GRAPHICAL DISPLAY OF EVENTS INDICATING SECURITY THREATS IN AN INFORMATION TECHNOLOGY SYSTEM

• US 20180351990A1
• Filed: 06/04/2018
• Published: 12/06/2018
• Est. Priority Date: 07/31/2013
• Status: Active Grant

• Current Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Original Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Inventors: Coates, John, Murphey, Lucas, Hazekamp, David, Hansen, James
• Granted Patent: US 10,382,472 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A disclosed computer-implemented method includes receiving and indexing the raw data. Indexing includes dividing the raw data into time stamped searchable events that include information relating to computer or network security. Store the indexed data in an indexed data store and extract values from a field in the indexed data using a schema. Search the extracted field values for the security information. Determine a group of security events using the security information. Each security event includes a field value specified by a criteria. Present a graphical interface (GI) including a summary of the group of security events, other summaries of security events, and a remove element (associated with the summary). Receive input corresponding to an interaction of the remove element. Interacting with the remove element causes the summary to be removed from the GI. Update the GI to remove the summary from the GI.

Claims

1-20. -20. (canceled)

21. A method comprising:

extracting, by a computer system, one or more values from each event in a plurality of time-stamped, searchable events, wherein the one or more values are extracted from a field present in raw machine data in each event, the machine data having been produced by one or more components of an information technology environment and indicative of activity in the information technology environment;

creating, by the computer system, an event group from a set of events in the plurality of time-stamped, searchable events, wherein each event in the set of events is associated with an extracted value that satisfies a security criterion;

creating, by the computer system, an event group summary for the event group, wherein the event group summary summarizes one or more fields present in the machine data in the events in the event group; and

causing, by the computer system, display of a plurality of event group summaries, including the event group summary, wherein the plurality of event group summaries are indicative of potential security threats in the information technology environment.

22. The method as recited in claim 21, wherein at least one event group summary of the plurality of event group summaries includes domain activity information.

23. The method as recited in claim 21, further comprising:

changing a visual appearance of a particular event group summary among the plurality of event group summaries to indicate that the particular event group summary is a potential security threat.

24. The method as recited in claim 21, further comprising:

causing display of a graphical element that, when activated, causes removal of a selected event group summary from the plurality of event group summaries; and

based on user input via the graphical element, removing the selected event group summary from the plurality of event group summaries, to indicate that the selected event group summary is not a security threat.

25. The method as recited in claim 21, further comprising:

causing display of a graphical element that, when activated, causes removal of a selected event group summary from the plurality of event group summaries;

based on user input via the graphical element, removing the selected event group summary from the plurality of event group summaries, to indicate that the selected event group summary is not a security threat;

causing display of a second graphical user interface displaying a second plurality of event group summaries including the selected event group summary, wherein each event group summary in the second plurality of event group summaries was removed from the plurality of event group summaries indicating that each event group summary in the second plurality of event group summaries is not a security threat.

26. The method as recited in claim 21, wherein the machine data is log data;

the method further comprising;

organizing the machine data into the plurality of time-stamped, searchable events, wherein an event comprises at least a portion of log data within the machine data.

27. The method as recited in claim 21, wherein each of the one or more security criteria is evaluated using a late binding schema applied to at least a portion of the plurality of time-stamped, searchable events.

28. The method as recited in claim 21, wherein each event of the plurality of time-stamped, searchable events is associated with a time stamp, and wherein the event group summary encompasses events having time stamps within a specified time period.

29. The method as recited in claim 21, wherein the event group summary includes a numerical count of events in the set of events.

30. The method as recited in claim 21, wherein the one or more security criteria include a particular threshold string length for the one or more extracted values.

31. The method as recited in claim 21, wherein the one or more security criteria include a particular threshold string length for a network resource locator.

32. The method as recited in claim 21, wherein the one or more security criteria include a source address associated with a security threat.

33. The method as recited in claim 21, wherein the security criterion relates to at least one of:

an HTTP agent string, a network traffic size, a length of a uniform resource locator string, a byte count per request, a domain name, or a source address.

