# US 10,482,242 B2 · System and method for performing event inquiries in a network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,482,242 B2 - Document ID: US10482242B2 - Status: Granted - Kind: B2 - Application number: 15/215,474 - Filed: 2016-07-20 - Published: 2017-09-14 - Granted: 2019-11-19 - Earliest claimed: 2016-03-08 - Assignees: Tanium Inc. - Applicants: Tanium Inc. - Inventors: Christian L. Hunt; Thomas R. Gissel; Aaron Tarter; Daniel Floyd; Benjamin Hobbs - Web page: https://patentgrep.com/patent/US10482242B2 ## CPC - H04L 43/10: Active monitoring, e.g. heartbeat, ping or trace-route - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/554: {involving event detection and direct action} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 41/0813: characterised by the conditions triggering a change of settings - H04L 41/0894: Policy-based network configuration management - H04L 41/12: Discovery or management of network topologies - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 67/141: Setup of application sessions (admission control or resource allocation in data switching networks H04L47/70) - G06F 2221/034: Test or assess a computer or a system - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A respective node in a linear communication orbit receives an instruction packet through the linear communication orbit, where the instruction packet has been propagated from a starting node to the respective node through one or more upstream nodes along the linear communication orbit, and the instruction packet includes an instruction for establishing a direct duplex connection between the respective node and a respective server. In response to receiving the instruction packet, the respective node sends an outbound connection request to the respective server to establish the direct duplex connection. The respective node then uploads local data to the respective server through the direct duplex connection (e.g., in response to one or more queries, instructions, and requests received from the respective server through the direct duplex connection), where the respective server performs analysis on the local data received from the respective node through the direct duplex connection. ## Claims ### Claim 1 A method of monitoring a network comprising a collection of machines that forms a linear communication orbit, the method comprising: at a respective machine in the linear communication orbit: receiving from a respective server, external to the linear communication orbit, an instruction packet via the linear communication orbit, wherein the instruction packet has been propagated to the respective machine through one or more upstream machines of the respective machine along the linear communication orbit, and wherein the instruction packet includes an instruction for establishing a direct duplex connection between the respective machine and the respective server; in response to receiving the instruction packet through the linear communication orbit, sending an outbound connection request to the respective server to establish the direct duplex connection between the respective machine and the respective server in accordance with a respective network connection protocol; and uploading local data to the respective server through the direct duplex connection, wherein the respective server is configured to perform analysis on the local data received from the respective machine through the direct duplex connection. ### Claim 2 (depends on 1) The method of claim 1, including: prior to uploading the local data to the respective server, receiving a request for the local data from the respective server through the direct duplex connection. ### Claim 3 (depends on 2) The method of claim 2, wherein the request for the local data includes a request to capture a snapshot of the local database of event history. ### Claim 4 (depends on 1) The method of claim 1, including: maintaining a local database of event history at the respective machine, wherein the event history includes historical local values for a plurality of indicator items that are relevant to events of interest in the network. ### Claim 5 (depends on 4) The method of claim 4, wherein the instruction packet has been propagated from a starting machine to the respective machine along the linear communication orbit, further including: receiving a query from the respective server through the linear communication orbit, wherein the respective server injects the query into the network via the starting machine of the linear communication orbit; and in response to receiving the query: generating a local answer based on the historical local values stored in the local database at the respective machine; and sending the local answer to the starting machine through the linear communication orbit, wherein the starting machine responds to the respective server based at least in part on the local answer collected from the respective machine. ### Claim 6 (depends on 5) The method of claim 5, wherein the starting machine receives respective local answers from a plurality of machines in the linear communication orbit and sends an integrated response to the respective server based on the respective local answers collected from the plurality of machines in the linear communication orbit. ### Claim 7 (depends on 1) The method of claim 1, including: receiving, from the respective server and through the direct duplex connection, a request for event artifacts associated with an event of interest; and in response to the request for event artifacts, sending relevant event artifact data for the event of interest to the respective server through the direct duplex connection. ### Claim 8 (depends on 1) The method of claim 1, wherein the direct duplex connection is a secure Web Socket connection. ### Claim 9 (depends on 1) The method of claim 1, wherein the respective server is separated from the network by a firewall. ### Claim 10 A respective machine in a collection of machines that forms a linear communication orbit, the respective machine comprising: one or more processors; and memory storing instructions that, when executed by the one or more processors, cause the processors to perform operations including: receiving from a respective server, external to the linear communication orbit, an instruction packet via the linear communication orbit, wherein the instruction packet has been propagated to the respective machine through one or more upstream machines of the respective machine along the linear communication orbit, and wherein the instruction packet includes an instruction for establishing a direct duplex connection between the respective machine and the respective server; in response to receiving the instruction packet through the linear communication orbit, sending an outbound connection request to the respective server to establish the direct duplex connection between the respective machine and the respective server in accordance with a respective network connection protocol; and uploading local