Back to results
US 10,380,548 B2Granted
Event-driven customizable automated workflows for incident remediation
AssigneeOracle International Corporation
InventorsDipto Chakravarty, John Melvin Antony, Usman Choudhary, David Capuano, Srinivasa Phanindra Mallapragada
Life of this patent
Estimating the term…
Abstract
The invention relates to a system and method for customizing and storing workflow processes for use in remediation incidents such as security events. One aspect of the invention relates to providing tools to enable creation of customized workflow processes for event driven incident remediation, monitoring and analyzing system activity to identify occurrence of incidents, assigning a workflow process to an incident, applying the assigned workflow process to remediate the incident, and tracking and graphically displaying the status of the workflow process, among other things.
Claims20
A method to create automated workflows for incident remediation, the method comprising:
- selecting, by a system configured to create automated workflows for incident remediation, two or more work-items of a plurality of work-items to include in a workflow process instance, where:
- the plurality of work-items comprise one or more system work-items that comprise one or more executable commands to be executed by one or more devices of a network, each system work-item of the one or more system work-items directed to remediating one or more incidents;
- the one or more incidents correspond to a set of correlation rules defining characteristics of one or more events, the one or more events corresponding to activity in the network specified based on a policy;
- creating, by the system, one or more transitions to include in the workflow process instance, each transition of the one or more transitions defining a decision process between at least two work-items of the two or more work-items selected;
- verifying, by the system, the workflow process instance as the two or more work-items and the one or more transitions are added to the workflow process instance;
- storing, by the system, the workflow process instance in a data store;
- monitoring, by the system, the network and detecting occurrence of the one or more incidents in the network;
- responsive to the detecting of the occurrence of the one or more incidents in the network, assigning, by the system, the workflow process instance to the one or more incidents detected, and initiating execution of the two or more work-items, where the initiating the execution comprises electronically communicating, via the network to one or more devices, the workflow process instance as a self-contained object to the one or more devices, causing the one or more devices to automatically execute the workflow process instance including the one or more system work-items;
- processing, by the system, a set of one or more communications received from the one or more devices, the set of one or more communications indicative of a status associated with the one or more system work-items;
- and
- based on processing the set of one or more communications received, tracking, by the system, remediation of the one or more incidents at least in part by tracking progress along a sequence in the workflow process instance.
8 more elements
A system configured to create automated workflows for incident remediation, the system comprising:
- one or more processors;
- and
- a memory communicatively coupled with and readable by the one or more processors and having stored therein instructions which, when executed by the one or more processors, cause the one or more processors to perform:
- selecting two or more work-items of a plurality of work-items to include in a workflow process instance, where:
- the plurality of work-items comprise one or more system work-items that comprise one or more executable commands to be executed by one or more devices of a network, each system work-item of the one or more system work-items directed to remediating one or more incidents;
- the one or more incidents correspond to a set of correlation rules defining characteristics of one or more events, the one or more events corresponding to activity in the network specified based on a policy;
- creating one or more transitions to include in the workflow process instance, each transition of the one or more transitions defining a decision process between at least two work-items of the two or more work-items selected;
- verifying the workflow process instance as the two or more work-items and the one or more transitions are added to the workflow process instance;
- storing the workflow process instance in a data store;
- monitoring the network and detecting occurrence of the one or more incidents in the network;
- responsive to the detecting of the occurrence of the one or more incidents in the network, assigning the workflow process instance to the one or more incidents detected, and initiating execution of the two or more work-items, where the initiating the execution comprises electronically communicating, via the network to one or more devices, the workflow process instance as a self-contained object to the one or more devices, causing the one or more devices to automatically execute the workflow process instance including the one or more system work-items;
- processing a set of one or more communications received from the one or more devices, the set of one or more communications indicative of a status associated with the one or more system work-items;
- and
- based on processing the set of one or more communications received, tracking remediation of the one or more incidents at least in part by tracking progress along a sequence in the workflow process instance.
11 more elements
One or more non-transitory, machine-readable media having machine-readable instructions thereon, which, when executed by one or more processing devices, cause the one or more processing devices to perform:
- selecting two or more work-items of a plurality of work-items to include in a workflow process instance, where:
- the plurality of work-items comprise one or more system work-items that comprise one or more executable commands to be executed by one or more devices of a network, each system work-item of the one or more system work-items directed to remediating one or more incidents;
- the one or more incidents correspond to a set of correlation rules defining characteristics of one or more events, the one or more events corresponding to activity in the network specified based on a policy;
- creating one or more transitions to include in the workflow process instance, each transition of the one or more transitions defining a decision process between at least two work-items of the two or more work-items selected;
- verifying the workflow process instance as the two or more work-items and the one or more transitions are added to the workflow process instance;
- storing the workflow process instance in a data store;
- monitoring the network and detecting occurrence of the one or more incidents in the network;
- responsive to the detecting of the occurrence of the one or more incidents in the network, assigning the workflow process instance to the one or more incidents detected, and initiating execution of the two or more work-items, where the initiating the execution comprises electronically communicating, via the network to one or more devices, the workflow process instance as a self-contained object to the one or more devices, causing the one or more devices to automatically execute the workflow process instance including the one or more system work-items;
- processing a set of one or more communications received from the one or more devices, the set of one or more communications indicative of a status associated with the one or more system work-items;
- and
- based on processing the set of one or more communications received, tracking remediation of the one or more incidents at least in part by tracking progress along a sequence in the workflow process instance.
8 more elements
Dependencies are inferred from the claim text.