# US 10,771,486 B2 · Systems and methods for detecting network security threat event patterns > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,771,486 B2 - Document ID: US10771486B2 - Status: Granted - Kind: B2 - Application number: 15/715,015 - Filed: 2017-09-25 - Published: 2019-03-28 - Granted: 2020-09-08 - Earliest claimed: 2017-09-25 - Assignees: Splunk Inc. - Applicants: Splunk Inc. - Inventors: Lucas Murphey; Francis Gerard; Richard Barger; Bhavin Patel; Patrick Schulz; Chinmay Kulkarni - Web page: https://patentgrep.com/patent/US10771486B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 9/4498: {Finite state machines} - G06F 16/951: Indexing; Web crawling techniques - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - G06F 3/0482: Interaction with lists of selectable items, e.g. menus - G06T 11/26: Drawing of charts or graphs - G06T 2200/24: involving graphical user interfaces [GUIs] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06T: IMAGE DATA PROCESSING OR GENERATION, IN GENERAL ## Abstract Techniques and mechanisms are disclosed for a data intake and query system to generate “meta-notable” events by applying a meta-notable event rule to a collection of notable event data. A meta-notable event rule specifies one or more patterns of notable event instances defined by a set of notable event states and a set of transition rules (also referred to as association rules) indicating conditions for transitioning from one notable event state to another. The set of notable event states includes at least one start state and at least one end state. A meta-notable event is generated when a set of analyzed notable events satisfies a set of transition rules linking a start state to an end state (including transitions through any intermediary states between the start state and the end state). ## Claims ### Claim 1 A computer-implemented method, comprising: causing display of a graphical user interface (GUI) including interface elements used to define a meta-notable event rule, the meta-notable event rule including: a plurality of notable event states, at least one of the plurality of notable event states corresponding to a correlation search used to identify timestamped event data matching one or more search criteria, wherein at least one of the plurality of notable event states is a start state and at least one of the plurality of notable event states is an end state, and a plurality of transition rules, each transition rule defining one or more criteria for transitioning between two notable event states of the plurality of notable event states; receiving, via the GUI, input specifying: at least one of the plurality of notable event states, at least one of the plurality of transition rules, and a plurality of notable event state groupings, wherein each notable event grouping of the plurality of notable event state groupings includes a selected set of notable event states of the plurality of notable event states and is associated with a respective grouping label corresponding to a phase of a network security attack; executing a plurality of correlation searches against timestamped event data stored by a data intake and query system to identify a plurality of notable events from the timestamped event data, the timestamped event data generated by the data intake and query system based on raw machine data created by one or more components of an information technology or security environment; analyzing the plurality of notable events using the meta-notable event rule by determining whether any set of notable events from the plurality of notable events satisfies a set of transition rules from the plurality of transition rules linking the start state to the end state of the meta-notable event rule; and in response to determining that a set of events satisfies the meta-notable event rule, storing a record identifying the set of notable events satisfying the meta-notable event rule, the set of notable events satisfying the meta-notable event rule indicating a potential security threat involving at least one computing device of the information technology or security environment. ### Claim 2 (depends on 1) The method of claim 1, wherein the record identifying the set of notable events satisfying the meta-notable event rule is a timestamped event including identifiers of each notable event comprising the set of notable events. ### Claim 3 (depends on 1) The method of claim 1, wherein the event data comprises a plurality of events, each event including a portion of raw machine data created by the one or more components of the information technology or security environment. ### Claim 4 (depends on 1) The method of claim 1, wherein at least one of the plurality of notable events indicates the potential security threat involving the at least one computing device of the information technology or security environment. ### Claim 5 (depends on 1) The method of claim 1, wherein the potential security threat involves a plurality of computing devices of the information technology or security environment. ### Claim 6 (depends on 1) The method of claim 1, further comprising causing display of a graphical user interface (GUI) including graphical elements used to receive input specifying the plurality of notable event states and the plurality of transition rules. ### Claim 7 (depends on 1) The method of claim 1, wherein the GUI is a first GUI, and wherein the method further comprises causing display of a second GUI including graphical elements used to display information related to a stored record identifying the set of notable events satisfying the meta-notable event rule. ### Claim 8 (depends on 1) The method of claim 