# US 12,182,001 B2 · Auditing-as-a-service > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,182,001 B2 - Document ID: US12182001B2 - Status: Granted - Kind: B2 - Application number: 17/966,168 - Filed: 2022-10-14 - Published: 2023-02-02 - Granted: 2024-12-31 - Earliest claimed: 2019-07-29 - Assignees: NCR Voyix Corporation - Applicants: NCR Voyix Corporation - Inventors: Michael Schechter - Web page: https://patentgrep.com/patent/US12182001B2 ## CPC - G06F 11/3476: {Data logging (G06F11/14, G06F11/2205 take precedence)} - G06F 17/40: Data acquisition and logging (for input to computer G06F3/00) - G06F 11/3404: {for parallel or distributed programming} - G06F 11/3471: {Address tracing} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Auditing information is captured from a processing stack of an invoked application. An annotation customized for that invocation context is processed to filter and/or add additional audition information available from the processing stack. The customized auditing information is then sent to a destination based on a processing context of the invoked application when the invoked application completes processing. In an embodiment, the customized auditing information is housed in a data store and an interface is provided for customized query processing, report processing, event processing, a notification processing. ## Claims ### Claim 1 A method, comprising: identifying an expression linked to an application invoked within a processing context on a server; obtaining first data from a processing stack associated with the application; processing the expression with the first data; obtaining second data from the processing stack based on the processing; maintaining the second data in an object that is accessible to other resources after the application exits processing; sending the second data to an auditing microservice for indexing and storing in a centralized data store; parsing the expression using the first data to obtain the second data that includes custom audit data and identifying the custom audit data from the processing stack for the processing context, the custom audit data being defined by an annotation associated with the application; performing a searching, reporting, and mining through an audit interface of the centralized data store by indexing the custom audit data within the centralized data store; and sending a reference to the object to a resource after the application exits processing from the processing context. ### Claim 2 (depends on 1) The method of claim 1 further comprising, sending the second data to a resource based on the processing context. ### Claim 3 (depends on 1) The method of claim 1 further comprising, providing an interface for searching the centralized data store. ### Claim 4 (depends on 1) The method of claim 1 further comprising, assigning one or more categories to the second data. ### Claim 5 (depends on 4) The method of claim 4 further comprising, sending portions of the second data to a resource based on the one or more categories. ### Claim 6 (depends on 1) The method of claim 1 further comprising, processing the method as a service to additional applications. ### Claim 7 (depends on 1) The method of claim 1 further comprising, providing the object as a trace log of the application within a processing context associated with processing a transaction. ### Claim 8 (depends on 1) The method of claim 1, wherein identifying further includes detecting the expression based on invocation of the application within the processing context. ### Claim 9 (depends on 1) The method of claim 1, wherein identifying further includes initiating the identifying in response to a call made by the application to the method. ### Claim 10 A method, comprising: associating an expression with an application; detecting an invocation of the application on a processing stack within a processing context on a server; processing the expression and obtaining audit data for the application from the processing stack for the processing context; retaining the audit data in an object after the application exits processing within the processing context in an audit data store; categorizing portions of the audit data and sending each portion of the audit data to a certain resource associated with a corresponding assigned category, wherein categories are defined by an annotation associated with the application, and wherein the audit data includes metadata for an invoking application, metadata for an invoked application, an operation endpoint, an operation result, data for an invoking end user, data about the certain resource, additional invocation metadata, classification data for an audit content, and any ad-hoc user defined data, parsing the expression to obtain data types and patterns of data defined for the audit data from the processing stack; performing a searching, reporting, and mining through an audit interface of the audit data store by indexing the audit data within the audit data store; and sending a reference to the object to a resource after the application exits processing from the processing context. ### Claim 11 (depends on 10) The method of claim 10, wherein processing further includes parsing the expression to obtain data types and patterns of data defined for the audit data from the processing stack. ### Claim 12 (depends on 10) The method of claim 10 further comprising indexing the audit data within the audit data store for searching, reporting, and mining through an audit interface of the audit data store. ### Claim 13 (depends on 10) The method of claim 10, wherein retaining further includes retaining other audit data captured for the application with the audit data within the audit data store. ### Claim 14 (depends on 10) The method of claim 10, wherein associating further includes initiating the method based on an application identifier associated with the application appearing on the processing stack within the processing context. ### Claim 15 (depends on 14) The method of claim 14, wherein initiating further includes obtaining the expression based on an annotation identifier for the application being linked to the expression. ### Claim 16 A system, comprising: a cloud that comprises at least one server and the at least one server comprises at least one processor having instructions; and the instructions when executed by the at least one processor cause the at least one processor to perform operations comprising: identifying an annotation associated with an application that is invoked within a processing context on the at least one server; obtaining an expression for custom audit data based on the annotation; obtaining first audit data from a processing stack for the processing context of the application; obtaining the custom audit data by parsing the expression using the first audit data and identifying the custom audit data from the processing stack for the processing context; storing the first audit data and the custom audit data in an audit data store, wherein the custom audit data includes metadata for an invoking application, metadata for an invoked application, an operation endpoint, an operation result, data for an invoking end user, data about a target resource, additional invocation metadata, classification data for audit content, and any ad-hoc user defined data; retaining the custom audit data in an object that persists after the application exits processing from the processing context; searching the audit data store by utilizing an interface, and performing customized query processing, report processing, event processing, and notification processing based on the custom audit data by utilizing the interface; and sending a reference to the object to a resource after the application exits processing from the processing context.