# US 2019/0356676 A1 · Correlating forensic and non-forensic data in an information technology environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0356676 A1 - Document ID: US20190356676A1 - Status: Published application - Kind: A1 - Application number: 16/528,397 - Filed: 2019-07-31 - Published: 2019-11-21 - Earliest claimed: 2016-09-26 - Assignees: Splunk Inc. - Applicants: Splunk Inc. - Inventors: Brian Luger - Web page: https://patentgrep.com/patent/US20190356676A1 ## CPC - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - H04L 63/308: {retaining data, e.g. retaining successful, unsuccessful communication attempts, internet access, or e-mail, internet telephony, intercept related information or call content} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Techniques and mechanisms are disclosed enabling efficient collection of forensic data from client devices, also referred to herein as endpoint devices, of a networked computer system. Embodiments described herein further enable correlating forensic data with other types of non-forensic data from other data sources. A network security application described herein further enables generating various dashboards, visualizations, and other interfaces for managing forensic data collection, and displaying information related to collected forensic data and information related to identified correlations between items of forensic data and other items of non-forensic data. ## Claims ### Claim 1 A computer-implemented method, comprising: obtaining forensic data related to activity of an endpoint device of an information technology or security environment; obtaining non-forensic data related to activity of at least one component in the information technology or security environment that is not the endpoint device; segmenting the forensic data and the non-forensic data into a plurality of events; for each event of the plurality of events, determining a time stamp for the event, associating the time stamp with the event, and storing the event in a field-searchable data store; and correlating an event derived from the forensic data with an event derived from the non-forensic data. ### Claim 2 (depends on 1) The method of claim 1, wherein the forensic data related to activity of the endpoint device includes one or more of: file system information, registry information, service information, process information, file information, log data. ### Claim 3 (depends on 1) The method of claim 1, wherein the non-forensic data includes one or more of: firewall data, router data, email server data, user identity management system data, log data. ### Claim 4 (depends on 1) The method of claim 1, wherein the forensic data includes file information related to the endpoint device, and wherein the non-forensic data includes email server data, and wherein correlating the event derived from the forensic data with the event derived from the non-forensic data includes identifying events indicating a phishing attack against the endpoint device. ### Claim 5 (depends on 1) The method of claim 1, wherein the forensic data includes registry information related to the endpoint device, and wherein the non-forensic data includes a malware alert from a security application, and wherein the correlating the event derived from the forensic data with the event derived from the non-forensic data includes identifying events indicating a malware attack against the endpoint device. ### Claim 6 (depends on 1) The method of claim 1, wherein the forensic data includes login history information related to the endpoint device, and wherein the non-forensic data includes information from a user identity management system, and wherein the correlating the event derived from the forensic data with the event derived from the non-forensic data includes identifying events indicating a brute-force login attack against the endpoint device. ### Claim 7 (depends on 1) The method of claim 1, further comprising causing display, on a graphical user interface, of indications of the event derived from the forensic data and the event derived from the non-forensic data. ### Claim 8 (depends on 1) The method of claim 1, wherein the endpoint device is one of: a desktop computer, a workstation, a laptop computer, a tablet computer, a mobile device. ### Claim 9 (depends on 1) The method of claim 1, wherein the at least one component interacts with the endpoint device via a network. ### Claim 10 (depends on 1) The method of claim 1, wherein each event of the plurality of events includes a portion of raw machine data created by a component of the information technology or security environment and related to activity of the component in the information technology or security environment. ### Claim 11 (depends on 1) The method of claim 1, wherein correlating the event derived from the forensic data with the event derived from the non-forensic data includes executing a query identifying a relationship between the event derived from the forensic data and the event derived from the non-forensic data. ### Claim 12 (depends on 1) The method of claim 1, further comprising sending a forensic data request to the endpoint device, the forensic data request instructing the endpoint device to send the forensic data to another component in the information technology or security environment. ### Claim 13 (depends on 1) The method of claim 1, further comprising sending a forensic data request to the endpoint device, the forensic data request instructing the endpoint device to generate event data based on the forensic data and to send the event data to another component in the information technology or security environment. ### Claim 14 (depends on 1) The method of claim 1, further comprising periodically executing a query used to correlate events derived from the forensic data with events derived from the non-forensic data. ### Claim 15 (depends on 1) The method of claim 1, wherein correlating the event derived from the forensic data with the event derived from the non-forensic data includes executing a query identifying a relationship between the event derived from the forensic data and the event derived from the non-forensic data, wherein executing the query includes searching for event data in a field-searchable data store. ### Claim 16 (depends on 1) The method of claim 1, wherein correlating the event derived from the forensic data with the event