# US 12,113,664 B2 · Scalable security information and event management (SIEM) framework > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,113,664 B2 - Document ID: US12113664B2 - Status: Granted - Kind: B2 - Application number: 18/386,117 - Filed: 2023-11-01 - Published: 2024-02-22 - Granted: 2024-10-08 - Earliest claimed: 2019-01-31 - Assignees: CenturyLink Intellectual Property LLC - Applicants: CenturyLink Intellectual Property LLC - Inventors: Michael David Wimpy; Andrey Konczal - Web page: https://patentgrep.com/patent/US12113664B2 ## CPC - G06F 21/552: {involving long-term monitoring or reporting} - H04L 41/069: using logs of notifications; Post-processing of notifications - G06F 21/602: {Providing cryptographic facilities or services} - H04L 41/5074: Handling of user complaints or trouble tickets - H04L 69/04: Protocols for data compression, e.g. ROHC - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A framework for security information and event management (SIEM), the framework includes a first data store; a data router; one or more parsing mechanisms; one or more correlation machines; and one or more workflow engines, wherein said framework performs SIEM on behalf of multiple subscribers to said framework. ## Claims ### Claim 1 A framework for security information and event management (SIEM), the framework comprising: at least one processor; memory, operatively connected to the at least one processor storing instructions that, when executed by the processor, cause the framework to perform operations: a first data store; one or more parsing mechanisms; one or more correlation machines; and one or more workflow engines, wherein said framework performs SIEM on behalf of multiple subscribers to said framework, and wherein said first data store is constructed and adapted to store log data obtained from at least some of said multiple subscribers, and wherein said one or more parsing mechanisms are constructed and adapted to obtain log data from said first data store and to normalize said log, and wherein said one or more correlations machines are constructed and adapted: to obtain normalized log data, and to apply one or more correlation rules to said normalized log data to determine one or more correlations, and to put information about said one or more correlations on a correlations queue; and wherein said one or more workflow engines are constructed and adapted to obtain said information about said one or more correlations from said correlations queue and to determine ticket information based on said information about said one or more correlations, and to provide said ticket information to a subscriber of said multiple subscribers. ### Claim 2 (depends on 1) The framework of claim 1, wherein a data router informs said one or more correlation machines that normalized log data is by putting a message on a parsed queue. ### Claim 3 (depends on 2) The framework of claim 2, wherein the parsed message comprises a Simple Notification Service (SNS) message on the parsed queue. ### Claim 4 (depends on 1) The framework of claim 1, wherein the first data obtains log data obtained from one or more log collection appliances (LCAs) associated with said multiple subscribers. ### Claim 5 (depends on 4) The framework of claim 4, wherein each particular LCA is associated with a corresponding particular subscriber of said multiple subscribers. ### Claim 6 (depends on 1) The framework of claim 1, wherein said first data store is constructed and adapted to store data for each subscriber separately from data from each other subscriber. ### Claim 7 (depends on 1) The framework of claim 1, wherein a data router informs said one or more correlation machines of normalized log data present, based on subscriber-specific criteria. ### Claim 8 (depends on 1) The framework of claim 1, wherein the one or more correlation machines include at least one subscriber-dedicated correlation machine. ### Claim 9 (depends on 1) The framework of claim 1, wherein each subscriber has a corresponding correlation machine. ### Claim 10 (depends on 1) The framework of claim 1, wherein the one or more workflow engines determine said ticket information based on said information about said one or more correlations, and on other information. ### Claim 11 (depends on 10) The framework of claim 10, wherein the other information comprises information from one or more external systems. ### Claim 12 (depends on 1) The framework of claim 1, wherein said ticket information is used to generate and/or cause automated intervention at the subscriber. ### Claim 13 (depends on 12) The framework of claim 12, wherein said intervention is provided using one or more APIs on devices on the subscriber's network. ### Claim 14 A method operable in a framework for security information and event management (SIEM), said framework supporting SIEM on behalf of multiple subscribers to said framework, the framework having: a first data store; one or more parsing mechanisms; one or more correlation machines; and one or more workflow engines, wherein the method comprises: storing, in said first data, encrypted, compressed log data obtained from at least some of said multiple subscribers; said one or more parsing mechanisms obtaining data from said first data store and normalizing said log data, said one or more correlations machines: obtaining normalized log data, and applying one or more correlation rules to said normalized log data to determine one or more correlations, and putting information about said one or more correlations on a correlations queue; and said one or more workflow engines obtaining said information about said one or more correlations from said correlations queue and determining ticket information based on said information about said one or more correlations, and providing said ticket information to a subscriber of said multiple subscribers. ### Claim 15 (depends on 14) The method of claim 14, wherein a data router informs said one or more correlation machines that normalized log data are present by putting a message on a parsed queue. ### Claim 16 (depends on 15) The method of claim 15, wherein the parsed message comprises a Simple Notification Service (SNS) message on the parsed queue. ### Claim 17 (depends on 14) The method of claim 14, wherein the first data obtains log data obtained from one or more log collection appliances (LCAs) associated with said multiple subscribers. ### Claim 18 (depends on 17) The method of claim 17, wherein each particular LCA is associated with a corresponding particular subscriber of said multiple subscribers. ### Claim 19 (depends on 14) The method of claim 14, wherein said first data store is constructed and adapted to store data for each subscriber separately from data from each other subscriber. ### Claim 20 (depends on 14) The method of claim 14, wherein a data router informs said one or more correlation machines of normalized log data are present, based on subscriber-specific criteria. ### Claim 21 (depends on 14) The method of claim 14, wherein the one or more correlation machines include at least one subscriber-dedicated correlation machine. ### Claim 22 (depends on 14) The method of claim 14, wherein each subscriber has a corresponding correlation machine. ### Claim 23 (depends on 14) The method of claim 14, wherein the one or more workflow engines determine said ticket information based on said information about said one or more correlations, and on other information. ### Claim 24 (depends on 23) The method of claim 23, wherein the other information comprises information from one or more external systems. ### Claim 25 (depends on 14) The method of claim 14, wherein said ticket information is used to generate and/or cause automated intervention at the subscriber. ### Claim 26 (depends on 25) The method of claim 25, wherein said intervention is provided using one or more APIs on devices on the subscriber's network. ### Claim 27 (depends on 14) A non-transitory computer-readable medium with one or more computer programs stored therein that, when executed by one or more processors of a device, cause the one or more processors to perform the operations of the method of claim 14.