US 2019/0356676 A1 · CORRELATING FORENSIC AND NON-FORENSIC DATA IN AN INFORMATION TECHNOLOGY ENVIRONMENT

Abstract

Techniques and mechanisms are disclosed enabling efficient collection of forensic data from client devices, also referred to herein as endpoint devices, of a networked computer system. Embodiments described herein further enable correlating forensic data with other types of non-forensic data from other data sources. A network security application described herein further enables generating various dashboards, visualizations, and other interfaces for managing forensic data collection, and displaying information related to collected forensic data and information related to identified correlations between items of forensic data and other items of non-forensic data.

Claims30

Dependent claims

A computer-implemented method, comprising:

obtaining forensic data related to activity of an endpoint device of an information technology or security environment;
obtaining non-forensic data related to activity of at least one component in the information technology or security environment that is not the endpoint device;
segmenting the forensic data and the non-forensic data into a plurality of events;
for each event of the plurality of events, determining a time stamp for the event, associating the time stamp with the event, and storing the event in a field-searchable data store;
and
correlating an event derived from the forensic data with an event derived from the non-forensic data.

3 more elements

Dependencies are inferred from the claim text.

Facts

Application

16/528,397Filed 31 Jul 2019

Priority

26 Sep 2016

Published

21 Nov 2019

Term ends

Not estimatedThe source records don’t support an estimate.

Classification6 codes

H04L 63/145
Countermeasures against malicious traffic: the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
H04L 63/1408
For detecting or protecting against malicious traffic: by monitoring network traffic
H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection
H04L 63/1483
Countermeasures against malicious traffic: service impersonation, e.g. phishing, pharming or web spoofing

Correlating forensic and non-forensic data in an information technology environment

Life of this patent

Correlating forensic and non-forensic data in an information technology environment

Life of this patent

Abstract

Claims30