SYSTEM, METHOD, AND COMPUTER PROGRAM PRODUCT FOR DISPLAYING NETWORK EVENTS IN TERMS OF OBJECTS MANAGED BY A SECURITY APPLIANCE AND/OR A ROUTING DEVICE

• US 20110225622A1
• Filed: 03/12/2010
• Published: 09/15/2011
• Est. Priority Date: 03/12/2010
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Pearcy, Derek Patton, Caldera, Jose
• Granted Patent: US 8,448,221 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A system, method, and computer program product are provided for displaying network events in terms of objects managed by at least one of a security appliance and a routing device. In use, network events are received. Furthermore, the network events are displayed in terms of objects being managed by at least one of a security appliance and a routing device.

Claims

1. A computer program product embodied on a tangible computer readable medium, comprising:

computer code for receiving network events; and

computer code for displaying the network events in terms of objects being managed by at least one of a security appliance and a routing device.

2. The computer program product of claim 1, wherein the computer program product is operable such that the network events are received from the at least one of the security appliance and the routing device.

3. The computer program product of claim 1, wherein the network events include a description of network traffic processed by the at least one of the security appliance and the routing device.

4. The computer program product of claim 3, wherein the description identifies a source of the network traffic, a destination of the network traffic, and an application utilized for communicating the network traffic.

5. The computer program product of claim 4, wherein the application includes a port number, a service, a protocol, or an identifier.

6. The computer program product of claim 1, wherein the computer program product is operable such that displaying the network events in terms of the objects being managed by the at least one of the security appliance and the routing device includes displaying a summary of the network events utilizing a graph with axes indicative of the objects.

7. The computer program product of claim 6, wherein the objects include at least one source of network traffic from which the network events were generated, such that a first one of the axes represents the at least one source.

8. The computer program product of claim 6, wherein the objects include at least one destination of network traffic from which the network events were generated, such that a second one of the axes represents the at least one destination.

9. The computer program product of claim 6, wherein the objects include at least one application utilized for communicating network traffic from which the network events were generated, such that a third one of the axes represents the at least one application.

10. The computer program product of claim 1, wherein the computer program product is operable such that the objects being managed by the security appliance are defined in a policy of the security appliance.

11. The computer program product of claim 1, wherein the computer program product is operable such that the objects being managed by the routing device are defined in a policy of an application displaying the network events in terms of the objects.

12. The computer program product of claim 1, wherein the displayed network events include a subset of all received network events.

13. The computer program product of claim 12, wherein the subset includes network events that occurred during a first time period selected by a user.

14. The computer program product of claim 13, wherein the subset includes network events that occurred during a second time period automatically selected based on the first time period.

15. The computer program product of claim 14, wherein the first time period is different from the second time period.

16. The computer program product of claim 14, wherein the computer program product is operable such that the network events are displayed in a manner that compares the network events that occurred during the first time period with the network events that occurred during the second time period.

17. The computer program product of claim 15, wherein the computer program product is operable such that the comparison is utilized for indicating an effect of a change to a configuration of the management of the objects that occurred between the first time period and the second time period.

18. A method, comprising:

receiving network events; and

displaying the network events in terms of objects being managed by at least one of a security appliance and a routing device.

19. A system, comprising:

a processor for receiving network events, and displaying the network events in terms of objects being managed by at least one of a security appliance and a routing device.

20. The system of claim 19, wherein the processor is coupled to memory via a bus.