System, method, and computer program product for displaying network events in terms of objects managed by a security appliance and/or a routing device

• US 8,448,221 B2
• Filed: 03/12/2010
• Issued: 05/21/2013
• Est. Priority Date: 03/12/2010
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Pearcy, Derek Patton, Caldera, Jose
• Primary Examiner(s): McNally, Michael S
• Application Number:
  US12/723,558
• Publication Number:
  US 20110225622A1
• Time in Patent Office: 1,166 Days
• Field of Search: 715/734, 715/735, 715/736, 709/224, 726/1
• US Class Current: 726/1
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A system, method, and computer program product are provided for displaying network events in terms of objects managed by at least one of a security appliance and a routing device. In use, network events are received. Furthermore, the network events are displayed in terms of objects being managed by at least one of a security appliance and a routing device.

Claims

1. A computer program product embodied on a non-transitory tangible computer readable medium for performing operations in conjunction with a processor, the operations comprising:

receiving network events that are generated in response to a policy that outlines which segments of network traffic should be monitored to identify the network events, and wherein the policy includes a rule that indicates particular network traffic that was denied from being forwarded to a destination from a security appliance as qualifying to be included in the network events; and

displaying the network events in terms of objects being managed by at least one of the security appliance and a routing device, wherein the displaying includes displaying a trend graph illustrating a volume of data over a particular timeframe and a comparison of allowed network events and denied network events.

2. The computer program product of claim 1, wherein the computer program product is operable such that the network events are received from the at least one of the security appliance and the routing device.

3. The computer program product of claim 1, wherein the network events include a description of network traffic processed by the at least one of the security appliance and the routing device.

4. The computer program product of claim 3, wherein the description identifies a source of the network traffic, a destination of the network traffic, and an application utilized for communicating the network traffic.

5. The computer program product of claim 4, wherein the application includes a port number, a service, a protocol, or an identifier.

6. The computer program product of claim 1, wherein the computer program product is operable such that displaying the network events in terms of the objects being managed by the at least one of the security appliance and the routing device includes displaying a summary of the network events utilizing a graph with axes indicative of the objects.

7. The computer program product of claim 6, wherein the objects include at least one source of network traffic from which the network events were generated, such that a first one of the axes represents the at least one source.

8. The computer program product of claim 6, wherein the objects include at least one destination of network traffic from which the network events were generated, such that a second one of the axes represents the at least one destination.

9. The computer program product of claim 6, wherein the objects include at least one application utilized for communicating network traffic from which the network events were generated, such that a third one of the axes represents the at least one application.

10. The computer program product of claim 1, wherein the computer program product is operable such that the objects being managed by the security appliance are defined in a policy of the security appliance.

11. The computer program product of claim 1, wherein the computer program product is operable such that the objects being managed by the routing device are defined in a policy of an application displaying the network events in terms of the objects.

12. The computer program product of claim 1, wherein the displayed network events include a subset of all received network events.

13. The computer program product of claim 12, wherein the subset includes network events that occurred during a first time period selected by a user.

14. The computer program product of claim 13, wherein the subset includes network events that occurred during a second time period automatically selected based on the first time period.

15. The computer program product of claim 14, wherein the first time period is different from the second time period.

16. The computer program product of claim 14, wherein the computer program product is operable such that the network events are displayed in a manner that compares the network events that occurred during the first time period with the network events that occurred during the second time period.

17. The computer program product of claim 15, wherein the computer program product is operable such that the comparison is utilized for indicating an effect of a change to a configuration of the management of the objects that occurred between the first time period and the second time period.

18. A method to be performed in conjunction with a processor and a memory, the method comprising:

receiving network events that are generated in response to a policy that outlines which segments of network traffic should be monitored to identify the network events, and wherein the policy includes a rule that indicates particular network traffic that was denied from being forwarded to a destination from a security appliance as qualifying to be included in the network events; and

displaying the network events in terms of objects being managed by at least one of the security appliance and a routing device, wherein the displaying includes displaying a trend graph illustrating a volume of data over a particular timeframe and a comparison of allowed network events and denied network events.

19. A system, comprising:

a processor and a memory, wherein the system is configured for;

receiving network events that are generated in response to a policy that outlines which segments of network traffic should be monitored to identify the network events, and wherein the policy includes a rule that indicates particular network traffic that was denied from being forwarded to a destination from a security appliance as qualifying to be included in the network events, and

displaying the network events in terms of objects being managed by at least one of the security appliance and a routing device, wherein the displaying includes displaying a trend graph illustrating a volume of data over a particular timeframe and a comparison of allowed network events and denied network events.

20. The system of claim 19, wherein the processor is coupled to the memory via a bus.