Granular and prioritized visualization of anomalous log data
AssigneeRapid7, Inc.
InventorDouglas George Wainer
Life of this patent
Estimating the term…
Abstract
Disclosed herein are methods, systems, and processes for granular and prioritized visualization of anomalous log data. Log data that includes several logs is accessed. A unique identifier is generated for each log by generating a single hash for one or more fields in each log. Based on the hashing, the several logs are converted into a series of unique identifiers. A timestamp for each log in the series of unique identifiers is appended to generate a list of timestamps for each unique identifier in the series of unique identifiers. The list of timestamps for each unique identifier is overlayed on a time series graph in a graphical user interface (GUI).
Claims16
A computer-implemented method, comprising:
- accessing log data comprising a plurality of logs;
- generating a unique identifier for each log of the plurality of logs by generating a single hash for one or more fields in each log of the plurality of logs;
- based on the hashing, converting the plurality of logs into a series of unique identifiers;
- appending a timestamp for each log in the series of unique identifiers;
- generating a list of timestamps for each unique identifier in the series of unique identifiers;
- overlaying the list of timestamps for each unique identifier on a time series graph in a graphical user interface (GUI);
- tracking one or more new instances of each unique identifier in the series of unique identifiers;
- adding the one or more new instances to the list of timestamps;
- and
- re-overlaying the list of timestamps on the time series graph in the GUI.
A non-transitory computer readable storage medium comprising program instructions executable to:
- access log data comprising a plurality of logs;
- generate a unique identifier for each log of the plurality of logs by generating a single hash for one or more fields in each log of the plurality of logs;
- based on the hashing, convert the plurality of logs into a series of unique identifiers;
- append a timestamp for each log in the series of unique identifiers;
- generate a list of timestamps for each unique identifier in the series of unique identifiers;
- overlay the list of timestamps for each unique identifier on a time series graph in a graphical user interface (GUI);
- track one or more new instances of each unique identifier in the series of unique identifiers;
- add the one or more new instances to the list of timestamps;
- and
- re-overlay the list of timestamps on the time series graph in the GUI.
A system comprising:
- one or more processors;
- and
- a memory coupled to the one or more processors, wherein the memory stores program instructions executable by the one or more processors to:
- access log data comprising a plurality of logs;
- generate a unique identifier for each log of the plurality of logs by generating a single hash for one or more fields in each log of the plurality of logs;
- based on the hashing, convert the plurality of logs into a series of unique identifiers;
- append a timestamp for each log in the series of unique identifiers;
- generate a list of timestamps for each unique identifier in the series of unique identifiers;
- overlay the list of timestamps for each unique identifier on a time series graph in a graphical user interface (GUI);
- track one or more new instances of each unique identifier in the series of unique identifiers;
- add the one or more new instances to the list of timestamps;
- and
- re-overlay the list of timestamps on the time series graph in the GUI.
Dependencies are inferred from the claim text.