Event Model for Correlating System Component States
AssigneeCrowdStrike, Inc.
InventorsDaniel T. Martin, David F. Diehl
Life of this patent
Estimating the term…
Abstract
A computing device described herein is configured to receive a notification of an event associated with a plurality of system components. In response, the computing device determines a state for the system components based on a state for one of those system components specified in an event model. That specified state in the event model reflects a previous occurrence of another event.
Claims26
A computer-implemented method comprising:
- receiving a first notification of a first event associated with a system component;
- specifying a state for the system component in an event model;
- receiving a second notification of a second event associated with a plurality of system components which include the system component;
- and
- based at least in part on the specified state for the system component, determining a state for the plurality of system components.
One or more non-transitory computer-readable media having stored thereon computer-executable instructions which, when executed by a computing device, cause the computing device to perform operations comprising:
- receiving a first notification of a first event associated with a system component;
- specifying a state for the system component in an event model;
- receiving a second notification of a second event associated with a plurality of system components which include the system component;
- and
- based at least in part on the specified state for the system component, determining a state for the plurality of system components.
A system comprising:
- one or more processors;
- a kernel-level security agent configured to be operated by the one or more processors, the kernel-level security agent including:
- an event bus configured to receive and dispatch events associated with system components;
- an event model configured to maintain states for system components and combinations of system components;
- and
- an event model manager configured to receive notifications of events from the event bus and to determine a state for a combination of components based at least in part on an event and on a state for one component of the combination of system components that is maintained by the event model.
Dependencies are inferred from the claim text.