Back to results
US 12,771,698 B2Granted
Real-time streaming event enrichment for security endpoints
AssigneeCrowdStrike, Inc.
InventorsBrent Ryan Nash, James Robert Plush, Matthew Rowen
Life of this patent
Estimating the term…
Abstract
Hosts of a digital security system receive event data sent by sensors on endpoints that correspond with the hosts. The hosts locally maintain enrichment caches of information regarding the endpoints, and may update the enrichment caches based on information indicated by received event data. The hosts may also generate enriched event data, corresponding to received event data, by adding enrichment data indicated in the enrichment caches that was omitted from the event data sent by sensors.
Claims17
A computer-implemented method, comprising:
- receiving, by a host in a digital security system, event data sent by a sensor executing on a computing endpoint, wherein:
- the sensor comprises a security agent configured to detect computing events that occur on the computing endpoint,
- the event data indicates information associated with an occurrence of a computing event, detected by the security agent, on the computing endpoint, and
- the host maintains an enrichment cache that stores enrichment data, associated with the computing endpoint, determined based at least in part on one or more instances of previous event data that the sensor previously sent to the digital security system;
- determining, by the host, that one or more types of the enrichment data associated with the computing endpoint, indicated by the enrichment cache, are absent from the event data sent by the sensor;
- generating, by the host, enriched event data by adding the one or more types of the enrichment data, from the enrichment cache, to the event data;
- determining, by the host, that the event data indicates new enrichment data associated with the computing endpoint that is not indicated by the enrichment cache maintained by the host;
- and
- updating, by the host, the enrichment cache maintained by the host to indicate the new enrichment data.
6 more elements
A computing system, comprising:
- one or more processors;
- and
- memory storing computer-executable instructions associated with a host of a digital security system that, when executed by the one or more processors, cause the host to:
- receive event data sent by a sensor executing on a computing endpoint, wherein:
- the sensor comprises a security agent configured to detect computing events that occur on the computing endpoint,
- the event data indicates information associated with an occurrence of a computing event, detected by the security agent, on the computing endpoint, and
- the host maintains an enrichment cache that stores enrichment data, associated with the computing endpoint, determined based at least in part on one or more instances of previous event data that the sensor previously sent to the digital security system;
- determine that one or more types of the enrichment data associated with the computing endpoint, indicated by the enrichment cache, are absent from the event data sent by the sensor;
- generate enriched event data by adding the one or more types of the enrichment data, from the enrichment cache, to the event data;
- determine that the event data indicates new enrichment data associated with the computing endpoint that is not indicated by the enrichment cache maintained by the host;
- and
- update the enrichment cache maintained by the host to indicate the new enrichment data.
9 more elements
One or more non-transitory computer-readable media storing computer-executable instructions associated with a host of a digital security system that, when executed by one or more processors, cause the host to:
- receive event data sent by a sensor executing on a computing endpoint, wherein:
- the sensor comprises a security agent configured to detect computing events that occur on the computing endpoint,
- the event data indicates information associated with an occurrence of a computing event, detected by the security agent, on the computing endpoint, and
- the host maintains an enrichment cache that stores enrichment data, associated with the computing endpoint, determined based at least in part on one or more instances of previous event data that the sensor previously sent to the digital security system;
- determine that one or more types of the enrichment data associated with the computing endpoint, indicated by the enrichment cache, are absent from the event data sent by the sensor;
- generate enriched event data by adding the one or more types of the enrichment data, from the enrichment cache, to the event data;
- determine that the event data indicates new enrichment data associated with the computing endpoint that is not indicated by the enrichment cache maintained by the host;
- and
- update the enrichment cache maintained by the host to indicate the new enrichment data.
6 more elements
Dependencies are inferred from the claim text.