US 11,902,306 B1Granted

Advanced persistent threat detection by an information technology and security operations application

AssigneeSplunk Inc.

InventorSourabh Satish

Life of this patent

Estimating the term…

Loading patent…

Abstract

Techniques are described for enabling an IT and security operations application to detect and remediate advanced persistent threats (APTs). The detection of APTs involves the execution of search queries to search event data that initially was associated with lower-severity activity or that otherwise did not initially rise to the level of actionable event data in the application. The execution of such search queries may thus generally be configured to search non-real-time event data, e.g., event data that outside of a current window of days or a week and instead searches and aggregates event data spanning time periods of many weeks, months, or years. Due the nature of APTs, analyses of historical event data spanning such relatively long periods of time may in the aggregate uncover the types of persistent activity associated with APTs that would otherwise go undetected based only on searches of more current, real-time event data.

Claims18

Dependent claims

A computer-implemented method comprising:

executing a first query against timestamped event data stored in a data store to identify a first set of events, wherein the timestamped event data is generated by a data intake and query system based on raw machine data obtained from one or more components of an information technology (IT) environment, wherein the first query identifies events associated with a type of security incident, wherein events in the first set of events are assigned a first severity level by an IT and security operations application, wherein a second set of events stored in the data store do not satisfy the first query, and wherein events in the second set of events are assigned a second severity level that is less than the first severity level;
executing a second query against the second set of events that do not satisfy the first query to identify a third set of events, and wherein events in the third set of events do not individually indicate a security incident triggering an automated set of actions;
identifying, based on execution of the second query against the second set of events, a security event associated with an automated set of actions to be implemented by the IT and security operations application;
and
implementing the automated set of actions.

2 more elements

A system comprising:

a first electronic device to implement a data intake and query system, the data intake and query system including instructions that upon execution cause the data intake and query system to:
execute a first query against timestamped event data stored in a data store to identify a first set of events, wherein the timestamped event data is generated by the data intake and query system based on raw machine data obtained from one or more components of an information technology (IT) environment, wherein the first query identifies events associated with a type of security incident, wherein events in the first set of events are assigned a first severity level by an IT and security operations application, wherein a second set of events stored in the data store do not satisfy the first query, and wherein events in the second set of events are assigned a second severity level that is less than the first severity level, and
execute a second query against the second set of events that do not satisfy the first query to identify a third set of events, and wherein events in the third set of events do not individually indicate a security incident triggering an automated set of actions;
and
a second one or more electronic devices to implement the IT and security operations application in a cloud provider network, the IT and security operations application including instructions that upon execution cause the IT and security operations application to:
identify, based on execution of the second query against the second set of events, a security event associated with an automated set of actions to be implemented by the IT and security operations application, and
implement the automated set of actions.

4 more elements

Dependencies are inferred from the claim text.