# US 12,764,148 B1 · Using crowdsourced data for alert management in an anomaly detection framework > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,764,148 B1 - Document ID: US12764148B1 - Status: Granted - Kind: B1 - Application number: 18/747,104 - Filed: 2024-06-18 - Granted: 2026-10-13 - Earliest claimed: 2017-11-27 - Assignees: Fortinet, Inc. - Applicants: Lacework, Inc. - Inventors: Ting-Fang Yen; Mary L. Singh; Xuan Loc Bui; Yijou Chen - Web page: https://patentgrep.com/patent/US12764148B1 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 9/455: Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines - G06F 9/545: {where tasks reside in different layers, e.g. user- and kernel-space} - G06F 16/9024: {Graphs; Linked lists (G06F16/9027 takes precedence)} - G06F 16/9038: Presentation of query results - G06F 16/9535: Search customisation based on user profiles and personalisation - G06F 16/9537: Spatial or temporal dependent retrieval, e.g. spatiotemporal queries - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - H04L 43/045: for graphical visualisation of monitoring data - H04L 43/06: Generation of reports - H04L 63/10: {for controlling access to devices or network resources} - H04L 67/306: User profiles - H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)} - G06F 16/2456: {Join operations} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An illustrative method includes determining a severity of an anomaly associated with one or more compute assets within a particular compute environment and associated with a particular customer, accessing a plurality of customer datasets collected from a plurality of compute environments associated with a plurality of customers, each compute environment associated with a different customer included in the plurality of customers, and adjusting, based on the plurality of customer datasets, the severity of the anomaly with respect to the particular compute environment. ## Claims ### Claim 1 A method comprising: determining, by a data platform monitoring a plurality of compute environments associated with a plurality of customers of the data platform, a severity of an anomaly associated with one or more compute assets within a particular compute environment being monitored by the data platform and associated with a particular customer of the data platform; accessing, by the data platform, a plurality of customer datasets collected from the plurality of compute environments and each associated with a different customer included in the plurality of customers; analyzing, by the data platform, the plurality of customer datasets to detect feedback associated with one or more anomalies within the plurality of compute environments that correspond to the anomaly within the particular compute environment; and adjusting, by the data platform based on the plurality of customer datasets, the severity of the anomaly with respect to the particular compute environment, wherein the adjusting of the severity of the anomaly with respect to the particular compute environment is based on the feedback associated with the one or more anomalies within the plurality of compute environments. ### Claim 2 (depends on 1) The method of claim 1, further comprising: analyzing, by the data platform, the plurality of customer datasets to detect one or more occurrences of one or more anomalies within the plurality of compute environments that correspond to the anomaly within the particular compute environment; wherein the adjusting the severity of the anomaly with respect to the particular compute environment is based on the one or more occurrences of the one or more anomalies within the plurality of compute environments. ### Claim 3 (depends on 2) The method of claim 2, wherein the adjusting the severity of the anomaly includes comparing the one or more occurrences of the one or more anomalies within the plurality of compute environments to a predetermined threshold. ### Claim 4 (depends on 3) The method of claim 3, wherein the adjusting the severity of the anomaly includes downgrading the severity when the occurrences of the one or more anomalies within the plurality of compute environments exceeds the predetermined threshold. ### Claim 5 (depends on 3) The method of claim 3, wherein the adjusting the severity of the anomaly includes upgrading the severity when the one or more occurrences of the one or more anomalies within the plurality of compute environments is below the predetermined threshold. ### Claim 6 (depends on 3) The method of claim 3, wherein the predetermined threshold is based on a number of the one or more occurrences of the one or more anomalies within the plurality of compute environments. ### Claim 7 (depends on 3) The method of claim 3, wherein the predetermined threshold is based on a number of compute environments within which the one or more anomalies occurred. ### Claim 8 (depends on 3) The method of claim 3, wherein the predetermined threshold is adjustable. ### Claim 9 (depends on 1) The method of claim 1, wherein the adjusting the severity of the anomaly is further based on a user input designating an adjustment of the severity. ### Claim 10 (depends on 1) The method of claim 1, further comprising analyzing, by the data platform, a customer dataset associated with the particular compute environment to detect the anomaly within the particular compute environment. ### Claim 11 (depends on 10) The method of claim 10, wherein the adjusting the severity of the anomaly with respect to the particular compute environment is further based on one or more characteristics of the customer dataset associated with the particular compute environment. ### Claim 12 (depends on 11) The method of claim 11, wherein the one or more characteristics comprises one or more of a number of occurrences of the anomaly, an environment type associated with the anomaly, or an event type associated with the anomaly. ### Claim 13 (depends on 10) The method of claim 10, wherein the analyzing the customer dataset associated with the particular compute environment comprises generating a logical graph comprising a plurality of nodes interconnected by a plurality of edges, the plurality of nodes and the plurality of edges representative of activities within the particular compute environment. ### Claim 14 (depends on 1) The method of claim 1, further comprising providing, by the data platform, an alert indicating the adjusted severity of the anomaly. ### Claim 15 (depends on 14) The method of claim 14, further comprising prioritizing the alert relative to another alert based on the adjusted severity of the anomaly. ### Claim 16 (depends on 1) The method of claim 1, wherein one or more of the plurality of customer datasets are collected using one or more agents deployed at the plurality of compute environments. ### Claim 17 (depends on 1) The method of claim 1, wherein one or more of the plurality of customer datasets are collected using one or more agentless configurations. ### Claim 18 A computer program product embodied in a non-transitory computer-readable storage medium and comprising computer instructions for a data platform to perform a process comprising: determining a severity of an anomaly associated with one or more compute assets within a particular compute environment and associated with a particular customer; accessing a plurality of customer datasets collected from a plurality of compute environments associated with a plurality of customers, each compute environment associated with a different customer included in the plurality of customers; analyzing, by the data platform, the plurality of customer datasets to detect feedback associated with one or more anomalies within the plurality of compute environments that correspond to the anomaly within the particular compute environment; and adjusting, based on the plurality of customer datasets, the severity of the anomaly with respect to the particular compute environment, wherein the adjusting of the severity of the anomaly with respect to the particular compute environment is based on the feedback associated with the one or more anomalies within the plurality of compute environments. ### Claim 19 A system comprising: memory storing instructions; and one or more processors communicatively coupled to the memory and configured to execute the instructions to perform a process comprising: determining a severity of an anomaly associated with one or more compute assets within a particular compute environment and associated with a particular customer; accessing a plurality of customer datasets collected from a plurality of compute environments associated with a plurality of customers, each compute environment associated with a different customer included in the plurality of customers; analyzing, by the data platform, the plurality of customer datasets to detect feedback associated with one or more anomalies within the plurality of compute environments that correspond to the anomaly within the particular compute environment; and adjusting, based on the plurality of customer datasets, the severity of the anomaly with respect to the particular compute environment, wherein the adjusting of the severity of the anomaly with respect to the particular compute environment is based on the feedback associated with the one or more anomalies within the plurality of compute environments.