# US 2019/0098032 A1 · Systems and methods for detecting network security threat event patterns > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0098032 A1 - Document ID: US20190098032A1 - Status: Published application - Kind: A1 - Application number: 15/715,015 - Filed: 2017-09-25 - Published: 2019-03-28 - Earliest claimed: 2017-09-25 - Assignees: Splunk Inc. - Applicants: Splunk Inc. - Inventors: Lucas Murphey; Francis Gerard; Richard Barger; Bhavin Patel; Patrick Schulz; Chinmay Kulkarni - Web page: https://patentgrep.com/patent/US20190098032A1 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 9/4498: {Finite state machines} - G06F 16/951: Indexing; Web crawling techniques - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - G06F 3/0482: Interaction with lists of selectable items, e.g. menus - G06T 11/26: Drawing of charts or graphs - G06T 2200/24: involving graphical user interfaces [GUIs] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06T: IMAGE DATA PROCESSING OR GENERATION, IN GENERAL ## Abstract Techniques and mechanisms are disclosed for a data intake and query system to generate “meta-notable” events by applying a meta-notable event rule to a collection of notable event data. A meta-notable event rule specifies one or more patterns of notable event instances defined by a set of notable event states and a set of transition rules (also referred to as association rules) indicating conditions for transitioning from one notable event state to another. The set of notable event states includes at least one start state and at least one end state. A meta-notable event is generated when a set of analyzed notable events satisfies a set of transition rules linking a start state to an end state (including transitions through any intermediary states between the start state and the end state). ## Claims ### Claim 1 A computer-implemented method, comprising: accessing a meta-notable event rule, the meta-notable event rule including: a plurality of notable event states, at least one of the plurality of notable event states corresponding to a correlation search used to identify timestamped event data matching one or more search criteria, wherein at least one of the plurality of notable event states is a start state and at least one of the plurality of notable event states is an end state, and a plurality of transition rules, each transition rule defining one or more criteria for transitioning between two notable event states of the plurality of notable event states; analyzing a plurality of notable events using the meta-notable event rule by determining whether any set of notable events from the plurality of notable events satisfies a set of transition rules from the plurality of transition rules linking a start state to an end state of the meta-notable event rule; and in response to determining that a set of events satisfies the meta-notable event rule, storing a record identifying the set of notable events satisfying the meta-notable event rule. ### Claim 2 (depends on 1) The method of claim 1, wherein at least one notable event of the plurality of notable events is generated based on execution of a correlation search. ### Claim 3 (depends on 1) The method of claim 1, wherein the record identifying the set of notable events satisfying the meta-notable event rule is a timestamped event including identifiers of each notable event comprising the set of notable events. ### Claim 4 (depends on 1) The method of claim 1, wherein the event data comprises a plurality of events, each event including a portion of raw machine data created by one or more components of an information technology or security environment. ### Claim 5 (depends on 1) The method of claim 1, wherein at least one of the analyzed plurality of notable events indicates a potential network security threat involving at least one computing device of an information technology or security environment. ### Claim 6 (depends on 1) The method of claim 1, wherein the set of notable events satisfying the meta-notable event rule indicates a potential network security threat involving a plurality of computing devices of a computer network. ### Claim 7 (depends on 1) The method of claim 1, further comprising causing display of a graphical user interface (GUI) including graphical elements used to receive input specifying the plurality of notable event states and the plurality of transition rules. ### Claim 8 (depends on 1) The method of claim 1, further comprising causing display of a graphical user interface (GUI) including graphical elements used to display information related to the stored record identifying the set of notable events satisfying the meta-notable event rule. ### Claim 9 (depends on 1) The method of claim 1, further comprising causing display of a graphical user interface (GUI) including graphical elements used to display information related to the stored record identifying the set of notable events satisfying the meta-notable event rule, the displayed information including information stored as part of at least one of the notable events from the set of notable events satisfying the meta-notable event rule. ### Claim 10 (depends on 1) The method of claim 1, further comprising causing display of a graphical user interface (GUI) including a graph showing relationships among the set of notable events satisfying the meta-notable event rule. ### Claim 11 (depends on 1) The method of claim 1, further comprising causing display of a graphical user interface (GUI) including graphical elements used to display an indication, for at least one particular notable event of the set of notable events satisfying the meta-notable event rule, a total number of notable event sets satisfying the meta-notable event rule that include the particular notable event. ### Claim 12 (depends on 1) The method of claim 1, wherein the set of transition rules links a start state to the end state based on transitions to one or more intermediate notable event states between the start state and the end state. ### Claim 13 (depends on 1) The method of claim 1, wherein the correlation search used to identify the event data matching the one or more search criteria is executed periodically. ### Claim 14 (depends on 1) The method of claim 1, wherein the correlation search used to identify the event data matching the one or more search criteria is executed on event data stored in a field-searchable data store. ### Claim 15 (depends on 1) The method of claim 1, wherein the correlation search is executed to identify event data stored in a field-searchable data store matching the one or