Configuring the generation of ephemeral event streams by remote capture agents

An apparatus, comprising:

• one or more processors;
• and
• memory storing instructions that, when executed by the one or more processors, cause the apparatus to:
• receive input defining an ephemeral event stream to be generated by a remote capture agent, the input indicating:
• a first search query to be executed against timestamped event data generated by the remote capture agent based on network traffic monitored by the remote capture agent, wherein timestamped event data satisfying the search query indicates a potential security incident in a computing environment, and wherein identification of at least one timestamped event satisfying the search query causes the remote capture agent to generate the ephemeral event stream,
• an identifier of a network protocol used by network packets from which the ephemeral event stream is to be generated, and
• an amount of time the remote capture agent is to generate timestamped event data to be included in the ephemeral event stream, wherein the timestamped event data is generated by the remote capture agent based on the network packets monitored by the remote capture agent;
• generate, based on the input, configuration information that includes settings to be used by the remote capture agent to generate the ephemeral event stream;
• send, via the network, the configuration information to the remote capture agent;
• cause display of a graphical user interface (GUI) including identifiers of a plurality of event streams, wherein the plurality of event streams includes the ephemeral event stream;
• receive, via the GUI, a second search query identifying an event stream attribute;
• execute the second search query to identify a subset of the plurality of event streams associated with the event stream attribute, wherein the subset of the plurality of event streams includes the ephemeral event stream;
• and
• cause display of identifiers of event streams in the subset of the plurality of event streams.

A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform operations for facilitating processing of network data, the operations comprising:

• receiving input defining an ephemeral event stream to be generated by a remote capture agent, the input indicating:
• a first search query to be executed against timestamped event data generated by the remote capture agent based on network traffic monitored by the remote capture agent, wherein timestamped event data satisfying the search query indicates a potential security incident in a computing environment, and wherein identification of at least one timestamped event satisfying the search query causes the remote capture agent to generate the ephemeral event stream,
• an identifier of a network protocol used by network packets from which the ephemeral event stream is to be generated, and
• an amount of time the remote capture agent is to generate timestamped event data to be included in the ephemeral event stream, wherein the timestamped event data is generated by the remote capture agent based on the network packets monitored by the remote capture agent;
• generating, based on the input, configuration information that includes settings to be used by the remote capture agent to generate the ephemeral event stream;
• sending, via the network, the configuration information to the remote capture agent;
• causing display of a graphical user interface (GUI) including identifiers of a plurality of event streams, wherein the plurality of event streams includes the ephemeral event stream;
• receiving, via the GUI, a second search query identifying an event stream attribute;
• executing the second search query to identify a subset of the plurality of event streams associated with the event stream attribute, wherein the subset of the plurality of event streams includes the ephemeral event stream;
• and
• causing display of identifiers of event streams in the subset of the plurality of event streams.