# US 2018/0027010 A1 · Realtime triggering framework > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0027010 A1 - Document ID: US20180027010A1 - Status: Published application - Kind: A1 - Application number: 15/216,201 - Filed: 2016-07-21 - Published: 2018-01-25 - Earliest claimed: 2016-07-21 - Assignees: Sap SE - Applicants: Sap SE - Inventors: Eugen Pritzkau; Kathrin Nos; Marco Rodeck; Florian Chrosziel; Jona Hassforther; Rita Merkel; Thorsten Menke; Thomas Kunz; Hartwig Seifert; Harish Mehta; Wei-Guo Peng; Lin Luo; Nan Zhang; Hristina Dinkova - Web page: https://patentgrep.com/patent/US20180027010A1 ## CPC - H04L 63/1433: {Vulnerability analysis} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 43/106: using time related information in packets, e.g. by adding timestamps - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A computer-implemented method generates a trigger registration for a selected triggering type. The generated trigger registration is stored in a triggering persistency. A received event from an event persistency is analyzed and data associated with the analyzed event is compared with the triggering persistency. Based on the comparison and using a pattern execution framework, an enterprise threat detection (ETD) pattern is processed to perform actions responsive to the received event. ## Claims ### Claim 1 A computer-implemented method, comprising: generating a trigger registration for a selected triggering type; storing the generated trigger registration in a triggering persistency; analyzing a received event from an event persistency; comparing data associated with the analyzed event with the triggering persistency; and based on the comparison, processing, using a pattern execution framework, an enterprise threat detection (ETD) pattern to perform actions responsive to the received event. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the triggering type includes one of the group consisting of by event and by pattern. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the trigger registration is stored in a triggering persistency registration list. ### Claim 4 (depends on 3) The computer-implemented method of claim 3, comprising determining that the data associated with the analyzed event matches registered content or one or more semantic value trigger registrations in the triggering persistency registration list. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, comprising: instantiating a processing thread to process the ETD pattern; and delegating the processing of the ETD pattern from the processing thread to the pattern execution framework. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, comprising determining that execution of the ETD pattern generates an additional event. ### Claim 7 (depends on 6) The computer-implemented method of claim 6, comprising determining whether a triggering registration for the additional event exists in the triggering persistency. ### Claim 8 A non-transitory, computer-readable medium storing one or more instructions executable by a computer system to perform operations comprising: generating a trigger registration for a selected triggering type; storing the generated trigger registration in a triggering persistency; analyzing a received event from an event persistency; comparing data associated with the analyzed event with the triggering persistency; and based on the comparison, processing, using a pattern execution framework, an enterprise threat detection (ETD) pattern to perform actions responsive to the received event. ### Claim 9 (depends on 8) The non-transitory, computer-readable medium of claim 8, wherein the triggering type includes one of the group consisting of by event and by pattern. ### Claim 10 (depends on 8) The non-transitory, computer-readable medium of claim 8, wherein the trigger registration is stored in a triggering persistency registration list. ### Claim 11 (depends on 10) The non-transitory, computer-readable medium of claim 10, comprising one or more instructions to determine that the data associated with the analyzed event matches registered content or one or more semantic value trigger registrations in the triggering persistency registration list. ### Claim 12 (depends on 8) The non-transitory, computer-readable medium of claim 8, comprising one or more instructions to: instantiate a processing thread to process the ETD pattern; and delegate the processing of the ETD pattern from the processing thread to the pattern execution framework. ### Claim 13 (depends on 8) The non-transitory, computer-readable medium of claim 8, comprising one or more instructions to determine that execution of the ETD pattern generates an additional event. ### Claim 14 (depends on 13) The non-transitory, computer-readable medium of claim 13, comprising one or more instructions to determine whether a triggering registration for the additional event exists in the triggering persistency. ### Claim 15 A computer-implemented system, comprising: a hardware processor interoperably coupled with a computer memory and configured to perform operations comprising: generating a trigger registration for a selected triggering type; storing the generated trigger registration in a triggering persistency; analyzing a received event from an event persistency; comparing data associated with the analyzed event with the triggering persistency; and based on the comparison, processing, using a pattern execution framework, an enterprise threat detection (ETD) pattern to perform actions responsive to the received event. ### Claim 16 (depends on 15) The computer-implemented system of claim 15, wherein the triggering type includes one of the group consisting of by event and by pattern. ### Claim 17 (depends on 15) The computer-implemented system of claim 15, wherein the trigger registration is stored in a triggering persistency registration list. ### Claim 18 (depends on 17) The computer-implemented system of claim 17, configured to determine that the data associated with the analyzed event matches registered content or one or more semantic value trigger registrations in the triggering persistency registration list. ### Claim 19 (depends on 15) The computer-implemented system of claim 15, configured to: instantiate a processing thread to process the ETD pattern; and delegate the processing of the ETD pattern from the processing thread to the pattern execution framework. ### Claim 20 (depends on 15) The computer-implemented system of claim 15, configured to: determine that execution of the ETD pattern generates an additional event; and determine whether a triggering registration for the additional event exists in the triggering persistency.