# US 10,769,283 B2 · Risk adaptive protection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,769,283 B2 - Document ID: US10769283B2 - Status: Granted - Kind: B2 - Application number: 16/288,322 - Filed: 2019-02-28 - Published: 2019-06-27 - Granted: 2020-09-08 - Earliest claimed: 2017-10-31 - Assignees: Forcepoint LLC - Applicants: Forcepoint, LLC - Inventors: Chris Poirel; Ann Irvine; Russell Snyder; Chris Puderbaugh - Web page: https://patentgrep.com/patent/US10769283B2 ## CPC - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 16/26: Visual data mining; Browsing structured data - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method, system and computer-usable medium for performing security analytics comprising receiving a stream of data from a data source; preprocessing the stream of data identify entity information and event information from the stream of data; transforming the entity information into transformed entity data and the event information into transformed event data; the transforming conforming to a genericized data model; storing the transformed entity data and the transformed event data in a security analytics data repository; and, performing a security analytics operation on the transformed entity data and the transformed event data. ## Claims ### Claim 1 A computer-implementable method for generating enriched event related to an event, comprising: receiving a stream of data from a data source, the stream of data comprising a plurality of events, the plurality of events comprising electronically-observable interactions by a user, the electronically-observable interactions being observed through at least one of an electronic device, a computer system and a software application executing on the computing system; processing the steam of data to identify entity information and event information, the entity information comprising heterogeneous entity information, the event information comprising heterogeneous event information, the processing being performed by a data preprocessor module of a genericized data model management system; transforming the entity information into transformed entity data and the event information into transformed event data, the transforming conforming to a genericized data model, the genericized data model comprising a data model that defines a general relational type along with at least one of an entity and event related by the general relational type, the transforming being performed by a data transformation module of a genericized data model management system; storing the transformed entity data and the transformed event data in a data repository; and, performing a security analytics operation using the transformed entity data and the transformed event data, the security analytics operation being performed by a security analytics system executing on a hardware processor, the security analytics operation accessing the transformed entity data and the transformed event data from the data repository, the security analytics operation processing the transformed entity data and the transformed event data to identify a possible security breach. ### Claim 2 (depends on 1) The method of claim 1, wherein: the storing the transformed entity data and the transformed event data comprises associating the data source with a mode, the data source being associated with a particular mode, the particular mode comprising a set of required fields, the set of required fields comprising data fields within the stream of data containing information associated with at least one of a particular entity and a particular event for processing the entity information and the event information to conform to the genericized data model. ### Claim 3 (depends on 1) The method of claim 1, wherein: the transformed entity data comprises entity role information; and, the security analytics operation performs at least one of a plurality of analytic operations using the entity role information, the plurality of analytics operations comprising an entity count operation, a numeric field operation, a secondary role cardinality aggregation operation, a relationship event feature operation, an entity resolution operation, and an entitlements operation. ### Claim 4 (depends on 1) The method of claim 1, wherein: the transformed entity data comprises entity attribute information and entity feature information. ### Claim 5 (depends on 1) The method of claim 1, wherein: the transformed event data comprises event attribute information, the event attribute information comprising structured information about an event; and, the event attribute information comprises an event attribute type, the event attribute type comprising at least one of a Boolean attribute type, a double attribute type, a string attribute type, and a date attribute type. ### Claim 6 (depends on 1) The method of claim 1, wherein: the transformed event data comprises at least one of event content information, event timestamp information, event attachment information and event reference information. ### Claim 7 A system comprising: a processor; a data bus coupled to the processor; and a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for: receiving a stream of data from a data source, the stream of data comprising a plurality of events, the plurality of events comprising electronically-observable interactions by a user, the electronically-observable interactions being observed through at least one of an electronic device, a computer system and a software application executing on the computing system; processing the steam of data to identify entity information and event information, the entity information comprising heterogeneous entity information, the event information comprising heterogeneous event information, the processing being performed by a data preprocessor module of a genericized data model management system; transforming the entity information into transformed entity data and the event information into transformed event data, the transforming conforming to a genericized data model, the genericized data model comprising a data model that defines a general relational type along with at least one of an entity and event related by the general relational type, the transforming being performed by a data transformation module of a genericized data model management system; storing the transformed entity data and the transformed event data in a data repository; and, performing a security analytics operation using the transformed entity data and the transformed event data, the security analytics operation being performed by a security analytics