more search criteria, the stored event data comprising time stamped events that include a portion of raw machine data created by a component of an information technology or security environment and which relates to activity of the component in the information technology or security environment. ### Claim 16 (depends on 1) The method of claim 1, wherein the correlation search is executed to search for event data stored in a field-searchable data store using a late-binding schema. ### Claim 17 (depends on 1) The method of claim 1, further comprising: receiving raw machine data from components of an information technology or security environment; segmenting the received raw machine data into events, each event containing a portion of the collected raw machine data; and for each event, determining a time stamp for the event, associating the time stamp with the event, and storing the event in a field-searchable data store. ### Claim 18 (depends on 1) The method of claim 1, wherein the event data includes a portion of raw machine data created by one or more components of an information technology or security environment, and wherein at least one component of the information technology or security environment is one of a desktop computer, a workstation, a laptop computer, a tablet computer, a mobile device, a server, a database, a networking device, an application. ### Claim 19 (depends on 1) The method of claim 1, wherein the event data includes a portion of raw machine data created by one or more components of an information technology or security environment, and wherein the raw machine data includes one or more of log data, wire data, server data, network data, file system information, registry information, and information related to one or more processes or services running on a device. ### Claim 20 (depends on 1) The method of claim 1, wherein at least one transition rule of the plurality of transition rules indicates a field value to be present in notable events satisfying the at least one transition rule. ### Claim 21 (depends on 1) The method of claim 1, wherein at least one transition rule of the plurality of transition rules indicates a field value to be matched between a first notable event matched by the at least one transition rule and a second notable event matched by a previous transition rule. ### Claim 22 (depends on 1) The method of claim 1, wherein at least one transition rule of the plurality of transition rules indicates filter excluding notable events matching one or more filtering conditions. ### Claim 23 (depends on 1) The method of claim 1, wherein at least one transition rule of the plurality of transition rules includes a time-based filter excluding notable events matching one or more time-based filtering conditions. ### Claim 24 (depends on 1) The method of claim 1, wherein at least one transition rule of the plurality of transition rules includes logical connectors connecting two or more matching or filtering conditions. ### Claim 25 A non-transitory computer-readable storage medium storing instructions which, when executed by one or more processors, cause performance of operations comprising: accessing a meta-notable event rule, the meta-notable event rule including: a plurality of notable event states, at least one of the plurality of notable event states corresponding to a correlation search used to identify timestamped event data matching one or more search criteria, wherein at least one of the plurality of notable event states is a start state and at least one of the plurality of notable event states is an end state, and a plurality of transition rules, each transition rule defining one or more criteria for transitioning between two notable event states of the plurality of notable event states; analyzing a plurality of notable events using the meta-notable event rule by determining whether any set of notable events from the plurality of notable events satisfies a set of transition rules from the plurality of transition rules linking a start state to an end state of the meta-notable event rule; and in response to determining that a set of notable events satisfies the meta-notable event rule, storing an record identifying the set of notable events satisfying the meta-notable event rule. ### Claim 26 (depends on 25) The non-transitory computer-readable storage medium of claim 25, wherein at least one notable event of the plurality of notable events is generated based on execution of a correlation search. ### Claim 27 (depends on 25) The non-transitory computer-readable storage medium of claim 25, wherein the record identifying the set of notable events satisfying the meta-notable event rule is a timestamped event including identifiers of each notable event comprising the set of notable events. ### Claim 28 An apparatus, comprising: one or more processors; a non-transitory computer-readable storage medium coupled to the one or more processors, the computer-readable storage medium storing instructions which, when executed by the one or more processors, causes the apparatus to: access a meta-notable event rule, the meta-notable event rule including: a plurality of notable event states, at least one of the plurality of notable event states corresponding to a correlation search used to identify timestamped event data matching one or more search criteria, wherein at least one of the plurality of notable event states is a start state and at least one of the plurality of notable event states is an end state, and a plurality of transition rules, each transition rule defining one or more criteria for transitioning between two notable event states of the plurality of notable event states; analyze a plurality of notable events using the meta-notable event rule by determining whether any set of notable events from the plurality of notable events satisfies a set of transition rules from the plurality of transition rules linking a start state to an end state of the meta-notable event rule; and in response to determining that a set of events satisfies the meta-notable event rule, store an record identifying the set of notable events satisfying the meta-notable event rule. ### Claim 29 (depends on 28) The apparatus of claim 28, wherein at least one notable event of the plurality of notable events is generated based on execution of a correlation search. ### Claim 30 (depends on 28) The apparatus of claim 28, wherein the record identifying the set of notable events satisfying the meta-notable event rule is a timestamped event including identifiers of each notable event comprising the set of notable events.