BIDIRECTIONAL LINKING OF EPHEMERAL EVENT STREAMS TO CREATORS OF THE EPHEMERAL EVENT STREAMS

• US 20150295779A1
• Filed: 01/30/2015
• Published: 10/15/2015
• Est. Priority Date: 04/15/2014
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Ching, Clayton S., Dickey, Michael R., Shcherbakov, Vladimir A., Teredesai, Nishant, Zises, Matthew S.
• Granted Patent: US 10,366,101 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/26 Visual data mining; Browsing structured data
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/022 by sampling
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

The disclosed embodiments provide a system that facilitates the processing of network data. During operation, the system causes for display a graphical user interface (GUI) for obtaining configuration information for configuring the generation of time-series event data from network packets captured by one or more remote capture agents. Next, the system causes for display, in the GUI, a first set of user-interface elements comprising event stream information for one or more ephemeral event streams used to temporarily generate the time-series event data from the network packets. The system then causes for display, in the GUI, a mechanism for navigating between the event stream information and creation information for one or more creators of the one or more ephemeral event streams.

Claims

1. A method for facilitating the processing of network data, comprising:

causing for display, on a computer system, a graphical user interface (GUI) for obtaining configuration information for configuring the generation of time-series event data from network packets captured by one or more remote capture agents;

causing for display, in the GUI, a first set of user-interface elements comprising event stream information for one or more ephemeral event streams used to temporarily generate the time-series event data from the network packets; and

causing for display, in the GUI, a mechanism for navigating between the event stream information and creation information for one or more creators of the one or more ephemeral event streams.

2. The method of claim 1, further comprising:

obtaining a subset of the one or more ephemeral event streams associated with a grouping of the one or more ephemeral event streams by an event stream attribute; and

updating the first set of user-interface elements with a subset of the event stream information for the subset of the one or more ephemeral event streams.

3. The method of claim 1, further comprising:

obtaining a subset of the one or more ephemeral event streams associated with a grouping of the one or more ephemeral event streams by an event stream attribute, wherein the event stream attribute is selected from;

a category of an event stream;

a protocol used by the network packets;

an application used to create the event stream; and

an event stream lifecycle of the event stream; and

updating the first set of user-interface elements with a subset of the event stream information for the subset of the one or more ephemeral event streams.

4. The method of claim 1, further comprising:

causing for display, in the GUI, a second set of user-interface elements for managing the one or more ephemeral event streams, wherein managing the one or more ephemeral event streams comprises at least one of;

modifying an end time for terminating the capture of time-series event data in an ephemeral event stream;

disabling the ephemeral event stream; and

deleting the ephemeral event stream.

5. The method of claim 1, further comprising:

causing for display, in the GUI, a second set of user-interface elements for creating a new ephemeral event stream; and

updating the configuration information based on input received through the second set of user-interface elements.

6. The method of claim 1, further comprising:

causing for display, in the GUI, a second set of user-interface elements comprising the time-series event data.

7. The method of claim 1, wherein the creation information comprises at least one of:

a creator name;

a protocol;

a duration of the ephemeral event stream; and

a trigger condition for activating the ephemeral event stream.

8. The method of claim 1, wherein the one or more creators of the one or more ephemeral event streams comprise an application for monitoring network traffic captured by the one or more remote capture agents.

9. The method of claim 1, wherein the one or more creators of the one or more ephemeral event streams comprise a capture trigger for generating additional time-series event data from the network packets on the one or more remote capture agents based on a security risk.

10. The method of claim 1, wherein the event stream information comprises at least one of:

a name;

a number of event streams;

an application;

a start time;

the end time;

a time remaining; and

a status.

11. The method of claim 1, wherein the mechanism comprises a hyperlink to the creation information for a creator of an ephemeral event stream.

12. The method of claim 1, wherein the mechanism comprises a hyperlink from the creation information to the event stream information.

13. The method of claim 1,

wherein the one or more creators of the one or more ephemeral event streams comprise:

a risk-identification mechanism for identifying a security risk from time-series event data generated from network packets captured by one or more remote capture agents distributed across a network; and

a capture trigger for generating additional time-series event data from the network packets on the one or more remote capture agents based on a security risk, and

wherein the risk-identification mechanism comprises an event of interest related to the security risk that is displayed in the GUI.

14. The method of claim 1,

wherein the one or more creators of the one or more ephemeral event streams comprise:

a risk-identification mechanism for identifying a security risk from the time-series event data generated from network packets captured by one or more remote capture agents distributed across a network; and

a capture trigger for generating additional time-series event data from the network packets on the one or more remote capture agents based on a security risk, and

wherein the capture trigger is received through one or more user-interface elements in the GUI that display an error representing the security risk.

