Monitoring service policy management
AssigneeInternational Business Machines Corporation
InventorsAlan Byrne, Bryan D. Osenbach, Paul Connolly
Life of this patent
Estimating the term…
Abstract
The present invention provides a computer implemented method, a system, and a computer program product of monitoring service policy management. In an exemplary embodiment, the computer implemented method, the system, and the computer program product include (1) receiving, by a computer system, a user-id when a new user logs onto a target network, (2) in response to the receiving, fetching, by the computer system, a rule associated with the new user, and (3) replacing, by the computer system, an active rule in a network monitoring service with the fetched rule such that the network monitoring service is configured to use the fetched rule, instead of the replaced active rule, for monitoring network events and creating an alert.
Claims15
A computer implemented method comprising:
- receiving, by a computer system, a user-id when a new user logs onto a target network;
- in response to the receiving:
- fetching, by the computer system, a fetched rule associated with the new user;
- replacing, by the computer system, an active rule in a network monitoring service with the fetched rule such that the fetched rule, instead of the replaced active rule, is used throughout the target network while the new user is logged onto the target network to monitor network events and to create an alert;
- wherein:
- the target network comprises a plurality of network devices, and the fetched rule is applicable to the plurality of the network devices and other users;
- the computer implemented method further comprising:
- receiving, by the computer system, a false alert;
- associating, by the computer system, the false alert, the replaced active rule, and the new user as a trend;
- searching, by the computer system, for similar trends, having a similarly associated false alert, active rule and the new user, similar to the trend;
- and
- in response to identifying two or more of the similar trends, amending, by the computer system, an existing user rule.
A system comprising:
- a memory;
- and
- a processor in communication with the memory, the processor configured to:
- receive a user-id when a new user logs onto a target network;
- in response to the receipt:
- fetch a fetched rule associated with the new user;
- replace an active rule in a network monitoring service with the fetched rule such that the fetched rule, instead of the replaced active rule, is used throughout the target network while the new user is logged onto the target network to monitor network events and to create an alert;
- wherein:
- the target network comprises a plurality of network devices, and the fetched rule is applicable to the plurality of the network devices and other users;
- wherein the processor is further configured to:
- receive a false alert;
- associate the false alert, the replaced active rule, and the new user as a trend;
- search for similar trends, having a similarly associated false alert, active rule and the new user, similar to the trend;
- and
- in response to an identification of two or more of the similar trends, create a new user rule.
A computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to:
- receive a user-id when a new user logs onto a target network;
- in response to the receipt:
- fetch a fetched rule associated with the new user;
- replace an active rule in a network monitoring service with the fetched rule such that the fetched rule, instead of the replaced active rule, is used throughout the target network while the new user is logged onto the target network to monitor network events and to create an alert;
- wherein:
- the target network comprises a plurality of network devices, and the fetched rule is applicable to the plurality of the network devices and other users;
- wherein the instructions further cause the processor to:
- receive a false alert;
- associate the false alert, the replaced active rule, and the new user as a trend;
- search for similar trends, having a similarly associated false alert, active rule and the new user, similar to the trend;
- and
- in response to the identification of two or more of the similar trends, create a new user rule.
Dependencies are inferred from the claim text.