Back to results
US 2016/0255114 A1Published application
Lateral account mapping
AssigneeRapid7, Inc.
InventorsMatthew Robert Hathaway, Samuel Adams, Jeff Myers, Steven Torance
Life of this patent
Estimating the term…
Abstract
Systems and methods of correlating accounts among a plurality of network assets using account lateral movement data is presented in the context of network security. In one embodiment a plurality of authentication audit logs are received from a plurality of assets; the plurality of authentication audit logs are correlated; and a notification is generated based on a comparison of correlation results and a database of permitted account associations.
Claims20
A method of monitoring a network, the method comprising:
- receiving, via a processing module, a plurality of authentication audit logs to assist in generating account lateral movement mapping data from a plurality of assets;
- correlating, via the processing module, the plurality of authentication audit logs;
- and
- generating, via the processing module, a notification based on a comparison of correlation results and a database of permitted associations among multiple accounts used by a single user.
1 more element
A system for monitoring a network, the system comprising:
- a database of permitted associations between at least one account and at least one asset;
- a processing module in communication with the database;
- and
- memory storing instructions configured to instruct the processing module to receive a plurality of authentication audit logs to assist in generating account lateral movement mapping data from a plurality of assets, correlate the plurality of authentication audit logs;
- and,. in response to the correlation of the plurality of authentication logs, generate a notification based on a comparison of correlation results and the database of permitted associations among multiple accounts used by a single user.
2 more elements
Dependencies are inferred from the claim text.