Risk Adaptive Protection
AssigneeForcepoint LLC
InventorsChris Poirel, Ann Irvine, Russell Snyder, Chris Puderbaugh
Life of this patent
Estimating the term…
Abstract
A method, system and computer-usable medium for performing security analytics comprising receiving a stream of data from a data source; preprocessing the stream of data identify entity information and event information from the stream of data; transforming the entity information into transformed entity data and the event information into transformed event data; the transforming conforming to a genericized data model; storing the transformed entity data and the transformed event data in a security analytics data repository; and, performing a security analytics operation on the transformed entity data and the transformed event data.
Claims21
1-20. (canceled)
A computer-implementable method for generating enriched event related to an event, comprising:
- receiving a stream of data from a data source, the stream of data comprising a plurality of events;
- processing the steam of data to identify entity information and event information;
- transforming the entity information into transformed entity data and the event information into transformed event data;
- the transforming conforming to a genericized data model;
- storing the transformed entity data and the transformed event data in a data repository;
- and,
- performing an analytics operation using the transformed entity data and the transformed event data.
A system comprising:
- a processor;
- a data bus coupled to the processor;
- and
- a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
- receiving a stream of data from a data source, the stream of data comprising a plurality of events;
- processing the steam of data to identify entity information and event information;
- transforming the entity information into transformed entity data and the event information into transformed event data;
- the transforming conforming to a genericized data model;
- storing the transformed entity data and the transformed event data in a data repository;
- and,
- performing an analytics operation using the transformed entity data and the transformed event data.
A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:
- receiving a stream of data from a data source, the stream of data comprising a plurality of events;
- processing the steam of data to identify entity information and event information;
- transforming the entity information into transformed entity data and the event information into transformed event data;
- the transforming conforming to a genericized data model;
- storing the transformed entity data and the transformed event data in a data repository;
- and,
- performing an analytics operation using the transformed entity data and the transformed event data.
Dependencies are inferred from the claim text.