Method, system and program product for alerting an information technology support organization of a security event

A system for alerting an information technology support organization of a security event, comprising:

• an intrusion detection system configured to log in intrusion detection system logs a plurality of security events for a system within a network monitored by an information technology support organization;
• a trouble ticket alerting system configured to store therein a plurality of trouble tickets corresponding to said plurality of security events logged in said intrusion detection system logs;
• and
• a security event aggregator and reporter tool configured to determine, at a pre-determined time interval, whether or not a recent security event among a plurality of logged security events in said intrusion detection system logs corresponds to an existing trouble ticket among said plurality of trouble tickets stored in said trouble ticket alerting system;
• and wherein if said recent security event is determined to not correspond to said existing trouble ticket in said trouble ticket alerting system, said security event aggregator and reporter tool creates a new trouble ticket corresponding to said recent security event and notifies an owner of said system of said recent security event requesting that said owner alleviate said recent security event;
• and wherein if said recent security event is determined to correspond to said existing trouble ticket in said trouble ticket alerting system, said security event aggregator and reporter tool establishes whether or not a pre-determined threshold for escalation has expired before escalating said existing trouble ticket corresponding to said recent security event to a higher notification level, such that said information technology support organization is requested to take appropriate action to alleviate said recent security event.

A computer program product for alerting an information technology support organization of a security event, said computer program product comprising:

• a computer readable medium;
• first program instructions to store in a trouble ticket alerting system a plurality of trouble tickets corresponding to a plurality of logged security events for a system on a network monitored by an information technology support organization;
• second program instructions to determine, at a pre-determined time interval, whether or not a recent security event among one or more recently logged security events stored in intrusion detection system logs corresponds to an existing trouble ticket among said plurality of trouble tickets stored in said trouble ticket alerting system, said one or more recently logged security events being logged within said pre-determined time interval;
• third program instructions to automate creation of a new trouble ticket in said trouble ticket alerting system if said recent security event does not correspond to said existing trouble ticket stored in said trouble ticket alerting system, and if said recent security event corresponds to said existing trouble ticket stored in said trouble ticket alerting system, said third program instructions include instructions to establish whether or not a pre-determined threshold for escalation has expired before escalating said existing trouble ticket corresponding to said recent security event, such that said information technology support organization is alerted of said recent security event and can take appropriate action to alleviate said recent security event;
• and wherein said first, second and third program instructions are stored on said computer readable medium.

A process for deploying computing infrastructure comprising integrating computer-readable code into a computing system, wherein said code in combination with said computing system is capable of performing a process for alerting an information technology support organization of a security event, said process comprising:

• storing in a trouble ticket alerting system a plurality of trouble tickets corresponding to a plurality of logged security events for a system on a network monitored by an information technology support organization;
• providing an intrusion detection system for logging said plurality of logged security events into intrusion detection system logs;
• analyzing, at a pre-determined time interval, intrusion detection system logs for one or more recently logged security events of said plurality of logged security events, said one or more recently logged security events being logged within said pre-determined time interval;
• comparing a recent security event of said one or more recently logged security events to each of said plurality of trouble tickets stored in said trouble ticket alerting system;
• and
• if said recent security event does not match an existing trouble ticket, automatically creating a new trouble ticket in said trouble ticket alerting system, and if said recent security event matches said existing trouble ticket, escalating said existing trouble ticket, wherein said information technology support organization is alerted of said recent security event so that appropriate action can be taken to alleviate said recent security event.