising comparing the data groups and providing a report to the user showing the difference between two groups.

9. The method of claim 5 comprising comparing the data groups and providing a report to the user showing the similarities between two groups.

10. The method of claim 1 wherein the report comprises a list of the plurality of files.

11. A method of analyzing data comprising:

(a) receiving a search request from a user;

(b) searching for storage devices according to the search request;

(c) searching for data on the storage devices according to the search request;

(d) copying the data to a memory location;

(e) converting the data to a user-defined format;

(f) analyzing the data; and

(g) providing a report to the user based on the analyzing of the data.

12. The method of claim 11 wherein the storage devices are coupled to a user computer through a network.

13. The method of claim 11 wherein the user-defined format is extensible markup language.

14. The method of claim 11 further comprising storing the data in a database.

15. The method of claim 11 wherein analyzing the data comprises searching the data for a user-defined variable.

16. The method of claim 15 wherein the user-defined variable is a file type.

17. The method of claim 15 wherein the user-defined variable is a bit string.

18. The method of claim 11 wherein analyzing the data comprises creating a plurality of groups of data according to a plurality of user-defined variables.

19. The method of claim 18 further comprising comparing the groups.

20. A system for analyzing data comprising:

(a) means for receiving a search request from a user;

(b) means for searching for storage devices according to the search request;

(c) means for searching for data on the storage devices according to the search request;

(d) means for copying the data to a memory location;

(e) means for converting the data to a user-defined format;

(f) means for analyzing the data; and

(g) means for providing a report to the user based on the analyzing of the data.

21. A method of analyzing data related to an event comprising:

(a) copying data from a plurality of storage locations to a single memory location;

(b) converting the data to a user-defined format;

(c) storing the data in a database;

(d) receiving notations from a user concerning the data; and

(e) storing the notations in the database.

22. The method of claim 21 wherein the plurality of storage locations are coupled to the single memory location through a network.

23. The method of claim 21 further comprising providing an interface to the user which displays the database to the user.

24. The method of claim 23 further comprising defining the interface based on user input.

25. The method of claim 24 wherein the user input comprises a request for defined radio buttons.

26. The method of claim 25 wherein the user input further comprises a request for defined text boxes.

27. The method of claim 26 wherein the notations comprise text entered into the text boxes.

28. The method of claim 27 wherein the notations further comprise selected radio buttons.

29. The method of claim 28 further comprising recording notations in the database for every record viewed by the user.

30. The method of claim 21 wherein the notations comprise user-defined labels.

31. The method of claim 21 further comprising searching the database based on a user-defined search query.

32. A method for annotating data comprising:

(a) searching for files on storage devices coupled to a user computer;

(b) copying the files to a memory location;

(c) converting the files to a user-defined format; and

(d) attaching user comments to the files.

33. The method of claim 32 wherein only files of a file type specified by the user are copied to the memory location.

34. The method of claim 32 wherein the user-defined format is extensible markup language.

35. The method of claim 32 further comprising sorting the files based on user-defined criteria.

36. The method of claim 35 further comprising sorting the files wherein the user comments comprise labels that are applied to a sorted category of files.

37. The method of claim 32 wherein the user comments comprise free-form text.

38. The method of claim 32 wherein the user comments comprise the username of the user that viewed each file.

39. The method of claim 32 further comprising sorting the files based on the user comments.

40. The method of claim 32 further comprising creating a report for the user based on the user comments.

41. A system of analyzing data comprising:

(a) means for copying data from a plurality of storage locations to a single memory location;

(b) means for converting the data to a user-defined format;

(c) means for storing the data in a database;

(d) means for receiving notations from a user concerning the data; and

(e) means for storing the notations in the database.

42. The system of claim 41 wherein the notations are stored in the database as data objects.

43. A method of analyzing data related to an event comprising:

(a) providing an interface to a user on a central computer;

(b) contacting a plurality of memory locations coupled to the central computer at a first time;

(c) copying data from the plurality of memory locations to the central computer;

(d) converting the data to a uniform format;

(e) providing the user access to the data through the interface; and

(f) contacting the plurality of memory locations at a second time, comparing the data on the plurality of memory locations to the data on the central computer, and updating the display of the data to the user if data stored on the plurality of memory locations has changed more than a predetermined amount.

44. The method of claim 43 wherein the plurality of memory locations are coupled to the central computer through a network.

45. The method of claim 43 wherein converting the data to a uniform format occurs before copying data from the plurality of memory locations to the central computer.

46. The method of claim 43 wherein the uniform format is extensible markup language.

47. The method of claim 43 wherein providing the user access to the data through the interface further comprises executing a search query of the data requested by the user.

48. The method of claim 43 wherein the contacting the plurality of memory locations at a second time is repeated periodically.

49. The method of claim 48 wherein the contacting the plurality of memory locations at a second time is repeated periodically at a user-defined time interval.

50. The method of claim 43 wherein the predetermined amount is a number of modified files.

51. The method of claim 43 wherein the display is updated using a syndication feed.

52. The method of claim 51 wherein the syndication feed is in Atom syndication format.

53. The method of claim 51 wherein the syndication feed comprises details of the data that has changed and upon which memory locations the data is located.

54. The method of claim 43 wherein the user is alerted when the display is updated.

55. The method of claim 54 wherein the user is presented with an option to copy any changed data from the memory locations to the central computer.

56. A method of tracking data comprising:

(a) contacting a plurality of computer environments coupled to a central computer;

(b) identifying stored files on the plurality of computer environments;

(c) copying the stored files to the central computer;

(d) converting the stored files into uniform files in a uniform file format;

(e) comparing the uniform files to the stored files on the plurality of computer environments; and

(f) alerting the user if the difference between the uniform files and the stored files is greater than a predetermined amount.

57. The method of claim 56 wherein the uniform file format is extensible markup language.

58. The method of claim 56 wherein comparing the uniform files to the stored files occurs periodically.

59. The method of claim 58 wherein comparing the uniform files to the stored files occurs periodically at user-defined time intervals.

60. The method of claim 56 wherein alerting the user comprises utilizing a syndication feed to provide any updates to the stored files to the user.

61. The method of claim 60 wherein the syndication feed is in Atom syndication format.

62. The method of claim 56 wherein only stored files of a file type requested by the user are copies to the central computer.

63. The method of claim 56 further comprising creating a plurality of indexes of the uniform data.

64. The method of claim 63 further comprising executing a search of the indexes based on user defined search terms.

65. A system of analyzing data comprising:

(a) means for providing an interface to a user on a central computer;

(b) means for contacting a plurality of memory locations coupled to the central computer at a first time;

(c) means for copying data from the plurality of memory locations to the central computer;

(d) means for converting the data to a uniform format;

(e) means for providing the user access to the data through the interface; and

(f) means for contacting the plurality of memory locations at a second time, comparing the data on the memory locations to the data on the central computer, and alerting the user if data stored on the plurality of memory locations has changed more than a predetermined amount.