Back to results
US 10,708,123 B1Granted
Scalable security information and event management (SIEM) framework
AssigneeLevel 3 Communications, LLC
InventorsMichael David Wimpy, Andrey Konczal
Life of this patent
Estimating the term…
Abstract
A framework for security information and event management (SIEM), the framework includes a first data store; a data router; one or more parsing mechanisms; one or more correlation machines; and one or more workflow engines, wherein said framework performs SIEM on behalf of multiple subscribers to said framework.
Claims29
A framework for security information and event management (SIEM), the framework comprising:
- a first data store;
- a data router;
- one or more parsing mechanisms;
- one or more correlation machines;
- and
- one or more workflow engines,
- wherein said framework performs SIEM on behalf of multiple subscribers to said framework, and
- wherein said first data store is constructed and adapted to store encrypted, compressed log data obtained from at least some of said multiple subscribers, and
- wherein said data router is constructed and adapted to notify said one or more parsing mechanisms that encrypted, compressed log data are present on said first data store;
- and
- wherein said one or more parsing mechanisms are constructed and adapted to obtain encrypted, compressed log data from said first data store and to decrypt, decompress, and normalize said log data and to store decrypted, decompressed, and normalized log data in a second data store, and
- wherein said one or more parsing mechanisms are further constructed and adapted to notify said data router that decrypted, decompressed, and normalized log data are present in said second store, and
- wherein said data router is further constructed and adapted to inform said one or more correlation machines that decrypted, decompressed, and normalized log data are present in said second store, and
- wherein said one or more correlations machines are constructed and adapted:
- to obtain decrypted, decompressed, and normalized log data in said second store, and to apply one or more correlation rules to said decrypted, decompressed, and normalized log data obtained from said second data store to determine one or more correlations, and to put information about said one or more correlations on a correlations queue;
- and
- wherein said one or more workflow engines are constructed and adapted to obtain said information about said one or more correlations from said correlations queue and to determine ticket information based on said information about said one or more correlations, and to provide said ticket information to a subscriber of said multiple subscribers, and
- wherein said data router informs said one or more correlation machines of decrypted, decompressed, and normalized log data present in said second store, based on subscriber-specific criteria.
15 more elements
A method operable in a framework for security information and event management (SIEM), said framework supporting SIEM on behalf of multiple subscribers to said framework, the framework having:
- a first data store;
- a data router;
- one or more parsing mechanisms;
- one or more correlation machines;
- and one or more workflow engines,
- wherein the method comprises:
- storing, in said first data, encrypted, compressed log data obtained from at least some of said multiple subscribers;
- said data router notifying said one or more parsing mechanisms that encrypted, compressed log data are present on said first data store;
- said one or more parsing mechanisms obtaining encrypted, compressed log data from said first data store and decrypting, decompressing, and normalizing said log data and storing decrypted, decompressed, and normalized log data in a second data store,
- said one or more parsing mechanisms notifying said data router that decrypted, decompressed, and normalized log data are present in said second store, and
- said data router informing said one or more correlation machines that decrypted, decompressed, and normalized log data are present in said second store, and
- said one or more correlations machines:
- obtaining decrypted, decompressed, and normalized log data in said second store, and applying one or more correlation rules to said decrypted, decompressed, and normalized log data obtained from said second data store to determine one or more correlations, and putting information about said one or more correlations on a correlations queue;
- and
- said one or more workflow engines obtaining said information about said one or more correlations from said correlations queue and determining ticket information based on said information about said one or more correlations, and providing said ticket information to a subscriber of said multiple subscribers, and
- wherein said data router informs said one or more correlation machines of decrypted, decompressed, and normalized log data present in said second store, based on subscriber-specific criteria.
13 more elements
A non-transitory computer-readable medium with one or more computer programs stored therein that, when executed by one or more processors of a device, cause the one or more processors to perform the operations of a method operable in a framework for security information and event management (SIEM), said framework supporting SIEM on behalf of multiple subscribers to said framework, the framework having:
- a first data store;
- a data router;
- one or more parsing mechanisms;
- one or more correlation machines;
- and one or more workflow engines,
- wherein the method comprises:
- storing, in said first data, encrypted, compressed log data obtained from at least some of said multiple subscribers;
- said data router notifying said one or more parsing mechanisms that encrypted, compressed log data are present on said first data store;
- said one or more parsing mechanisms obtaining encrypted, compressed log data from said first data store and decrypting, decompressing, and normalizing said log data and storing decrypted, decompressed, and normalized log data in a second data store,
- said one or more parsing mechanisms notifying said data router that decrypted, decompressed, and normalized log data are present in said second store, and
- said data router informing said one or more correlation machines that decrypted, decompressed, and normalized log data are present in said second store, and
- said one or more correlations machines:
- obtaining decrypted, decompressed, and normalized log data in said second store, and applying one or more correlation rules to said decrypted, decompressed, and normalized log data obtained from said second data store to determine one or more correlations, and putting information about said one or more correlations on a correlations queue;
- and
- said one or more workflow engines obtaining said information about said one or more correlations from said correlations queue and determining ticket information based on said information about said one or more correlations, and providing said ticket information to a subscriber of said multiple subscribers, and
- wherein said data router informs said one or more correlation machines of decrypted, decompressed, and normalized log data present in said second store, based on subscriber-specific criteria.
13 more elements
Dependencies are inferred from the claim text.