Method and system for collaboration during an event

• US 9,106,630 B2
• Filed: 02/01/2008
• Issued: 08/11/2015
• Est. Priority Date: 02/01/2008
• Status: Active Grant

• Current Assignee: Fireeye Security Holdings US LLC
• Original Assignee: Mandiant LLC (Alphabet Inc.)
• Inventors: Frazier, Matthew, Shiffer, Jason, Merkel, David, Mandia, Kevin, Cozzi, Lois, Pepe, Matthew
• Primary Examiner(s): HENNING, MATTHEW T
• Application Number:
  US12/024,834
• Publication Number:
  US 20090199274A1
• Time in Patent Office: 2,748 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic

Abstract

A system and method for gathering data from a plurality of computer environments. The computer environments are authenticated, data is copied from the plurality of authenticated computer environments to a memory location, and access to the memory location is provided to a plurality of authenticated users. The data may be marked so that a user may determine which computer environment provided the data.

Claims

1. A method of gathering data in response to an event comprising:

identifying, by an agent discovery service, a plurality of computer environments coupled to a network;

authenticating, by a controller communicatively coupled to the agent discovery service, the plurality of computer environments;

authenticating, by the controller, one or more users;

providing, by the controller, an interface to an authenticated user of the one or more users;

allowing, by the controller, the authenticated user to define a parameter identifying a characteristic of data to be gathered from the plurality of authenticated computer environments;

allowing, by the controller, the authenticated user to reduce an amount of data gathered and transported from each of the plurality of authenticated computer environments by remotely (i) comparing data in the authenticated computer environments with the parameter and (ii) filtering out data that does not satisfy the parameter so that (a) filtered out data is remotely separated from other data, (b) the filtered out data is not transported from at least one of the plurality of authenticated computer environments, and (c) the other data is transported from the one of the plurality of authenticated computer environments;

marking, by the controller, the gathered data as gathered from a particular authenticated computer environment; and

providing, by the controller, access to the authenticated user to the gathered data,

wherein,

the characteristic of data to be gathered from the plurality of authenticated computer environments relates to at least one of (i) a deleted file, (ii) program or process execution, (c) program or process installation, (iii) access history, and (iv) a system log, and

the parameter is a file hash for searching for encrypted files.

2. The method of claim 1 wherein the event is a user request.

3. The method of claim 1 wherein the event is a response to an incident.

4. The method of claim 1 wherein the plurality of computer environments comprise servers.

5. The method of claim 1 wherein the plurality of computer environments comprise storage devices.

6. The method of claim 1 wherein the network is the Internet.

7. The method of claim 1 wherein the step of authenticating the plurality of computer environments utilizes a public key infrastructure.

8. The method of claim 1 wherein the authenticated user accesses the interface through the network.

9. The method of claim 8 wherein the authenticated user utilizes different computers to access the interface.

10. The method of claim 1 wherein the data comprises metadata.

11. The method of claim 1 wherein the data comprises files of a type specified by the authenticated user.

12. The method of claim 1 wherein the gathering comprises copying data to memory location defined by the authenticated user.

13. The method of claim 1, further comprising the steps of:

storing the gathered data according to a formal storage syntax, and

enabling the authenticated user to perform at least one of (i) a search of the gathered data stored according to the formal storage syntax, and (ii) relational comparison of the gathered data stored according to the formal storage syntax with data also stored according to the formal storage syntax.

14. A method of gathering data in response to an event comprising:

identifying, by an agent discovery service, a plurality of computer environments coupled to a network;

authenticating, by a controller communicatively coupled to the agent discovery service, the plurality of computer environments;

authenticating, by the controller, at least one user;

providing, by the controller, an interface to the at least one authenticated user;

allowing, by the controller, the at least one authenticated user to define a parameter identifying a characteristic of data to be gathered from the plurality of authenticated computer environments;

allowing, by the controller, the at least one authenticated user to gather data from the plurality of authenticated computer environments through the interface including by (i) comparing data in the authenticated computer environments with the parameter, and (ii) filtering out data that does not satisfy the parameter so that (a) filtered out data is remotely separated from other data, (b) the filtered out data is not transported from at least one of the plurality of authenticated computer environments, and (c) the other data is transported from the one of the plurality of authenticated computer environments;

marking, by the controller, the gathered data as gathered from the one of the plurality of authenticated computer environments; and

providing, by the controller, access to the at least one authenticated user to the gathered data;

wherein,

the data to be gathered from the plurality of authenticated computer environments was not previously stored in the authenticated computer environments at the direction or pursuant to the instructions of the at least one authenticated user, and

the parameter is a file hash for searching for encrypted files.

15. The method of claim 14, further comprising the step of:

performing, by the controller, a relational comparison of the gathered data with data stored according to a formal storage syntax.

16. A method of gathering data in response to an event comprising:

identifying, by an agent discovery service, a plurality of computer environments coupled to a network;

authenticating, by a controller communicatively coupled to the agent discovery service, the plurality of computer environments;

authenticating, by the controller, one or more of a plurality of users;

providing, by the controller, an interface to the plurality of an authenticated user of the one or more users;

allowing, by the controller, one or more of the authenticated user to define a parameter identifying a characteristic of data to be gathered from the plurality of authenticated computer environments;

allowing, by the controller, the authenticated user to reduce, using an auditor module, an amount of data gathered and transported from each of the plurality of authenticated computer environments by remotely (i) comparing data in the authenticated computer environments with the parameter and (ii) filtering out data that does not satisfy the parameter so that (a) filtered out data is remotely separated from other data, (b) the filtered out data is not transported from at least one of the plurality of authenticated computer environments, and (c) the other data is transported from the one of the plurality of authenticated computer environments;

marking, by the controller, the gathered data as gathered from the one of the plurality of authenticated computer environments; and

providing, by the controller, access to the authenticated user to the gathered data,

wherein,

the parameter is a file hash for searching for encrypted files.

17. The method of claim 16, wherein the gathered data enables the authenticated user to at least one of (i) access information sought by an attacker during a security breach, (ii) determine how a breach occurred, and (iii) determine whether an attacker has stored data on a system.