# US 12,267,338 B2 · Event evaluation pipeline for alert engine

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,267,338 B2
- Document ID: US12267338B2
- Status: Granted
- Kind: B2
- Application number: 18/117,770
- Filed: 2023-03-06
- Published: 2024-02-01
- Granted: 2025-04-01
- Earliest claimed: 2020-07-21
- Assignees: Absolute Software Corporation
- Applicants: Absolute Software Corporation
- Inventors: Tomas Piedrahita Herran; Hansel D'Ornellas
- Web page: https://patentgrep.com/patent/US12267338B2

## CPC

- G06F 16/24568: {Data stream processing; Continuous queries}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- G06F 16/2474: {Sequence data queries, e.g. querying versioned data}
- G06F 16/93: Document management systems
- H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Provided is a way of evaluating rules/conditions that span different domain entities against a set of disparate events from multiple sources that have occurred within a specific window or interval of time from the current time back to a specific time in the past. Events are stored in dedicated storage to enable an extended window of time to be used for multiple event evaluation. Only relevant event/rule pairs are evaluated. The system will record when an event relevant to a rule happens. When a second event that is relevant to the rule happens, the system checks the records to see if a previous relevant event had happened in the past that would cause the rule to trigger an alert. A mechanism is also provided for evaluating static state in combination with changed properties.

## Claims

### Claim 1

A method for evaluating events related to an electronic device, the method comprising:
receiving a stream of pre-filtered events each of which is matched with a corresponding rule;
determining that a first of the events satisfies a condition of its corresponding rule;
creating a document that includes said first event, an indication of its corresponding rule, and an expiry time measured from said first event;
storing the document in a non-volatile storage;
determining that a second of the events satisfies another condition of the rule corresponding to said first event before the expiry time;
adding said second event to the document and an indication that said other condition is satisfied; and
taking a security action in relation to the electronic device.

### Claim 2

A method for evaluating events related to an electronic device, the method comprising:
analyzing a stream of pre-filtered events until a first of said events satisfies a condition of a rule corresponding to said first event;
creating a document that includes said first event, an identification of the rule, and an expiry time defined in the rule and measured from said first event;
storing the document in a non-volatile storage;
continuing to analyze said events until either (a) a second of the events satisfies another condition of the rule before the expiry time or (b) the expiry time has passed;
in the case of (a), adding said second event to the document and an indication that said other condition is satisfied, taking a security action in relation to the electronic device, and deleting the document;
in the case of (b), deleting the document and repeating the method with subsequent pre-filtered events.