# US 11,308,206 B2 · Audit log enrichment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,308,206 B2 - Document ID: US11308206B2 - Status: Granted - Kind: B2 - Application number: 17/082,967 - Filed: 2020-10-28 - Published: 2021-04-15 - Granted: 2022-04-19 - Earliest claimed: 2016-06-02 - Assignees: Varonis Systems, Inc. - Applicants: Varonis Systems Ltd. - Inventors: Yakov Faitelson - Web page: https://patentgrep.com/patent/US11308206B2 ## CPC - G06F 21/552: {involving long-term monitoring or reporting} - G06F 11/3438: {monitoring of user actions (tracking the activity of the user H04L67/535)} - G06F 16/951: Indexing; Web crawling techniques - H04L 51/52: for supporting social networking services - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)} - H04L 67/60: Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources (admission control or resource allocation H04L47/70) - G06F 2221/2101: Auditing as a secondary aspect - G06F 2221/2151: Time stamp - H04L 61/5007: Internet protocol [IP] addresses - H04L 2463/121: Timestamp - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system for monitoring actual access to data elements in an enterprise computer network and providing associated data, the system including an at least near real time data element audit subsystem providing audit output data including at least one of a time stamp, identification of an accessor, user depository stored data regarding the accessor, accessed data element data, affected data element data, type of access operation, source IP address of access and access outcome data, in at least near real time, relating to actual access to data elements in the enterprise computer network, and an additional data providing subsystem receiving in at least near real time at least a part of the audit output data and utilizing the at least part of the audit output data for providing additional data which is not part of the audit output data. ## Claims ### Claim 1 A system for monitoring actual access to data elements in an enterprise computer network and providing associated data, the system comprising: an at least near real time data element audit subsystem providing at least data relating to an enterprise user; and an additional data providing subsystem providing to said at least near real time data element audit subsystem, social network metadata from a social network external to said enterprise computer network, said social network metadata relating to access activity of said enterprise user on a social network profile associated with said enterprise user and update activity of said enterprise user on said social network profile associated with said enterprise user; said an at least near real time data element audit subsystem being operable for utilizing a combination of said social network metadata relating to said access activity of said enterprise user on said social network profile associated with said enterprise user and said social network metadata relating to said update activity of said enterprise user on said social network profile associated with said enterprise user from said social network external to said enterprise computer network, for said monitoring said actual access to said social network profile associated with said enterprise user. ### Claim 2 (depends on 1) A system according to claim 1 and wherein said additional data providing subsystem provides said social network data in at least near real time. ### Claim 3 (depends on 1) A system according to claim 1 and also comprising a time window calculation subsystem configured to indicate whether said activity on said social network occurred within a predetermined time window. ### Claim 4 (depends on 1) A system according to claim 1 and wherein operation of said additional data providing subsystem is triggered by at least one occurrence of said activity on said social network of said individual. ### Claim 5 (depends on 1) A system according to claim 1 and wherein operation of said additional data providing subsystem is triggered on a scheduled basis to analyze occurrence of activity on said social network of said individual. ### Claim 6 (depends on 1) A system according to claim 1 and wherein operation of said additional data providing subsystem is continuously triggered to analyze ongoing activity on said social network of said individual. ### Claim 7 (depends on 1) A system according to claim 1 and wherein operation of said additional data providing subsystem is triggered by at least one user- defined rule which is based at least on time and on occurrence of said activity. ### Claim 8 (depends on 3) A system according to claim 3 and wherein an output of said time window calculation subsystem triggers a retroactive analysis of past actual accesses to at least one data element in said enterprise computer network. ### Claim 9 A method for monitoring actual access to data elements in an enterprise computer network and providing associated data, the method comprising: providing in at least near real time at least data relating to an enterprise user; receiving at least part of said data relating to said enterprise user and utilizing said part of said data relating to said enterprise user for providing social network metadata from a social network external to said enterprise computer network, said social network metadata relating to access activity of said enterprise user on a social network profile associated with said enterprise user and update activity on said social network profile associated with said enterprise user by said enterprise user; and utilizing a combination of said social network metadata relating to said access activity of said enterprise user on said social network profile associated with said enterprise user and said social network metadata relating to said update activity of said enterprise user on said social network profile associated with said enterprise user from said social network external to said enterprise computer network, for said monitoring said actual access to said social network profile associated with said enterprise user. ### Claim 10 (depends on 9) A method according to claim 9 and also comprising providing an indication of whether said activity on said social network was done within a predetermined time window. ### Claim 11 (depends on 9) A method according to claim 9 and wherein said providing data from said social network is triggered by at least one existence of predetermined activity on said social network by said individual. ### Claim 12 (depends on 9) A method according to claim 9 and wherein said providing data from said social network occurs on at least a scheduled basis to analyze existence of predetermined activity on said social network by said individual. ### Claim 13 (depends on 9) A method according to claim 9 and wherein said providing data from said social network occurs continuously to analyze ongoing activity on said social network by said individual. ### Claim 14 (depends on 9) A method according to claim 9 and wherein said providing data from said social network occurs in accordance with at least one user-defined rule based at least on time and on existence of predetermined activity on said social network by said individual. ### Claim 15 (depends on 10) A method according to claim 10 and wherein said indication of whether said activity on said social network by said individual was done within a predetermined time window triggers a retroactive analysis of past actual accesses to at least one data element in said enterprise computer network.