Event-driven customizable automated workflows for incident remediation

• US 20080040191A1
• Filed: 12/22/2006
• Published: 02/14/2008
• Est. Priority Date: 08/10/2006
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Novell Incorporated (Open Text Corporation)
• Inventors: Capuano, David, Mallapragada, Srinivasa Phanindra, Choudhary, Usman, Chakravarty, Dipto, Antony, John Melvin
• Granted Patent: US 9,715,675 B2
• Time in Patent Office: Days
• US Class Current: 705/9
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 10/063114 Status monitoring or status determination for a person or group
• CPC Class Codes: G06Q 10/06316 Sequencing of tasks or work
• CPC Class Codes: G06Q 10/0633 Workflow analysis
• CPC Class Codes: G06Q 10/10 Office automation; Time management

Abstract

The invention relates to a system and method for customizing and storing workflow processes for use in remediation incidents such as security events. One aspect of the invention relates to providing tools to enable creation of customized workflow processes for event driven incident remediation, monitoring and analyzing system activity to identify occurrence of incidents, assigning a workflow process to an incident, applying the assigned workflow process to remediate the incident, and tracking and graphically displaying the status of the workflow process, among other things.

Claims

1. A computer implemented method for event driven incident response including one or more workflow process instances for handling incident response, each having one or more work-items, the method comprising:

monitoring network activity for one or more network events;

identifying occurrence of one or more incidents based on the one or more network events;

associating at least one workflow process instance to an identified incident based at least in part on incident details;

determining the work-items to perform based on the workflow process instance, wherein the work-items include one or more user work-items and system work-items;

automatically implementing the one or more system work-item;

notifying a user to complete one or more user work-item; and

tracking progress of the incident'"'"'s workflow process instance based on output from the work-items.

2. The method of claim 1, wherein the one or more network events is a policy event based on violation of a network policy.

3. The method of claim 1, wherein the one or more network events is a compliance event based on network compliance breach.

4. The method of claim 1, wherein the workflow process instance is a corporate governance workflow, compliance workflow, or policy workflow.

5. The method of claim 1, wherein the incident details include information associated with the incident including the one or more events, affected assets, vulnerable assets, one or more violated policies, compliance breach information, or corporate governance information.

6. The method of claim 1, wherein the method of tracking further comprises the step of tracking progress of multiple workflow process instances.

7. The method of claim 1, wherein the method further comprises the step of:

creating an incident object for the identified incident;

recording incident details and the assigned workflow process instance within the incident object;

updating the incident object with status information for the progress of the incident'"'"'s workflow process instance based on output from the work-items.,

8. The method of claim 1, wherein the method of associating further comprises the step of automatically associating an incident to a workflow process instance.

9. The method of claim 1, wherein the method of associating further comprises the step of manually associating an incident to a workflow process instance.

10. The method of claim 1, wherein the method of associating is further based on workflow association rules.

11. The method of claim 1, wherein the method of notifying further comprises sending notification to user or group of users based on identity or role.

12. The method of claim 1, wherein the method of automatically implementing further comprises performing an action on a network device that is determined to be related to the incident.

13. The method of claim 7, wherein the method further comprises displaying an incident response screen for one or more incident objects, including real-time visual representation for the status information for the progress of the workflow process instances.

14. The method of claim 1, wherein the method further comprises determining whether the incident is resolved based on successful completion of the workflow process instance.

15. The method of claim 14, wherein the method further comprises storing information related to resolved incidents.

16. The method of claim 15, wherein the method further comprises auditing incident response based on stored information related to resolved incidents.

17. A computer implemented system for event driven incident response including one or more workflow process instances for handling incident response, each having one or more work-items, the system comprising:

a network activity monitoring means for monitoring network activity for one or more network events;

a correlation engine identifying occurrence of one or more incidents based on the one or more network events;

an assignment module for associating at least one workflow process instance to an identified incident based at least in part on incident details;

a workflow module determining the work-items to perform based on the workflow process instance, wherein the work-items include one or more user work-items and system work-items;

means for automatically implementing the one or more system work-item;

means for notifying a user to complete one or more user work-item; and

an incident tracking module tracking progress of the incident'"'"'s workflow process instance based on output from the work-items.

18. The system of claim 17, wherein the one or more network events is a policy event created based on violation of a network policy.

19. The system of claim 17, wherein the one or more network events is a compliance event based on network compliance breach.

20. The system of claim 17, wherein the workflow process instance is a corporate governance workflow, compliance workflow, or policy workflow.

21. The system of claim 17, wherein the incident details include information associated with the incident including the one or more events, affected assets, vulnerable assets, one or more violated policies, compliance breach information, or corporate governance information.

22. The system of claim 17, wherein the incident tracking module further comprises means for tracking progress of multiple workflow process instances.

23. The system of claim 17, wherein the system further comprises:

creating means for creating an incident object for the identified incident;

recording means for recording incident details and the assigned workflow process instance within the incident object;

updating means for updating the incident object with status information for the progress of the incident'"'"'s workflow process instance based on output from the work-items.