1, wherein the GUI is a first GUI, and wherein the method further comprises causing display of a second GUI including graphical elements used to display information related to a stored record identifying the set of notable events satisfying the meta-notable event rule, the displayed information including information stored as part of at least one of the notable events from the set of notable events satisfying the meta-notable event rule. ### Claim 9 (depends on 1) The method of claim 1, wherein the GUI is a first GUI, and wherein the method further comprises causing display of a second GUI including a graph showing relationships among the set of notable events satisfying the meta-notable event rule. ### Claim 10 (depends on 1) The method of claim 1, wherein the GUI is a first GUI, and wherein the method further comprises causing display of a second GUI including graphical elements used to display an indication, for at least one particular notable event of the set of notable events satisfying the meta-notable event rule, a total number of notable event sets satisfying the meta-notable event rule that include the particular notable event. ### Claim 11 (depends on 1) The method of claim 1, wherein the set of transition rules links the start state to the end state based on transitions to one or more intermediate notable event states between the start state and the end state. ### Claim 12 (depends on 1) The method of claim 1, wherein the plurality of correlation searches used to identify the timestamped event data matching the one or more search criteria are executed periodically. ### Claim 13 (depends on 1) The method of claim 1, wherein the plurality of correlation searches used to identify the timestamped event data matching the one or more search criteria are executed on event data stored in a field-searchable data store. ### Claim 14 (depends on 1) The method of claim 1, wherein the plurality of correlation searches are executed to identify event data stored in a field-searchable data store matching the one or more search criteria, the stored event data comprising timestamped events that include a portion of raw machine data created by a component of the information technology or security environment and which relates to activity of the component in the information technology or security environment. ### Claim 15 (depends on 1) The method of claim 1, wherein execution of the plurality of correlation searches includes using a late-binding schema to identify the timestamped event data matching the one or more search criteria. ### Claim 16 (depends on 1) The method of claim 1, further comprising: receiving the raw machine data from components of the information technology or security environment; segmenting the raw machine data into events, each event containing a portion of the raw machine data; and for each event, determining a timestamp for the event, associating the timestamp with the event, and storing the event in a field-searchable data store. ### Claim 17 (depends on 1) The method of claim 1, wherein the timestamped event data includes a portion of the raw machine data created by the one or more components of the information technology or security environment, and wherein at least one component of the information technology or security environment is one of a desktop computer, a workstation, a laptop computer, a tablet computer, a mobile device, a server, a database, a networking device, an application. ### Claim 18 (depends on 1) The method of claim 1, wherein the timestamped event data includes a portion of the raw machine data created by one or more components of the information technology or security environment, and wherein the raw machine data includes one or more of log data, wire data, server data, network data, file system information, registry information, and information related to one or more processes or services running on a device. ### Claim 19 (depends on 1) The method of claim 1, wherein at least one transition rule of the plurality of transition rules indicates a field value to be present in notable events satisfying the at least one transition rule. ### Claim 20 (depends on 1) The method of claim 1, wherein at least one transition rule of the plurality of transition rules indicates a field value to be matched between a first notable event matched by the at least one transition rule and a second notable event matched by a previous transition rule. ### Claim 21 (depends on 1) The method of claim 1, wherein at least one transition rule of the plurality of transition rules indicates a filter excluding notable events matching one or more filtering conditions. ### Claim 22 (depends on 1) The method of claim 1, wherein at least one transition rule of the plurality of transition rules includes a time-based filter excluding notable events matching one or more time-based filtering conditions. ### Claim 23 (depends on 1) The method of claim 1, wherein at least one transition rule of the plurality of transition rules includes logical connectors connecting two or more matching or filtering conditions. ### Claim 24 A non-transitory computer-readable storage medium storing instructions which, when executed by one or more processors, cause performance of operations comprising: causing display of a graphical user interface (GUI) including interface elements used to define a meta-notable event rule, the meta-notable event rule including: a plurality of notable event states, at least one of the plurality of notable event states corresponding to a correlation search used to identify timestamped event data matching one or more search criteria, wherein at least one of the plurality of notable event states is a