# US 10,771,479 B2 · Configuring modular alert actions and reporting action performance information > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,771,479 B2 - Document ID: US10771479B2 - Status: Granted - Kind: B2 - Application number: 15/276,756 - Filed: 2016-09-26 - Published: 2018-03-29 - Granted: 2020-09-08 - Earliest claimed: 2016-09-26 - Assignees: Splunk Inc. - Applicants: Splunk Inc. - Inventors: Banipal Shahbaz; Siri Atma Oaklander De Licori; John Robert Coates; David Hazekamp; Devendra Badhani; Luke Murphey; Patrick Schulz - Web page: https://patentgrep.com/patent/US10771479B2 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/554: {involving event detection and direct action} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 63/1458: {Denial of Service} - H04L 63/1475: {Passive attacks, e.g. eavesdropping or listening without modification of the traffic monitored} - G06F 16/248: Presentation of query results - G06F 16/26: Visual data mining; Browsing structured data - G06F 2221/2151: Time stamp - H04L 2463/121: Timestamp - H04L 2463/141: Denial of service attacks against endpoints in a network - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Techniques and mechanisms are disclosed for configuring actions to be performed by a network security application in response to the detection of potential security incidents, and for causing a network security application to report on the performance of those actions. For example, users may use such a network security application to configure one or more “modular alerts.” As used herein, a modular alert generally represents a component of a network security application which enables users to specify security modular alert actions to be performed in response to the detection of defined triggering conditions, and which further enables tracking information related to the performance of modular alert actions and reporting on the performance of those actions. ## Claims ### Claim 1 A computer-implemented method performed by a security application of a data intake and query system, the method comprising: receiving, through a graphical interface for creating modular alerts, input defining a modular alert comprising: a correlation search used to identify notable events from events stored by the data intake and query system in a field-searchable data store, wherein each of the events includes a time stamp and a portion of raw machine data produced by a component of an information technology or security environment and reflects activity in the information technology or security environment, and wherein the correlation search is executed based on a recurring schedule specified in the input; a triggering condition reflected in criteria in the correlation search, the triggering condition representing detection of a potential security threat; and a plurality of actions to be executed based on the triggering condition being satisfied during execution of the correlation search, the plurality of actions including: a first action involving execution of a query against time stamped event data stored by the data intake and query system in the field-searchable data store, wherein the query is used to obtain additional information related to a notable event identified based on execution of the correlation search, and wherein execution of the query returns first results information, and a second action to be executed by a security application that is external to the data intake and query system, wherein execution of the second action by the security application returns second results information; persisting the modular alert in memory; executing the correlation search included in the modular alert according to the recurring schedule; detecting the triggering condition in the modular alert; based on detecting the triggering condition, executing the plurality of actions in the modular alert including the first action and the second action; obtaining information associated with execution of the plurality of actions; and causing display of a graphical user interface (GUI) including information representing a notable event identified based on execution of the correlation search, the first results information obtained by executing the first action involving execution of a query against time stamped event data stored by the data intake and query system, and the second results information obtained based on the security application executing the second action. ### Claim 2 (depends on 1) The method of claim 1, wherein the potential security threat includes one or more of: a malware infection, a brute-force login attack, a denial-of-service attack, a phishing attack. ### Claim 3 (depends on 1) The method of claim 1, wherein executing the correlation search includes storing a notable event in a notable event index. ### Claim 4 (depends on 1) The method of claim 1, wherein the security application that is external to the data intake and query system includes: a firewall application, a user identity management application, or an antivirus and malware protection application. ### Claim 5 (depends on 1) The method of claim 1, wherein the second action includes causing the security application to perform at least one of: blocking a user, blacklisting a network address or range of network addresses, configuring multi-factor authentication for a user, executing a malware scan, or executing a virus scan. ### Claim 6 (depends on 1) The method of claim 1, wherein persisting the modular alert in memory includes storing an association between the triggering condition and the plurality of actions to be executed when the triggering condition is satisfied during execution of the query. ### Claim 7 (depends on 1) The method of claim 1, wherein the correlation search is associated with an identifier, and wherein the first results information and the second results information are each associated with the identifier, and wherein causing display of the GUI includes obtaining the first results information and the second results information based on the identifier. ### Claim 8 (depends on 1) The method of claim 1, wherein the plurality of actions further includes displaying an interactive electronic runbook, and wherein the interactive electronic runbook includes instructions for remediating the potential security threat associated with the triggering condition. ### Claim 9 (depends on 1) The method of claim 1, wherein executing the correlation search comprises searching the field-searchable data store using a late-binding schema. ### Claim 10 (depends on 1) The method of claim 1, wherein the GUI further includes an indication of whether execution of the second action was successful. ### Claim 11 (depends on 1) The method of claim 1, wherein the GUI further includes a hyperlink to a separate GUI including detailed information about the execution of the second action. ### Claim 12 (depends on 1) The method of claim 1, wherein the second action includes causing the security application to perform a scan against a web site to determine whether the web site is known to host malicious software, and wherein results of performing the scan are returned to the security application at an undetermined time in the future relative to when the triggering condition was detected. ### Claim 13 A non-transitory computer-readable storage medium storing instructions which, when executed by one or more processors, cause performance of operations comprising: receiving, through a graphical interface for creating modular alerts, input defining a modular alert comprising: a correlation search used to identify notable events from events stored by a data intake and query system in a field-searchable data store, wherein each of the events includes a time stamp and a portion of raw machine data produced by a component of an information technology or security