Searchable investigation history for event data store
AssigneeFactorChain Inc.
InventorsKenny Tidwell, David Frampton, Brendan O'Connell
Life of this patent
Estimating the term…
Abstract
A processing device receives a first query comprising a first field value and a first time period. The processing device performs a first search of a data store to identify a first plurality of events having the first time period and at least one field that comprises the first field value. The processing device generates a first search object comprising the first field value. The processing device generates a search event comprising the first field value and a reference to the first search object. An event entry for the first search event is then written to the data store. Future searches may return both the first search event and other events.
Claims20
A method comprising:
- receiving, by a processing device, a first query comprising a first field value and a first time period;
- performing, by the processing device, a first search of a data store to identify a first plurality of events having the first time period and at least one field that comprises the first field value;
- generating, by the processing device, a first search object comprising the first field value;
- generating, by the processing device, a first search event comprising the first field value and a reference to the first search object;
- and
- writing an event entry for the first search event to the data store, wherein the event entry is indexed in the data store based on the first field value.
A computer readable storage medium comprising instructions that, when executed by a processing device, cause the processing device to perform operations comprising:
- receiving, by the processing device, a first query comprising a first field value and a first time period;
- performing, by the processing device, a first search of a data store to identify a first plurality of events having the first time period and at least one field that comprises the first field value;
- generating, by the processing device, a first search object comprising the first field value;
- generating, by the processing device, a first search event comprising the first field value and a reference to the first search object;
- and
- writing an event entry for the first search event to the data store, wherein the event entry is indexed in the data store based on the first field value.
A system comprising:
- a data store to store a plurality of events;
- and
- a computing device, operatively coupled to the data store, to:
- receive a first query comprising a plurality of field values and a first time period;
- perform a first search of the data store to identify a first subset of the plurality of events having the first time period and the plurality of field values;
- generate a first search object comprising the plurality of field values;
- generate a first search event comprising a second time period that at least partially overlaps the first time period, a reference to the first search object, and the plurality of field values;
- and
- write a plurality of event entries for the first search event to the data store, wherein a separate event entry is written to the data store for each field value of the plurality of field values.
Dependencies are inferred from the claim text.