start state and at least one of the plurality of notable event states is an end state, and a plurality of transition rules, each transition rule defining one or more criteria for transitioning between two notable event states of the plurality of notable event states; receiving, via the GUI, input specifying: at least one of the plurality of notable event states, at least one of the plurality of transition rules, and a plurality of notable event state groupings, wherein each notable event grouping of the plurality of notable event state groupings includes a selected set of notable event states of the plurality of notable event states and is associated with a respective grouping label corresponding to a phase of a network security attack; executing a plurality of correlation searches against timestamped event data stored by a data intake and query system to identify a plurality of notable events from the timestamped event data, the timestamped event data generated by the data intake and query system based on raw machine data created by one or more components of an information technology or security environment; analyzing the plurality of notable events using the meta-notable event rule by determining whether any set of notable events from the plurality of notable events satisfies a set of transition rules from the plurality of transition rules linking the start state to the end state of the meta-notable event rule; and in response to determining that a set of notable events satisfies the meta-notable event rule, storing an record identifying the set of notable events satisfying the meta-notable event rule, the set of notable events satisfying the meta-notable event rule indicating a potential security threat involving at least one computing device of the information technology or security environment. ### Claim 25 (depends on 24) The non-transitory computer-readable storage medium of claim 24, wherein the record identifying the set of notable events satisfying the meta-notable event rule is a timestamped event including identifiers of each notable event comprising the set of notable events. ### Claim 26 An apparatus, comprising: one or more processors; a non-transitory computer-readable storage medium coupled to the one or more processors, the computer-readable storage medium storing instructions which, when executed by the one or more processors, causes the apparatus to: cause display of a graphical user interface (GUI) including interface elements used to define a meta-notable event rule, the meta-notable event rule including: a plurality of notable event states, at least one of the plurality of notable event states corresponding to a correlation search used to identify timestamped event data matching one or more search criteria, wherein at least one of the plurality of notable event states is a start state and at least one of the plurality of notable event states is an end state, and a plurality of transition rules, each transition rule defining one or more criteria for transitioning between two notable event states of the plurality of notable event states; receive, via the GUI, input specifying: at least one of the plurality of notable event states, at least one of the plurality of transition rules, and a plurality of notable event state groupings, wherein each notable event grouping of the plurality of notable event state groupings includes a selected set of notable event states of the plurality of notable event states and is associated with a respective grouping label corresponding to a phase of a network security attack; execute a plurality of correlation searches against timestamped event data stored by a data intake and query system to identify a plurality of notable events from the timestamped event data, the timestamped event data generated by the data intake and query system based on raw machine data created by one or more components of an information technology or security environment; analyze the plurality of notable events using the meta-notable event rule by determining whether any set of notable events from the plurality of notable events satisfies a set of transition rules from the plurality of transition rules linking the start state to the end state of the meta-notable event rule; and in response to determining that a set of events satisfies the meta-notable event rule, store an record identifying the set of notable events satisfying the meta-notable event rule, the set of notable events satisfying the meta-notable event rule indicating a potential security threat involving at least one computing device of the information technology or security environment. ### Claim 27 (depends on 26) The apparatus of claim 26, wherein the record identifying the set of notable events satisfying the meta-notable event rule is a timestamped event including identifiers of each notable event comprising the set of notable events. ### Claim 28 (depends on 24) The non-transitory computer-readable storage medium of claim 24, wherein the event data comprises a plurality of events, each event including a portion of raw machine data created by the one or more components of the information technology or security environment. ### Claim 29 (depends on 26) The apparatus of claim 26, wherein the event data comprises a plurality of events, each event including a portion of raw machine data created by the one or more components of the information technology or security environment. ### Claim 30 (depends on 26) The apparatus of claim 26, wherein at least one of the plurality of notable events indicates the potential security threat involving the at least one computing device of the information technology or security environment.