Risk based priority processing of data
AssigneeLogRhythm, Inc.
InventorsChristopher L. Petersen, Mark Vankempen
Life of this patent
Estimating the term…
Abstract
Utilities (e.g., methods, systems, apparatuses, etc.) for use in generating and making use of priority scores for data generated by one or more data systems that more accurately prioritize those events and other pieces of data to be addressed by analysts and troubleshooters before others (e.g., collectively taking into account threats posed by origin host components and risks to impacted host components) to work the highest risk events and alarms first and to effectively and efficiently spend their alarm monitoring time.
Claims28
A method for use in monitoring data generated by one or more data systems, the method comprising:
- receiving, at a processing platform over at least one communications network, data generated by one or more data systems;
- operating the processing platform to parse from the data at least one of an origin host identifier associated with an origin host component responsible for initiating an occurrence on the one or more data systems and an impacted host identifier associated with an impacted host component that is affected by an occurrence on the one or more data systems;
- determining, by the processing platform, that the at least one of the origin host identifier and impacted host identifier cannot be used to obtain a previously-configured relative risk or threat level for the origin host component or impacted host component from a database of known hosts and corresponding previously-configured relative risk or threat levels;
- obtaining, by the processing platform, a substitute relative risk or threat level for the origin host component or impacted host component using the at least one of the origin host identifier and impacted host identifier;
- and
- generating, with the processing platform, a risk based priority score for the data with the substitute relative risk or threat level.
(canceled)
(canceled)
A method for use in monitoring data generated by one or more data systems, the method comprising:
- receiving, at a processing platform over at least one communications network, data generated by one or more data systems;
- operating the processing platform to parse at least a first identifier from the data, wherein the first identifier identifies a host computer of the one or more data systems;
- determining, with the processing platform, whether the parsed first identifier can be used to obtain a relative risk or threat level of a known network range within which the identifier is resident;
- and
- using the processing platform to generate a risk based priority score for the data based on a result of the determining.
26-28. (canceled)
30-47. (canceled)
Dependencies are inferred from the claim text.