34. The method as recited in claim 21, wherein the plurality of time-stamped, searchable events comprise unstructured data.

35. The method as recited in claim 21, further comprising:

receiving an input corresponding to a selection of the summary of the event group summary; and

updating the graphical interface to display information related to at least one event in the event group summary.

36. The method as recited in claim 21, wherein the graphical interface includes a modify element associated with the event group summary, and wherein interaction with the modify element causes the event group summary to be visually modified in the graphical interface.

37. The method as recited in claim 21, further comprising:

generating a display that includes an add element and one or more event group summaries that have been removed from the graphical interface, wherein the one or more event group summaries include the event group summary, and wherein a user interaction with the add element causes the event group summary to be added back to the graphical interface; and

in response to a user interaction with the add element, updating the graphical interface to add the event group summary back to the graphical interface.

38. The method of claim 21, wherein the event group summary includes a result of a correlation search.

39. The method of claim 21, wherein the group of events is determined using an agent string that has been extracted from one or more events in the subset group of events.

40. The method of claim 21, wherein the group of events is determined using a particular length of a uniform resource locator string that has been extracted from one or more events in the group of events or a source address that has been extracted from one or more events in the group of events.

41. The method of claim 21, wherein each event in the plurality of time-stamped, searchable events is locatable in a searchable time-series data store using a time stamp of the event.

42. The method of claim 21, further comprising:

removing an event from the plurality of time-stamped, searchable events when the event is not recognized as notable.

43. The method as recited in claim 21, wherein each event in the plurality of time-stamped, searchable events includes information relating to security of the information technology environment

44. The method as recited in claim 21, further comprising:

segmenting stored raw machine data into the plurality of time-stamped, searchable events, wherein each event in the plurality of time-stamped, searchable events includes information relating to security of the information technology environment.

45. The method as recited in claim 21, wherein the event group summary includes a count of a number of events in the event group summary.

46. The method as recited in claim 21, further comprising:

extracting values for fields in events in the set of events, by applying a late binding schema to at least a portion of the plurality of events.

47. The method as recited in claim 21, further comprising:

evaluating whether events in the set of events satisfy the security criterion.

48. The method as recited in claim 21, further comprising:

evaluating whether events in the set of events satisfy the security criterion by applying a late binding schema to at least a portion of the plurality of events.

49. A non-transitory machine-readable storage medium storing instructions, execution of which in a computer system on a computing network causes performance of:

extracting, by a computer system, one or more values from each event in a plurality of time-stamped, searchable events, wherein the one or more values are extracted from a field present in raw machine data in each event, the machine data having been produced by one or more components of an information technology environment and indicative of activity in the information technology environment;

creating, by the computer system, an event group from a set of events in the plurality of time-stamped, searchable events, wherein each event in the set of events is associated with an extracted value that satisfies a security criterion;

creating, by the computer system, an event group summary for the event group, wherein the event group summary summarizes one or more fields present in the machine data in the events in the event group; and

causing, by the computer system, display of a plurality of event group summaries, including the event group summary, wherein the plurality of event group summaries are indicative of potential security threats in the information technology environment.

50. An apparatus comprising:

a value extraction device, implemented at least partially in hardware of one or more devices in a computer network, that when in operation extracts one or more values from each event in a plurality of time-stamped, searchable events, wherein the one or more values are extracted from a field present in raw machine data in each event, the machine data having been produced by one or more components of an information technology environment and indicative of activity in the information technology environment;

an event group creator, implemented at least partially in hardware, that when in operation creates an event group from a set of events in the plurality of time-stamped, searchable events, wherein each event in the set of events is associated with an extracted value that satisfies a security criterion;

a summary creator, implemented at least partially in hardware, that when in operation creates an event group summary for the event group, wherein the event group summary summarizes one or more fields present in the machine data in the events in the event group; and

a display generator, implemented at least partially in hardware, that when in operation causes display of a plurality of event group summaries, including the event group summary, wherein the plurality of event group summaries are indicative of potential security threats in the information technology environment.