# US 10,320,845 B2 · Recommended security action feature sets > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,320,845 B2 - Document ID: US10320845B2 - Status: Granted - Kind: B2 - Application number: 15/206,632 - Filed: 2016-07-11 - Published: 2017-01-12 - Granted: 2019-06-11 - Earliest claimed: 2015-07-09 - Assignees: Splunk Inc. - Applicants: Splunk Inc. - Inventors: Sourabh Satish; Oliver Friedrichs; Atif Mahadik; Govind Salinas; Ryan Russell - Web page: https://patentgrep.com/patent/US10320845B2 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 21/00: Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems, methods, and software described herein provide for identifying recommended feature sets for new security applications. In one example, a method of providing recommended feature sets for a new security application includes identifying a request for the new security application, and determining a classification for the new security application. The method further provides identifying related applications to the new security application based on the classification, and identifying a feature set for the new security application based on features provided in the related applications. ## Claims ### Claim 1 A method comprising: identifying a request to generate a new security application; determining a classification for the new security application based on security responsibilities of the new security application; identifying related applications with the same classification; identifying features implemented in the related applications; and identifying a recommended feature set comprising one or more features for the new security application, wherein the recommended feature set is identified based on the features implemented in the related applications, wherein each feature in the feature set is associated with a unified command to implement the feature in the related applications that have the feature, and wherein the unified command is translated by each application that has the feature into operations associated with the application. ### Claim 2 (depends on 1) The method of claim 1 wherein determining the classification for the new security application comprises: generating a user interface to receive the classification for the new security application; and receiving the classification from a developer for the new security application via the user interface. ### Claim 3 (depends on 1) The method of claim 1 wherein the new security application comprises one of a firewall, an antivirus application, a ticketing application, or a backup application. ### Claim 4 (depends on 1) The method of claim 1 wherein the features comprise security actions to be taken against security threats of a computing network. ### Claim 5 (depends on 1) The method of claim 1 further comprising: maintaining at least one data structure, the data structure associating applications with available features; and wherein identifying the features implemented in the related applications comprises identifying the features implemented in the related applications based on the at least one data structure. ### Claim 6 (depends on 1) The method of claim 1 wherein the unified command comprises a command in a unified syntax for an administrator of a computing network. ### Claim 7 (depends on 1) The method of claim 1 wherein the related applications comprise applications to provide security operations on different computing system hardware or software configurations. ### Claim 8 A computing apparatus comprising: one or more non-transitory computer readable storage media; a processing system operatively coupled with the one or more non-transitory computer readable storage media; and program instructions stored on the one or more non-transitory computer readable storage media that, when executed by the processing system, direct the processing system to at least: identify a request to generate a new security application; determine a classification for the new security application based on security responsibilities of the new security application; identify related applications with the same classification; identify features implemented in the related applications; and identify a recommended feature set comprising one or more features for the new security application, wherein the recommended feature set is identified based on the features implemented in the related applications, wherein each feature in the feature set is associated with a unified command to implement the feature in the related applications that have the feature, and wherein the unified command is translated by each application that has the feature into operations associated with the application. ### Claim 9 (depends on 8) The computing apparatus of claim 8 wherein the program instructions to determine the classification for the new security application direct the processing system to generate a user interface to receive the classification for the new security application and receive the classification from a developer via the user interface. ### Claim 10 (depends on 8) The computing apparatus of claim 8 wherein the new security application comprises one of a firewall, an antivirus application, a ticketing application, or a backup application. ### Claim 11 (depends on 8) The computing apparatus of claim 8 wherein the features comprise security actions to be taken against security threats of a computing network. ### Claim 12 (depends on 8) The computing apparatus of claim 8: wherein the program instructions further direct the processing system to maintain at least one data structure, the data structure associating applications with available features; and wherein identifying the features implemented in the related applications comprises identifying the features implemented in the related applications based on the at least one data structure. ### Claim 13 (depends on 8) The computing apparatus of claim 8 wherein the unified command comprises a command in a unified syntax for an administrator of a computing network. ### Claim 14 (depends on 8) The computing apparatus of claim 8 wherein the related applications comprise applications to provide security operations on different computing system hardware or software configurations. ### Claim 15 An apparatus comprising: one or more non-transitory computer readable storage media; program instructions stored on the one or more non-transitory computer readable storage media that, when executed by a processing system, direct the processing system to at least: identify a request to generate a new security application; determine a classification for the new security application based on security responsibilities of the new security application; identify related applications with the same classification; identify features implemented in the related applications; and identify a recommended feature set comprising one or more features for the new security application, wherein the recommended feature set is identified based on the features implemented in the related applications, wherein each feature in the feature set is associated with a unified command to implement the feature in the related applications that have the feature, and wherein the unified command is translated by each application that has the feature into operations associated with the application. ### Claim 16 (depends on 15) The apparatus of claim 15 wherein the program instructions to determine the classification for the new security application direct the processing system to generate a user interface to receive the classification for the new security application and receive the classification from a developer via the user interface. ### Claim 17 (depends on 15) The apparatus of claim 15 wherein the new security application comprises one of a firewall, an antivirus application, a ticketing application, or a backup application. ### Claim 18 (depends on 15) The apparatus of claim 15 wherein the features comprise security actions to be taken against security threats of a computing network. ### Claim 19 (depends on 15) The apparatus of claim 15: wherein the program instructions further direct the processing system to maintain at least one data structure, the data structure associating applications with available features; and wherein identifying the features implemented in the related applications comprises identifying the features implemented in the related applications based on the at least one data structure. ### Claim 20 (depends on 15) The apparatus of claim 15 wherein the program instructions to determine the classification for the new security application direct the processing system to receive the classification for the new security application from a developer of the new security application.