Retention and accessibility of data characterizing events on an endpoint computer
AssigneeCylance Inc.
InventorsRyan Permeh, Matthew Wolff, Samuel Oswald, Xuan Zhao, Mark Culley, Steve Polson
Life of this patent
Estimating the term…
Abstract
An endpoint computer system can harvest data relating to a plurality of events occurring within an operating environment of the endpoint computer system and can add the harvested data to a local data store maintained on the endpoint computer system. In some examples, the local data store can be an audit log and/or can include one or more tamper resistant features. Systems, methods, and computer program products are described.
Claims22
A system, comprising:
- computer hardware configured to perform operations comprising:
- harvesting, by an endpoint computer system, data relating to a plurality of events occurring within an operating environment of the endpoint computer system, the harvesting comprising receiving and/or inferring the data using one or more sensors executing on the endpoint computer system;
- adding the data to a local data store maintained on the endpoint computer system, the local data store comprising an audit log, the audit log comprising a series of data containers, each data container in the series comprising a tamper resistant feature, currently generated forensic data being stored in a current data container of the series while preceding data containers in the series are closed to further write operations.
A non-transitory computer readable medium storing instructions that, when executed by one or more programmable processors, cause the one or more programmable processors to perform operations comprising:
- harvesting, by an endpoint computer system, data relating to a plurality of events occurring within an operating environment of the endpoint computer system, the harvesting comprising receiving and/or inferring the data using one or more sensors executing on the endpoint computer system;
- adding the data to a local data store maintained on the endpoint computer system, the local data store comprising an audit log, the audit log comprising a series of data containers, each data container in the series comprising a tamper resistant feature, currently generated forensic data being stored in a current data container of the series while preceding data containers in the series are closed to further write operations.
A computer-implemented method comprising:
- harvesting, by an endpoint computer system, data relating to a plurality of events occurring within an operating environment of the endpoint computer system, the harvesting comprising receiving and/or inferring the data using one or more sensors executing on the endpoint computer system;
- adding the data to a local data store maintained on the endpoint computer system, the local data store comprising an audit log, the audit log comprising a series of data containers, each data container in the series comprising a tamper resistant feature, currently generated forensic data being stored in a current data container of the series while preceding data containers in the series are closed to further write operations.
Dependencies are inferred from the claim text.