System security agent authentication and alert distribution
AssigneeIntel Corporation
InventorsAlan Ross, Dennis Morgan
Life of this patent
Estimating the term…
Abstract
An aggregation agent may combine and correlate information generated by multiple on-host agents and/or information generated in response to multiple security events. The aggregation agent may transmit the combined information to a security console. The security console may check the identity of the aggregation agent to determine whether to accept the information. The security console may map information to one or more consoles.
Claims20
A method comprising:
- receiving from a security agent a security alert message having multiple security reports aggregated, each security report representing a security event on a host system;
- determining a security server with which each security report in the security alert message is associated;
- and
- transmitting a security report from the security alert message to the associated security server.
An article of manufacture comprising a machine accessible medium with content to be accessed to result in a machine performing operations including:
- receiving a signal sent from an agent, the signal having data aggregated from multiple host-based security entities;
- authenticating the sending agent;
- and
- if the sending agent successfully authenticates, mapping the aggregated data to one or more security enforcement servers.
An apparatus comprising:
- a receiver to receive from a transport agent on a communication link an aggregated security message having multiple items of data from multiple on-host security agents;
- a communication line controller to configure the communication link to receive the aggregated security message;
- and
- a management engine to transmit each item of data from the aggregated security message to a management console.
A system comprising:
- an aggregation agent to aggregate multiple host-based security event notifications into a single security report and transmit the single security report to a security server;
- a router coupled with the aggregation agent to route the single security report from the aggregation agent to the security server;
- and
- the security server coupled with the router to receive the single security report and indicate the a host-based security event notification to a security console.
Dependencies are inferred from the claim text.