Back to results
US 2019/0294789 A1Published application
Retention and Accessibility of Data Characterizing Events on an Endpoint Computer
AssigneeCylance Inc.
InventorsRyan Permeh, Matthew Wolff, Samuel John Oswald, Xuan Zhao, Mark Culley, Steve Polson
Life of this patent
Estimating the term…
Abstract
An endpoint computer system can harvest data relating to a plurality of events occurring within an operating environment of the endpoint computer system and can add the harvested data to a local data store maintained on the endpoint computer system. In some examples, the local data store can be an audit log and/or can include one or more tamper resistant features. Systems, methods, and computer program products are described.
Claims20
A method comprising:
- harvesting, by an endpoint computer system, data relating to a plurality of events occurring within and characterizing a history of an operating environment of the endpoint computer system, the harvesting comprising receiving and/or inferring the data using one or more sensors executing on the endpoint computer system;
- and
- adding the data to a local data store maintained on the endpoint computer system, the local data store comprising an audit log, the audit log comprising a series of cryptographically linked data containers, each data container in the series comprising a tamper resistant feature, currently generated forensic data being stored in a current data container of the series of data containers while preceding data containers in the series are closed to further write operations.
A system comprising:
- at least one data processor;
- and
- memory storing instructions which, when executed by the at least one data processor, result in operations comprising:
- harvesting, by an endpoint computer system, data relating to a plurality of events occurring within and characterizing a history of an operating environment of the endpoint computer system, the harvesting comprising receiving and/or inferring the data using one or more sensors executing on the endpoint computer system;
- and
- adding the data to a local data store maintained on the endpoint computer system, the local data store comprising an audit log, the audit log comprising a series of cryptographically linked encrypted data containers, each encrypted data container in the series comprising a tamper resistant feature, currently generated forensic data being encrypted and stored in a current data container of the series of encrypted data containers while preceding data containers in the series are closed to further write operations.
3 more elements
A method comprising:
- harvesting, by an endpoint computer system, data relating to a plurality of events occurring within and characterizing a history of an operating environment of the endpoint computer system, the harvesting comprising receiving and/or inferring the data using one or more sensors executing on the endpoint computer system;
- and
- adding the data to a local data store maintained on the endpoint computer system, the local data store comprising an audit log, the audit log comprising a series of data containers, each encrypted data container in the series comprising a tamper resistant feature, currently generated forensic data being encrypted and stored in a current data container of the series of encrypted data containers while preceding data containers in the series are closed to further write operations.
Dependencies are inferred from the claim text.