Directing audited data traffic to specific repositories
First Claim
1. A computer-implemented method for auditing data traffic, the computer-implemented process comprising:
- monitoring data traffic on a network and collecting data access elements thereof;
comparing the collected data access elements to security rules;
sending a first audit data collection to a first repository in response to one or more data access elements of a first data access matching a first condition of one of the security rules, wherein the one of the security rules having the first condition designates the first audit data collection and the first repository;
sending a second audit data collection to a second repository in response to one or more data access elements of a second data access matching a second condition of one of the security rules, wherein the one of the security rules having the second condition designates the second audit data collection and the second repository;
applying, in response to the matching first condition, a tag to data traffic of the first data access and discontinuing, responsive to applying the tag, the comparing of collected data access elements to the corresponding one of the security rules having the matching first condition, wherein the tag indicates a repository and the data traffic includes at least one of a connection and session; and
sending, in response to the tag in the tagged data traffic, an audit data collection to the repository indicated by the tag for a data access, wherein the computer-implemented process continues sending audit data for future data accesses that are in the tagged data traffic without the comparing to the corresponding one of the security rules again.
1 Assignment
0 Petitions
Accused Products
Abstract
Data traffic is monitored on a network and data access elements thereof are collected. The collected data access elements are compared to security rules. A first audit data collection is sent to a first repository in response to one or more data access elements of a first data access matching a first condition of one of the security rules. The one of the security rules having the first condition designates the first audit data collection and the first repository. A second audit data collection is sent to a second repository in response to one or more data access elements of a second data access matching a second condition of one of the security rules. The one of the security rules having the second condition designates the second audit data collection and the second repository.
37 Citations
17 Claims
-
1. A computer-implemented method for auditing data traffic, the computer-implemented process comprising:
-
monitoring data traffic on a network and collecting data access elements thereof; comparing the collected data access elements to security rules; sending a first audit data collection to a first repository in response to one or more data access elements of a first data access matching a first condition of one of the security rules, wherein the one of the security rules having the first condition designates the first audit data collection and the first repository; sending a second audit data collection to a second repository in response to one or more data access elements of a second data access matching a second condition of one of the security rules, wherein the one of the security rules having the second condition designates the second audit data collection and the second repository; applying, in response to the matching first condition, a tag to data traffic of the first data access and discontinuing, responsive to applying the tag, the comparing of collected data access elements to the corresponding one of the security rules having the matching first condition, wherein the tag indicates a repository and the data traffic includes at least one of a connection and session; and sending, in response to the tag in the tagged data traffic, an audit data collection to the repository indicated by the tag for a data access, wherein the computer-implemented process continues sending audit data for future data accesses that are in the tagged data traffic without the comparing to the corresponding one of the security rules again. - View Dependent Claims (2, 3, 4, 5, 6)
-
-
7. A system comprising:
-
at least one hardware computing processor; and a non-transitory computer-readable storage media connected to the at least one computing processor, wherein the computer-readable storage media has stored thereon a data traffic auditing program for controlling the at least one computing processor, and wherein the at least one computing processor is operative with the program to execute the program to; monitor data traffic on a network and collecting data access elements thereof; compare the collected data access elements to security rules; send a first audit data collection to a first repository in response to one or more data access elements of a first data access matching a first condition of one of the security rules, wherein the one of the security rules having the first condition designates the first audit data collection and the first repository; send a second audit data collection to a second repository in response to one or more data access elements of a second data access matching a second condition of one of the security rules, wherein the one of the security rules having the second condition designates the second audit data collection and the second repository; apply, in response to the matching first condition, a tag to data traffic of the first data access and discontinue, responsive to applying the tag, the comparing of collected data access elements to the corresponding one of the security rules having the matching first condition, wherein the tag indicates a repository and the data traffic includes at least one of a connection and session; and send, in response to the tag in the tagged data traffic, an audit data collection to the repository indicated by the tag for a data access, wherein the computer-implemented process continues sending audit data for future data accesses that are in the tagged data traffic without the comparing to the corresponding one of the security rules again. - View Dependent Claims (8, 9, 10, 11, 12)
-
-
13. A non-transitory computer program product for auditing data traffic, the computer program product comprising:
-
a non-transitory computer-readable storage medium; and computer-readable program code embodied in the computer-readable storage medium, wherein the computer-readable program code is configured to cause at least one hardware computing processor to; monitor data traffic on a network and collecting data access elements thereof; compare the collected data access elements to security rules; send a first audit data collection to a first repository in response to one or more data access elements of a first data access matching a first condition of one of the security rules, wherein the one of the security rules having the first condition designates the first audit data collection and the first repository; send a second audit data collection to a second repository in response to one or more data access elements of a second data access matching a second condition of one of the security rules, wherein the one of the security rules having the second condition designates the second audit data collection and the second repository; apply, in response to the matching first condition, a tag to data traffic of the first data access and discontinue, responsive to applying the tag, the comparing of collected data access elements to the corresponding one of the security rules having the matching first condition, wherein the tag indicates a repository and the data traffic includes at least one of a connection and session; and send, in response to the tag in the tagged data traffic, an audit data collection to the repository indicated by the tag for a data access, wherein the computer-implemented process continues sending audit data for future data accesses that are in the tagged data traffic without the comparing to the corresponding one of the security rules again. - View Dependent Claims (14, 15, 16, 17)
-
Specification