Back to results
US 2018/0124014 A1Published application
Security information and event management
AssigneeFortinet, Inc.
InventorDong Liang
Life of this patent
Estimating the term…
Abstract
Systems and methods are described for conducting work flows by an SIEM device to carry out a complex task automatically. According to one embodiment, an SIEM device may receive a work flow template defining at an abstract level multiple security tasks that are performed by one or more security devices. The SIEM device starts a work flow instance by deriving the work flow instance from the work flow template and scheduling the security tasks to be performed by the one or more security devices or replacements thereof. The SIEM device then collects results of security tasks.
Claims20
A method comprising:
- receiving, by a security information and event management (SIEM) device associated with a private network, information specifying a work flow template, wherein the work flow template defines a plurality of security tasks that are to be performed by one or more security devices or replacements thereof associated with the private network and as a result of the plurality of security tasks being represented at an abstract level in a form of descriptors, the work flow template need not be changed when the one or more security devices are upgraded or replaced, wherein the plurality of security tasks include functions that are intended to protect the private network against attacks;
- starting, by the SIEM, a work flow instance by:
- deriving the work flow instance from the work flow template, including translating the descriptors into commands and parameters (i) for accomplishing the plurality of security tasks by the one or more security devices or replacements thereof (ii) that are specific to the one or more security devices or replacements thereof;
- and
- scheduling the one or more security devices or replacements thereof to perform the plurality of security tasks defined in the work flow template by sending the commands and parameters to the one or more security devices or replacements thereof through a device adapter layer implemented by the SIEM device;
- and
- collecting, by the SIEM device, results of the plurality of security tasks after they are performed by the one or more security devices of replacements thereof.
4 more elements
A security information and event management (SIEM) system associated with a private network, the SIEM system comprising:
- a non-transitory storage device having embodied therein one or more routines;
- and
- one or more processors coupled to the non-transitory storage device and operable to execute the one or more routines to perform a method comprising:
- receiving information specifying a work flow template, wherein the work flow template defines a plurality of security tasks that are to be performed by one or more security devices or replacements thereof associated with the private network and as a result of the plurality of security tasks being represented at an abstract level in a form of descriptors, the work flow template need not be changed when the one or more security devices are upgraded or replaced, wherein the plurality of security tasks include functions that are intended to protect the private network against attacks;
- starting a work flow instance by:
- deriving the work flow instance from the work flow template, including translating the descriptors into commands and parameters (i) for accomplishing the plurality of security tasks by the one or more security devices or replacements thereof (ii) that are specific to the one or more security devices or replacements thereof;
- and
- scheduling the one or more security devices or replacements thereof to perform the plurality of security tasks defined in the work flow template by sending the commands and parameters to the one or more security devices or replacements thereof through a device adapter layer implemented by the SIEM system;
- and
- collecting results of the plurality of security tasks after they are performed by the one or more security devices of replacements thereof.
7 more elements
Dependencies are inferred from the claim text.