environment and reflects activity in the information technology or security environment, and wherein the correlation search is executed based on a recurring schedule specified in the input; a triggering condition reflected in criteria in the correlation search, the triggering condition representing detection of a potential security threat; and a plurality of actions to be executed based on the triggering condition being satisfied during execution of the correlation search, the plurality of actions including: a first action involving execution of a query against time stamped event data stored by the data intake and query system in the field-searchable data store, wherein the query is used to obtain additional information related to a notable event identified based on execution of the correlation search, and wherein execution of the query returns first results information, and a second action to be executed by a security application that is external to the data intake and query system, wherein execution of the second action by the security application returns second results information; persisting the modular alert in memory; executing the correlation search included in the modular alert according to the recurring schedule; detecting the triggering condition in the modular alert; based on detecting the triggering condition, executing the plurality of actions in the modular alert including the first action and the second action; obtaining information associated with execution of the plurality of actions; and causing display of a graphical user interface (GUI) including information representing a notable event identified based on execution of the correlation search, the first results information obtained by executing the first action involving execution of a query against time stamped event data stored by the data intake and query system, and the second results information obtained based on the security application executing the second action. ### Claim 14 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein executing the correlation search comprises searching the field-searchable data store using a late-binding schema. ### Claim 15 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein the plurality of actions further includes displaying an interactive electronic runbook, and wherein the interactive electronic runbook includes instructions for remediating a security threat associated with the triggering condition. ### Claim 16 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein the potential security threat includes one or more of: a malware infection, a brute-force login attack, a denial-of-service attack, a phishing attack. ### Claim 17 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein the security application that is external to the data intake and query system includes: a firewall application, a user identity management application, or an antivirus and malware protection application. ### Claim 18 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein the second action includes causing the security application to perform at least one of: blocking a user, blacklisting a network address or range of network addresses, configuring multi-factor authentication for a user, executing a malware scan, or executing a virus scan. ### Claim 19 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein the second action includes causing the security application to perform a scan against a website to determine whether the website is known to host malicious software, and wherein results of performing the scan are returned to the security application at an undetermined time in the future relative to when the triggering condition was detected. ### Claim 20 An apparatus, comprising: one or more processors; a non-transitory computer-readable storage medium coupled to the one or more processors, the computer-readable storage medium storing instructions which, when executed by the one or more processors, causes the apparatus to: receive, through a graphical interface for creating modular alerts, input defining a modular alert comprising: a correlation search used to identify notable events from events stored by a data intake and query system in a field-searchable data store, wherein each of the events includes a time-stamp and a portion of raw machine data produced by a component of an information technology or security environment and reflects activity in the information technology or security environment, and wherein the correlation search is executed based on a recurring schedule specified in the input; a triggering condition reflected in criteria in the correlation search, the triggering condition representing detection of a potential security threat; and a plurality of actions to be executed based on the triggering condition being satisfied during execution of the correlation search, the plurality of actions including: a first action involving execution of a query against time stamped event data stored by the data intake and query system in the field-searchable data store, wherein the query is used to obtain additional information related to a notable event identified based on execution of the correlation search, and wherein execution of the query returns first results information, and a second action to be executed by a security application that is external to the data intake and query system, wherein execution of the second action by the security application returns second results information; persist the modular alert in memory; execute the correlation search included in the modular alert according to the recurring schedule; detect the triggering condition in the modular alert; based on detecting the triggering condition, execute the plurality of actions in the modular alert including the first action and the second action; obtain information associated with execution of the plurality of actions; and cause display of a graphical user interface (GUI) including information representing a notable event identified based on execution of the correlation search, the first results information obtained by executing the first action involving execution of a query against time stamped event data stored by the data intake and query system, and the second results information obtained based on the security application executing the second action. ### Claim 21 (depends on 20) The apparatus of claim 20, wherein the plurality of actions further includes displaying an interactive electronic runbook, and wherein the interactive electronic runbook includes instructions for remediating a security threat associated with the triggering condition. ### Claim 22 (depends on 20) The apparatus of claim 20, wherein the potential security threat includes one or more of: a malware infection, a brute-force login attack, a denial-of-service attack, a phishing attack. ### Claim 23 (depends on 20) The apparatus of claim 20, wherein the security application that is external to the data intake and query system is one or more of: a firewall application, a user identity management application, and an antivirus and malware protection application. ### Claim 24 (depends on 20) The apparatus of claim 20, wherein the second action includes causing the security application to perform at least one of: blocking a user, blacklisting a network address or range of network addresses, configuring multi-factor authentication for a user, executing a malware scan, or executing a virus scan. ### Claim 25 (depends on 20) The apparatus of claim 20, wherein the second action includes causing the security application to perform a scan against a website to determine whether the website is known to host malicious software, and wherein results of performing the scan are returned to the security application at an undetermined time in the future relative to when the triggering condition was detected.