24. The system of claim 17, wherein the assignment module further comprises means for automatically associating an incident to a workflow process instance.

25. The system of claim 17, wherein the assignment module further comprises means for manually associating an incident to a workflow process instance.

26. The system of claim 17, wherein the assignment module further comprises means for assigning workflow process instances based on workflow association rules.

27. The system of claim 17, wherein the means for notifying further comprises means for sending notification to user or group of users based on their identity or role.

28. The system of claim 17, wherein the means for automatically implementing further comprises means for performing an action on a network device that is determined to be related to the incident.

29. The system of claim 23, wherein the system further comprises means for displaying an incident response screen for one or more incident objects, including real-time visual representation for the status information for the progress of the workflow process instances.

30. The system of claim 17, wherein the system further comprises means for determining whether the incident is resolved based on successful completion of the workflow process instance.

31. The system of claim 30, wherein the system further comprises database for storing information related to resolved incidents.

32. The system of claim 31, wherein the system further comprises means for auditing incident response based on stored information related to resolved incidents.

33. A computer implemented method for creating a customized event driven workflow process instance for handling incidents, comprising:

selecting two or more of a plurality of work-items to include into a workflow process instance;

creating transitions to include in the workflow process instance, the transitions defining a decision process between two or more work-items;

verifying workflow process instance as the work-item and the transitions are added to the workflow process instance;

storing the verified workflow process instance;

34. The method of claim 33, wherein the method further comprises the step of:

assigning the workflow process instance to a network incident based on workflow assignment rules;

resolving the network incident by executing the assigned workflow process instance.

35. The method of claim 33, wherein the method of selecting and creating are performed using a visual user interface.

36. The method of claim 33, wherein the visual user interface includes panels for:

process details, process elements, element properties, messages, work-item palette, overview and toolbars/menu bars.

37. The method of claim 36, wherein the panel for process details allow user to view and edit the workflow process instance rendered as a flow chart.

38. The method claim 36, wherein the panel for process elements displays available work-items in a tree view.

39. The method of claim 36, wherein the panel for element properties displays attributes of a selected process element, wherein the process element is selected from a process graph view or process tree view.

40. The method of claim 36, wherein the panel for messages displays error messages, if any, from the verification step.

41. The method of claim 36, wherein the panel for work-item palette lists the plurality of work-items that may be dragged and dropped from the work-item palette to the process graph to create work-items within a custom workflow process instance.

42. The method of claim 36, wherein the panel for overview displays a scaled down version of a workflow process instance graph at all times.

43. The method of claim 33, wherein the plurality of work-items define actions to be taken.

44. The method of claim 43, wherein the work-items are manual work-items or system work-items.

45. The method of claim 44, wherein the system work-items is a command work-item, template work-item, alert work-item or decision work-item.

46. The method of claim 33, wherein transitions are based on variables defined within the work-item.

47. The method of claim 33, wherein method further comprises enabling the user to add, remove, and modify work-items via user interface.

48. The method of claim 33, wherein the method further comprises tracking progress of the workflow process within visual representation of workflow process instance.

49. The method of claim 33, wherein the method of verifying further comprises detecting errors in a workflow process instance as it is created.

50. The method of claim 44, wherein manual work-item within the workflow process may be assigned to a specified user or role.

51. The method of claim 50, wherein a later manual work-item is assigned to the same specified user or role as a former manual work-item.

52. The method of claim 33, wherein the transitions are one of:

unconditional transitions, conditional transition, else transition, error transition, time out transition or alert transition.

53. A computer implemented system including a workflow module for creating a customized event driven workflow process instance for handling incidents, comprising:

selecting means for selecting two or more of a plurality of work-items to include into a workflow process instance;

creating means for creating transitions to include in the workflow process instance, the transitions defining a decision process between two or more work-items;

verifying means for verifying workflow process instance as the work-item and the transitions are added to the workflow process instance; and

database for storing the verified workflow process instance.

54. The system of claim 53, wherein the system further comprises:

means for assigning the workflow process instance to a network incident based on workflow assignment rules; and

means for resolving the network incident by executing the assigned workflow process instance.

55. A computer implemented system including a user interface to create and track. workflow process instances for event driven incident remediation, the system comprising:

editing means for creating a workflow process instance;

storing means for storing one or more workflow process instances;

identifying means for identifying one or more incidents

assigning means for assigning one or the stored workflow process instances to the identified incident;

executing means for executing the workflow process instance; and

tracking means for tracking status the assigned workflow process instance.

56. A computer implemented method for presenting a user interface for creating and tracking workflow process instances for event driven incident remediation, the system comprising:

creating a workflow process instance;

storing one or more workflow process instances;

identifying one or more incidents

assigning one or the stored workflow process instances to the identified incident;

executing the workflow process instance; and

tracking status the assigned workflow process instance.