system executing on a hardware processor, the security analytics operation accessing the transformed entity data and the transformed event data from the data repository, the security analytics operation processing the transformed entity data and the transformed event data to identify a possible security breach. ### Claim 8 (depends on 7) The system of claim 7, wherein: the storing the transformed entity data and the transformed event data comprises associating the data source with a mode, the data source being associated with a particular mode, the particular mode comprising a set of required fields, the set of required fields comprising data fields within the stream of data containing information associated with at least one of a particular entity and a particular event for processing the entity information and the event information to conform to the genericized data model. ### Claim 9 (depends on 7) The system of claim 7, wherein: the transformed entity data comprises entity role information; and, the security analytics operation performs at least one of a plurality of analytic operations using the entity role information, the plurality of analytics operations comprising an entity count operation, a numeric field operation, a secondary role cardinality aggregation operation, a relationship event feature operation, an entity resolution operation, and an entitlements operation. ### Claim 10 (depends on 7) The system of claim 7, wherein: the transformed entity data comprises entity attribute information and entity feature information. ### Claim 11 (depends on 7) The system of claim 7, wherein: the transformed event data comprises event attribute information, the event attribute information comprising structured information about an event; and, the event attribute information comprises an event attribute type, the event attribute type comprising at least one of a Boolean attribute type, a double attribute type, a string attribute type, and a date attribute type. ### Claim 12 (depends on 7) The system of claim 7, wherein: the transformed event data comprises at least one of event content information, event timestamp information, event attachment information and event reference information. ### Claim 13 A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for: receiving a stream of data from a data source, the stream of data comprising a plurality of events, the plurality of events comprising electronically-observable interactions by a user, the electronically-observable interactions being observed through at least one of an electronic device, a computer system and a software application executing on the computing system; processing the steam of data to identify entity information and event information, the entity information comprising heterogeneous entity information, the event information comprising heterogeneous event information, the processing being performed by a data preprocessor module of a genericized data model management system; transforming the entity information into transformed entity data and the event information into transformed event data, the transforming conforming to a genericized data model, the genericized data model comprising a data model that defines a general relational type along with at least one of an entity and event related by the general relational type, the transforming being performed by a data transformation module of a genericized data model management system; storing the transformed entity data and the transformed event data in a data repository; and, performing a security analytics operation using the transformed entity data and the transformed event data, the security analytics operation being performed by a security analytics system executing on a hardware processor, the security analytics operation accessing the transformed entity data and the transformed event data from the data repository, the security analytics operation processing the transformed entity data and the transformed event data to identify a possible security breach. ### Claim 14 (depends on 13) The non-transitory, computer-readable storage medium of claim 13, wherein: the storing the transformed entity data and the transformed event data comprises associating the data source with a mode, the data source being associated with a particular mode, the particular mode comprising a set of required fields, the set of required fields comprising data fields within the stream of data containing information associated with at least one of a particular entity and a particular event for processing the entity information and the event information to conform to the genericized data model. ### Claim 15 (depends on 14) The non-transitory, computer-readable storage medium of claim 14, wherein: the transformed entity data comprises entity role information; and, the security analytics operation performs at least one of a plurality of analytic operations using the entity role information, the plurality of analytics operations comprising an entity count operation, a numeric field operation, a secondary role cardinality aggregation operation, a relationship event feature operation, an entity resolution operation, and an entitlements operation. ### Claim 16 (depends on 13) The non-transitory, computer-readable storage medium of claim 13, wherein: the transformed entity data comprises entity attribute information and entity feature information. ### Claim 17 (depends on 13) The non-transitory, computer-readable storage medium of claim 13, wherein: the transformed event data comprises event attribute information, the event attribute information comprising structured information about an event; and, the event attribute information comprises an event attribute type, the event attribute type comprising at least one of a Boolean attribute type, a double attribute type, a string attribute type, and a date attribute type. ### Claim 18 (depends on 13) The non-transitory, computer-readable storage medium of claim 13, wherein the computer executable instructions are further configured for: the transformed event data comprises at least one of event content information, event timestamp information, event attachment information and event reference information. ### Claim 19 (depends on 13) The non-transitory, computer-readable storage medium of claim 13, wherein the computer executable instructions are deployable from a server system at a remote location. ### Claim 20 (depends on 13) The non-transitory, computer-readable storage medium of claim 13, wherein the computer executable instructions are provided by a service provider to a user on an on-demand basis.