15. The method of claim 1,

wherein the one or more creators of the one or more ephemeral event streams comprise:

a risk-identification mechanism for identifying a security risk from the time-series event data generated from network packets captured by one or more remote capture agents distributed across a network; and

a capture trigger for generating additional time-series event data from the network packets on the one or more remote capture agents based on a security risk, and

wherein the risk-identification mechanism for identifying the security risk from the time-series event data comprises a search for a subset of the time-series event data matching the security risk.

16. The method of claim 1,

wherein the one or more creators of the one or more ephemeral event streams comprise:

a risk-identification mechanism for identifying a security risk from the time-series event data generated from network packets captured by one or more remote capture agents distributed across a network; and

a capture trigger for generating additional time-series event data from the network packets on the one or more remote capture agents based on a security risk,

wherein the risk-identification mechanism for identifying the security risk from the time-series event data comprises a recurring search for a subset of the time-series event data matching the security risk, and

wherein the capture trigger for generating the additional time-series event data from the network packets is automatically activated upon identifying the subset of the time-series event data matching the security risk during the recurring search.

17. An apparatus, comprising:

one or more processors; and

memory storing instructions that, when executed by the one or more processors, cause the apparatus to;

cause for display a graphical user interface (GUI) for obtaining configuration information for configuring the generation of time-series event data from network packets captured by one or more remote capture agents;

cause for display, in the GUI, a first set of user-interface elements comprising event stream information for one or more ephemeral event streams used to temporarily generate the time-series event data from the network packets; and

cause for display, in the GUI, a mechanism for navigating between the first set of user-interface elements and a second set of user-interface elements comprising creation information for one or more creators of the one or more ephemeral event streams.

18. The apparatus of claim 17, wherein the memory further stores instructions that, when executed by the one or more processors, cause the apparatus to:

cause for display, in the GUI, a second set of user-interface elements for managing the one or more ephemeral event streams, wherein managing the one or more ephemeral event streams comprises at least one of;

modifying an end time for terminating the capture of time-series event data in an ephemeral event stream;

disabling the ephemeral event stream; and

deleting the ephemeral event stream.

19. The apparatus of claim 18, wherein the memory further stores instructions that, when executed by the one or more processors, cause the apparatus to:

cause for display, in the GUI, a second set of user-interface elements comprising the time-series event data.

20. The apparatus of claim 17, wherein the creation information comprises at least one of:

a creator name;

a protocol;

a duration of the ephemeral event stream; and

a trigger condition for activating the ephemeral event stream.

21. The apparatus of claim 17, wherein the one or more creators of the one or more ephemeral event streams comprise an application for monitoring network traffic captured by the one or more remote capture agents.

22. The apparatus of claim 17, wherein the one or more creators of the one or more ephemeral event streams comprise a capture trigger for generating additional time-series event data from the network packets on the one or more remote capture agents based on a security risk.

23. The apparatus of claim 17, wherein the mechanism comprises a hyperlink to the creation information for a creator of an ephemeral event stream.

24. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for facilitating the processing of network data, the method comprising:

causing for display, on a computer system, a graphical user interface (GUI) for obtaining configuration information for configuring the generation of time-series event data from network packets captured by one or more remote capture agents;

causing for display, in the GUI, a first set of user-interface elements comprising event stream information for one or more ephemeral event streams used to temporarily generate the time-series event data from the network packets; and

causing for display, in the GUI, a mechanism for navigating between the first set of user-interface elements and a second set of user-interface elements comprising creation information for one or more creators of the one or more ephemeral event streams.

25. The non-transitory computer-readable storage medium of claim 24, the method further comprising:

causing for display, in the GUI, a second set of user-interface elements for managing the one or more ephemeral event streams, wherein managing the one or more ephemeral event streams comprises at least one of;

modifying an end time for terminating the capture of time-series event data in an ephemeral event stream;

disabling the ephemeral event stream; and

deleting the ephemeral event stream.

26. The non-transitory computer-readable storage medium of claim 24, the method further comprising:

providing, in the GUI, a second set of user-interface elements comprising the time-series event data.

27. The non-transitory computer-readable storage medium of claim 24, wherein the creation information comprises at least one of:

a creator name;

a protocol;

a duration of the ephemeral event stream; and

a trigger condition for activating the ephemeral event stream.

28. The non-transitory computer-readable storage medium of claim 24, wherein the one or more creators of the one or more ephemeral event streams comprise an application for monitoring network traffic captured by the one or more remote capture agents.

29. The non-transitory computer-readable storage medium of claim 24, wherein the one or more creators of the one or more ephemeral event streams comprise a capture trigger for generating additional time-series event data from the network packets on the one or more remote capture agents based on a security risk.

30. The non-transitory computer-readable storage medium of claim 24, wherein the mechanism comprises a hyperlink to the creation information for a creator of an ephemeral event stream.