data to the respective server through the direct duplex connection, wherein the respective server is configured to perform analysis on the local data received from the respective machine through the direct duplex connection. ### Claim 11 (depends on 10) The respective machine of claim 10, wherein the operations further include: prior to uploading the local data to the respective server, receiving a request for the local data from the respective server through the direct duplex connection. ### Claim 12 (depends on 11) The respective machine of claim 11, wherein the request for the local data includes a request to capture a snapshot of the local database of event history. ### Claim 13 (depends on 10) The respective machine of claim 10, wherein the operations further include: maintaining a local database of event history at the respective machine, wherein the event history includes historical local values for a plurality of indicator items that are relevant to events of interest in the network. ### Claim 14 (depends on 13) The respective machine of claim 13, wherein the instruction packet has been propagated from a starting machine to the respective machine along the linear communication orbit, and the operations further include: receiving a query from the respective server through the linear communication orbit, wherein the respective server injects the query into the network via the starting machine of the linear communication orbit; and in response to receiving the query: generating a local answer based on the historical local values stored in the local database at the respective machine; and sending the local answer to the starting machine through the linear communication orbit, wherein the starting machine responds to the respective server based at least in part on the local answer collected from the respective machine. ### Claim 15 (depends on 14) The respective machine of claim 14, wherein the starting machine receives respective local answers from a plurality of machines in the linear communication orbit and sends an integrated response to the respective server based on the respective local answers collected from the plurality of machines in the linear communication orbit. ### Claim 16 (depends on 15) The respective machine of claim 15, wherein the operations further include: receiving, from the respective server and through the direct duplex connection, a request for event artifacts associated with an event of interest; and in response to the request for event artifacts, sending relevant event artifact data for the event of interest to the respective server through the direct duplex connection. ### Claim 17 (depends on 10) The respective machine of claim 10, wherein the direct duplex connection is a secure WebSocket connection. ### Claim 18 (depends on 10) The respective machine of claim 10, wherein the respective server is separated from the network by a firewall. ### Claim 19 A non-transitory computer-readable medium storing instructions that, when executed by one or more processors on a respective machine in a collection of machines that forms a linear communication orbit, cause the processors to perform operations comprising: receiving from a respective server, external to the linear communication orbit, an instruction packet via the linear communication orbit, wherein the instruction packet has been propagated to the respective machine through one or more upstream machines of the respective machine along the linear communication orbit, and wherein the instruction packet includes an instruction for establishing a direct duplex connection between the respective machine and the respective server; in response to receiving the instruction packet through the linear communication orbit, sending an outbound connection request to the respective server to establish the direct duplex connection between the respective machine and the respective server in accordance with a respective network connection protocol; and uploading local data to the respective server through the direct duplex connection, wherein the respective server is configured to perform analysis on the local data received from the respective machine through the direct duplex connection. ### Claim 20 (depends on 19) The non-transitory computer-readable medium of claim 19, wherein the operations further include: prior to uploading the local data to the respective server, receiving a request for the local data from the respective server through the direct duplex connection. ### Claim 21 (depends on 20) The non-transitory computer-readable medium of claim 20, wherein the request for the local data includes a request to capture a snapshot of the local database of event history. ### Claim 22 (depends on 19) The non-transitory computer-readable medium of claim 19, wherein the operations include: maintaining a local database of event history at the respective machine, wherein the event history includes historical local values for a plurality of indicator items that are relevant to events of interest in the network. ### Claim 23 (depends on 22) The non-transitory computer-readable medium of claim 22, wherein the instruction packet has been propagated from a starting machine to the respective machine along the linear communication orbit, and the operations include: receiving a query from the respective server through the linear communication orbit, wherein the respective server injects the query into the network via the starting machine of the linear communication orbit; and in response to receiving the query: generating a local answer based on the historical local values stored in the local database at the respective machine; and sending the local answer to the starting machine through the linear communication orbit, wherein the starting machine responds to the respective server based at least in part on the local answer collected from the respective machine. ### Claim 24 (depends on 23) The non-transitory computer-readable medium of claim 23, wherein the starting machine receives respective local answers from a plurality of machines in the linear communication orbit and sends an integrated response to the respective server based on the respective local answers collected from the plurality of machines in the linear communication orbit. ### Claim 25 (depends on 19) The non-transitory computer-readable medium of claim 19, wherein the operations include: receiving, from the respective server and through the direct duplex connection, a request for event artifacts associated with an event of interest; and in response to the request for event artifacts, sending relevant event artifact data for the event of interest to the respective server through the direct duplex connection. ### Claim 26 (depends on 19) The non-transitory computer-readable medium of claim 19, wherein the direct duplex connection is a secure WebSocket connection. ### Claim 27 (depends on 19) The non-transitory computer-readable medium of claim 19, wherein the respective server is separated from the network by a firewall.