METHOD AND SYSTEM FOR COLLABORATION DURING AN EVENT

• US 20090199274A1
• Filed: 02/01/2008
• Published: 08/06/2009
• Est. Priority Date: 02/01/2008
• Status: Active Grant

• Current Assignee: Fireeye Security Holdings US LLC
• Original Assignee: Mandiant LLC (Alphabet Inc.)
• Inventors: Frazier, Matthew, Cozzi, Lois, Shiffer, Jason, Mandia, Kevin, Merkel, David, Pepe, Matthew
• Granted Patent: US 9,106,630 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic

Abstract

A system and method for gathering data from a plurality of computer environments. The computer environments are authenticated, data is copied from the plurality of authenticated computer environments to a memory location, and access to the memory location is provided to a plurality of authenticated users. The data may be marked so that a user may determine which computer environment provided the data.

Claims

1. A method of gathering data in response to an event comprising:

(a) identifying a plurality of computer environments coupled to a network;

(b) authenticating the plurality of computer environments;

(c) authenticating a plurality of users;

(d) providing an interface to the plurality of authenticated users;

(e) allowing the plurality of authenticated users to gather the data from the plurality of authenticated computer environments through the interface;

(f) marking the gathered data as gathered from a particular authenticated computer environment; and

(g) providing access to the plurality of authenticated users to the gathered data.

2. The method of claim 1 wherein the event is a user request.

3. The method of claim 1 wherein the event is a response to an incident.

4. The method of claim 1 wherein the plurality of computer environments comprise servers.

5. The method of claim 1 wherein the plurality of computer environments comprise storage devices.

6. The method of claim 1 wherein the network is the Internet.

7. The method of claim 1 wherein the step of authenticating the plurality of computer environments utilizes a public key infrastructure.

8. The method of claim 1 wherein the plurality of users access the interface through the network.

9. The method of claim 8 wherein the plurality of users utilize different computers to access the interface.

10. The method of claim 1 wherein the data comprises metadata.

11. The method of claim 1 wherein the data comprises files of a type specified by the user.

12. The method of claim 1 wherein the gathering comprises copying the data to memory location defined by the user.

13. A method for gathering data in response to an incident comprising:

(a) contacting a plurality of storage devices coupled to a first computer;

(b) authenticating the identity of the storage devices;

(c) searching the plurality of storage devices for matching data that matches a predetermined criterion; and

(d) providing a list of matching data to a user through an interface on a second computer.

14. The method of claim 13 wherein the plurality of storage devices are servers.

15. The method of claim 13 wherein the plurality of storage devices are disk drives.

16. The method of claim 13 wherein the plurality of storage devices are coupled to the first computer through a network.

17. The method of claim 13 further comprising authenticating the plurality of storage devices.

18. The method of claim 13 further comprising obtaining the predetermined criterion from the user.

19. The method of claim 18 wherein the predetermined criterion is a file type.

20. The method of claim 13 further comprising copying the matching data to the second computer.

21. The method of claim 13 wherein the first computer is coupled to the second computer through the Internet.

22. The method of claim 13 wherein the matching data comprises metadata.

23. A system for gathering data comprising:

means for authenticating a plurality of computer environments;

means for presenting access to the plurality of computer environments to a user through an interface; and

means for enabling the user to copy data from the plurality of computer environments.