derived from the non-forensic data includes executing a query identifying a relationship between the event derived from the forensic data and the event derived from the non-forensic data, wherein executing the query includes searching for event data in the field-searchable data store using a late-binding schema. ### Claim 17 A non-transitory computer-readable storage medium storing instructions which, when executed by one or more processors, cause performance of operations comprising: obtaining forensic data related to activity of an endpoint device of an information technology or security environment; obtaining non-forensic data related to activity of at least one component in the information technology or security environment that is not the endpoint device; segmenting the forensic data and the non-forensic data into a plurality of events; for each event of the plurality of events, determining a time stamp for the event, associating the time stamp with the event, and storing the event in a field-searchable data store; and correlating an event derived from the forensic data with an event derived from the non-forensic data. ### Claim 18 (depends on 17) The non-transitory computer-readable storage medium of claim 17, wherein the forensic data related to activity of the endpoint device includes one or more of: file system information, registry information, service information, process information, file information, log data. ### Claim 19 (depends on 17) The non-transitory computer-readable storage medium of claim 17, wherein the non-forensic data includes one or more of: firewall data, router data, email server data, user identity management system data, log data. ### Claim 20 (depends on 17) The non-transitory computer-readable storage medium of claim 17, wherein the forensic data includes file information related to the endpoint device, and wherein the non-forensic data includes email server data, and wherein correlating the event derived from the forensic data with the event derived from the non-forensic data includes identifying events indicating a phishing attack against the endpoint device. ### Claim 21 (depends on 17) The non-transitory computer-readable storage medium of claim 17, wherein the forensic data includes registry information related to the endpoint device, and wherein the non-forensic data includes a malware alert from a security application, wherein the correlating the event derived from the forensic data with the event derived from the non-forensic data includes identifying events indicating a malware attack against the endpoint device. ### Claim 22 (depends on 17) The non-transitory computer-readable storage medium of claim 17, wherein the forensic data includes login history information related to the endpoint device, and wherein the non-forensic data includes information from a user identity management system, and wherein the correlating the event derived from the forensic data with the event derived from the non-forensic data includes identifying events indicating a brute-force login attack against the endpoint device. ### Claim 23 (depends on 17) The non-transitory computer-readable storage medium of claim 17, wherein the instructions which, when executed by the one or more processors, further cause display, on a graphical user interface, of indications of the event derived from the forensic data and the event derived from the non-forensic data. ### Claim 24 An apparatus, comprising: one or more processors; a non-transitory computer-readable storage medium coupled to the one or more processors, the computer-readable storage medium storing instructions which, when executed by the one or more processors, causes the apparatus to: obtain forensic data related to activity of an endpoint device of an information technology or security environment; obtain non-forensic data related to activity of at least one component in the information technology or security environment that is not the endpoint device; segment the forensic data and the non-forensic data into a plurality of events; for each event of the plurality of events, determine a time stamp for the event, associating the time stamp with the event, and storing the event in a field-searchable data store; and correlate an event derived from the forensic data with an event derived from the non-forensic data. ### Claim 25 (depends on 24) The apparatus of claim 24, wherein the forensic data related to activity of the endpoint device includes one or more of: file system information, registry information, service information, process information, file information, log data. ### Claim 26 (depends on 24) The apparatus of claim 24, wherein the non-forensic data includes one or more of: firewall data, router data, email server data, user identity management system data, log data. ### Claim 27 (depends on 24) The apparatus of claim 24, wherein the forensic data includes file information related to the endpoint device, and wherein the non-forensic data includes email server data, and wherein correlating the event derived from the forensic data with the event derived from the non-forensic data includes identifying events indicating a phishing attack against the endpoint device. ### Claim 28 (depends on 24) The apparatus of claim 24, wherein the forensic data includes one or more of registry information, file system information, services information, or processes information related to the endpoint device, and wherein the correlating the event derived from the forensic data with the event derived from the non-forensic data includes identifying events indicating a malware attack against the endpoint device. ### Claim 29 (depends on 24) The apparatus of claim 24, wherein the forensic data includes login history information related to the endpoint device, and wherein the non-forensic data includes information from a user identity management system, and wherein the correlating the event derived from the forensic data with the event derived from the non-forensic data includes identifying events indicating a brute-force login attack against the endpoint device. ### Claim 30 (depends on 24) The apparatus of claim 24, wherein the instructions which, when executed by the one or more processors, further causes the apparatus to cause display, on a graphical user interface, of indications of the event derived from the forensic data and the event derived from the non-forensic data.