EVENT VIEWS IN DATA INTAKE STAGE OF MACHINE DATA PROCESSING PLATFORM

• US 20170063903A1
• Filed: 10/30/2015
• Published: 03/02/2017
• Est. Priority Date: 08/31/2015
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Muddu, Sudhakar, Tryfonas, Christos, Bulusu, Ravi Prasad
• Granted Patent: US 10,243,970 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/24578 using ranking
• CPC Class Codes: G06F 16/254 Extract, transform and load [ETL] procedures, e.g. ETL data flows in data warehouses
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/444 Spatial browsing, e.g. 2D maps, 3D or virtual spaces
• CPC Class Codes: G06F 16/9024 Graphs; Linked lists G06F16/9027 takes precedence
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/0484 for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06F 3/04847 Interaction techniques to control parameter settings, e.g. interaction with sliders or dials
• CPC Class Codes: G06F 40/134 Hyperlinking
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 20/20 Ensemble learning
• CPC Class Codes: G06N 5/022 Knowledge engineering; Knowledge acquisition
• CPC Class Codes: G06N 5/04 Inference or reasoning models
• CPC Class Codes: G06N 7/01 Probabilistic graphical models, e.g. probabilistic networks
• CPC Class Codes: G06V 10/225 based on a marking or identifier characterising the area
• CPC Class Codes: H04L 2463/121 Timestamp cryptographic mechanisms or cryptographic arrangements involving time stamps H04L9/3297
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/00 : Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/045 : for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/062 : related to network traffic
• CPC Class Codes: H04L 43/08 : Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 63/06 : for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/1408 : by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 : Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 : Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 : Vulnerability analysis
• CPC Class Codes: H04L 63/1441 : Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A security platform employs a variety techniques and mechanisms to detect security related anomalies and threats in a computer network environment. The security platform is “big data” driven and employs machine learning to perform security analytics. The security platform performs user/entity behavioral analytics (UEBA) to detect the security related anomalies and threats, regardless of whether such anomalies/threats were previously known. The security platform can include both real-time and batch paths/modes for detecting anomalies and threats. By visually presenting analytical results scored with risk ratings and supporting evidence, the security platform enables network security administrators to respond to a detected anomaly or threat, and to take action promptly.

Claims

1. A method comprising:

receiving event data representing an event on a computer network; and

adding a view identifier to the event data to allow a downstream entity, by having designated the view identifier, to receive select information about the event, through an interface identified by the view identifier,

wherein the interface extracts the select information from and/or generates the select information based on the event data.

2. The method of claim 1, wherein the interface further includes logic operable to perform an action on the event data representing the event to generate the select information.

3. The method of claim 1, wherein the interface further includes logic operable to perform an action on the event data representing the event to generate the select information, and wherein the interface further includes an input for controlling the action that the logic performs.

4. The method of claim 1, wherein the select information only includes a defined subset of a complete set of the event data representing the event.

5. The method of claim 1, further comprising:

repeating said identifying and adding steps for event data representing each of a plurality of events to enable, via the interface, a uniform way to access information about the plurality of events.

6. The method of claim 1, further comprising:

repeating said identifying and adding steps for event data representing each of a plurality of events to enable, via the interface, a uniform way to access information about the plurality of events, wherein event data representing the plurality of events are in different data formats.

7. The method of claim 1, further comprising:

repeating said adding step for event data representing each of a plurality of events that belong to a same category as the event to enable, via the interface, a uniform way to access information about the plurality of events.

8. The method of claim 1, further comprising:

determining an event category to which the event belongs, from a plurality of event categories, based on the event data, wherein the view identifier and the interface correspond to the event category.

9. The method of claim 1, further comprising:

determining an event category to which the event belongs, from a plurality of event categories, based on a type of a machine that generated the event, wherein the view identifier and the interface correspond to the event category.

10. The method of claim 1, wherein the view identifier and the interface correspond to an event category to which the event belongs.

11. The method of claim 1, further comprising:

determining an event category to which the event belongs, from a plurality of event categories, based on a type of a machine that generated the event, wherein the view identifier and the interface correspond to the event category, the event category characterizing events generated by a plurality of types of machines.

12. The method of claim 1, wherein said identifying step comprises parsing the event data based on a predetermined data format.

13. The method of claim 1, wherein said identifying step comprises parsing the event data based on a predetermined data format that specifies which data in the event represent a key or a value.

14. The method of claim 1, wherein the view identifier is added as a field in the event.

15. The method of claim 1, further comprising:

identifying a plurality of attributes of the event, based on the event data,

wherein the select information includes a defined subset of the plurality of attributes of the event.

16. The method of claim 1, further comprising:

identifying a plurality of attributes of the event, based on the event data,

wherein the select information includes a defined subset of the plurality of attributes of the event,

wherein the attributes include at least one of;

a key, a value, or a key-value pair.

17. The method of claim 1, further comprising:

performing, by the downstream entity, analytics on event data representing a plurality of events using information about the plurality of events.

18. The method of claim 1, further comprising:

performing, by the downstream entity, analytics on event data representing a plurality of events using information about the plurality of events,

wherein information accessible via the interface includes at least one of;

(1) information generated by logic included in the interface, the logic being operable to perform an action on the event data representing the plurality of events, or (2) a predefined subset of a complete set of the event data representing the plurality of events.

19. The method of claim 1, further comprising:

using the view identifier to determine whether the event is relevant to the downstream entity.

20. The method of claim 1, further comprising:

automatically routing the information to the downstream entity having designated the view identifier.

21. The method of claim 1, further comprising:

automatically routing the information to the downstream entity having designated the view identifier,

wherein the downstream entity is configured to identify security-oriented anomalies represented by the event.

22. The method of claim 1, wherein the event data comprises machine data.

23. The method of claim 1, wherein the event data comprises timestamped machine data.

24. The method of claim 1, further comprising:

configuring said adding step by making an adjustment to a configuration file.

25. The method of claim 1, wherein the method is performed as part of an extract-transform-load stage of at least one of a distributed event processing system or an anomaly detection system.

26. A computer system comprising:

a communication device; and

a processor configured to;

receive, via the communication device, event data representing an event on a computer network; and

add a view identifier to the event data to allow a downstream entity, by having designated the view identifier, to receive select information about the event, through an interface identified by the view identifier,

wherein the interface extracts the select information from and/or generates the select information based on the event data.

27. The computer system of claim 26, wherein the interface further includes logic operable to perform an action on the event data representing the event to generate the select information.

28. The computer system of claim 26, wherein the select information only includes a defined subset of a complete set of the event data representing the event.

29. The computer system of claim 26, wherein the processor is further configured to:

repeat said identifying and adding steps for event data representing each of a plurality of events to enable, via the interface, a uniform way to access information about the plurality of events.

30. A non-transitory machine-readable storage medium for use in a processing system, the non-transitory machine-readable storage medium storing instructions, an execution of which in the processing system causes the processing system to perform operations comprising:

receiving event data representing an event on a computer network; and

adding a view identifier to the event data to allow a downstream entity, by having designated the view identifier, to receive select information about the event, through an interface identified by the view identifier,

wherein the interface extracts the select information from and/or generates the select information based on the event data.