Audit log enhancement

A method for monitoring actual access to data elements in an enterprise computer network and providing associated data, the method comprising:

• providing audit output data including at least one of a time stamp, identification of an accessor, user depository stored data regarding said accessor, accessed data element data, affected data element data, type of access operation, source IP address of access and access outcome data, in at least near real time, relating to actual access of said accessor to data elements within said enterprise computer network;
• receiving at least part of said audit output data relating to said actual access of said accessor;
• automatically searching said enterprise computer network in order to find at least one useful data source outside of said enterprise computer network;
• utilizing said at least part of said audit output data for automatically receiving, in response to said audit output data, additional data relating to said actual access of said accessor from said at least one useful data source outside of said enterprise computer network which said additional data is not part of said audit output data;
• utilizing a combination of at least said part of said audit output data relating to said actual access to said data elements within said enterprise computer network and said additional data relating to said actual access of said accessor from said at least one data source outside of said enterprise computer network for said monitoring said actual access to said data elements in said enterprise computer network and providing a monitoring access output for said actual access;
• and
• providing at least one automatic protective measure in at least near real time to said enterprise computer network when said monitoring access output indicates that said actual access of said accessor may be problematic.

A system comprising a processor and a non-transitory, tangible computer-readable medium in which computer program instructions are stored, which instructions, when read by a computer, cause the computer to enable monitoring actual access to data elements in an enterprise computer network and providing associated data, the system further comprising:

• a data element audit subsystem providing audit data including at least data relating to time stamps of at least two actual accesses of a particular accessor and IP addresses of computers used for said two actual accesses of said particular accessor;
• an additional data providing subsystem operative to:
• receive at least a part of said audit data relating to said actual accesses of said accessor;
• automatically search said enterprise computer network in order to find at least one useful data source outside of said enterprise computer network;
• utilize said at least part of said audit data for automatically retrieving, in response to said audit output data, additional data relating to said actual accesses of said accessor from said at least one useful data source outside of said enterprise computer network, said additional data comprising physical location data corresponding to said IP addresses of said computers used for said two actual accesses of said particular accessor, said additional data not being part of said audit output data;
• and
• utilize a combination of at least said part of said audit output data and said additional data relating to said actual accesses of said accessor from said at least one data source outside of said enterprise computer network for said monitoring said actual access to said data elements in said enterprise computer network;
• a time and distance analysis engine providing a monitoring access output for said actual access indicating whether a time difference between said time stamps and a geographical separation between said physical locations of said at least two actual accesses of said particular accessor may feasibly correspond one to another, in view of a minimum time duration required to physically travel between said physical locations of said at least two actual accesses of said particular accessor;
• and
• a protective measure subsystem operative to provide at least one automatic protective measure to said enterprise computer network in at least near real time when said monitoring access output indicates that said actual access may be problematic.

A method for monitoring actual access to data elements in an enterprise computer network and providing associated data, the method comprising:

• providing audit data including at least data relating to time stamps of at least two actual accesses of a particular accessor and IP addresses of computers used for said two actual accesses of said particular accessor;
• receiving at least a part of said audit data relating to said actual accesses of said accessor;
• automatically searching said enterprise computer network in order to find at least one useful data source outside of said enterprise computer network;
• utilizing said at least part of said audit data for automatically retrieving, in response to said audit output data, additional data relating to said actual accesses of said accessor from said at least one useful data source outside of said enterprise computer network, said additional data comprising physical location data corresponding to said IP addresses of said computers used for said two actual accesses of said particular accessor, said additional data not being part of said audit output data;
• utilizing a combination of at least said part of said audit output data and said additional data relating to said actual accesses of said accessor from said at least one data source outside of said enterprise computer network for said monitoring said actual access to said data elements in said enterprise computer network;
• providing a monitoring access output for said actual access indicating whether a time difference between said time stamps and a geographical separation between said physical locations of said at least two actual accesses of said particular accessor may feasibly correspond one to another in view of a minimum time duration required to physically travel between said physical locations of said at least two actual accesses of said particular accessor;
• and
• providing at least one automatic protective measure to said enterprise computer network in at least near real time when said monitoring access output indicates that said actual access of said accessor may be problematic.