US 2020/0053127 A1Published application

Creating security incident records using a remote network management platform

AssigneeServiceNow, Inc.

InventorsThomas Woodley Brotherton, Vamsi Krishna Madala, Teja Chava, John Gerald Ferguson, Hnin Haymar, Betsy Cherian, Eun-Sook Watson

Life of this patent

Estimating the term…

patentgrep

Loading patent…

Abstract

An example embodiment performed by a scoped software application executable on a computing device of a computational instance of a remote network management platform may involve: requesting and receiving, from an application database associated with a third-party software application, alert rules that trigger alerts when associated events occur in a managed network; receiving data representing selection of a set of the alert rules and, based on the data, requesting and receiving, from the application database, a set of past alerts that have been triggered by the set of the alert rules; using mapping data to map fields of the set of the past alerts to fields of a sample security incident record; displaying a preview region including the sample security incident record; using the mapping data to create security incident records that map to the set of the past alerts; and writing, to a security incident database, the security incident records.

Claims20

Dependent claims

A system comprising:

a computational instance of a remote network management platform, wherein the computational instance is communicatively coupled and dedicated to a managed network and contains a security incident database, wherein the managed network contains one or more servers and an application database associated with a third-party software application executable on the one or more servers, wherein the application database stores, in fields defined in accordance with the third-party software application:
(i) alert rules that trigger alerts when associated events occur in the managed network and (ii) past alerts that have been triggered by the alert rules;
a scoped software application, executable on a computing device of the computational instance, and configured to:
request and receive, from the application database, the alert rules;
receive input data representing selection of a set of the alert rules;
based on the input data, request and receive, from the application database, a set of the past alerts that have been triggered by the set of the alert rules;
using mapping data stored within the computational instance, map fields of the set of the past alerts to fields of a sample security incident record without writing the sample security incident record to the security incident database, wherein the mapping data defines pairwise associations between the fields of the set of the past alerts and fields of the security incident records;
generate and provide for display a representation of a graphical user interface, the representation comprising a preview region including the sample security incident record;
using the mapping data, create security incident records that map to the set of the past alerts;
and
write, to the security incident database, the security incident records.

8 more elements

A method comprising:

requesting and receiving, by a scoped software application, from an application database associated with a third-party software application, alert rules that trigger alerts when associated events occur in a managed network, wherein the scoped software application is executable on a computing device of a computational instance of a remote network management platform, wherein the computational instance is communicatively coupled and dedicated to the managed network and contains a security incident database, wherein the managed network contains one or more servers and the application database, wherein the third-party software application is executable on the one or more servers, and wherein the application database stores, in fields defined in accordance with the third-party software application:
(i) the alert rules and (ii) past alerts that have been triggered by the alert rules;
receiving, by the scoped software application, input data representing selection of a set of the alert rules;
based on the input data, requesting and receiving, by the scoped software application, from the application database, a set of the past alerts that have been triggered by the set of the alert rules;
using mapping data stored within the computational instance, mapping, by the scoped software application, fields of the set of the past alerts to fields of a sample security incident record without writing the sample security incident record to the security incident database, wherein the mapping data defines pairwise associations between the fields of the set of the past alerts and fields of the security incident records;
generating and providing for display, by the scoped software application, a representation of a graphical user interface, the representation comprising a preview region including the sample security incident record;
using the mapping data, creating, by the scoped software application, security incident records that map to the set of the past alerts;
and
writing, by the scoped software application, to the security incident database, the security incident records.

6 more elements

An article of manufacture including a non-transitory computer-readable medium, having stored thereon program instructions that, upon execution by a computing device of a computational instance of a remote network management platform, cause the computing device to perform operations comprising:

requesting and receiving, from an application database associated with a third-party software application, alert rules that trigger alerts when associated events occur in a managed network, wherein the computational instance is communicatively coupled and dedicated to the managed network and contains a security incident database, wherein the managed network contains one or more servers and the application database, wherein the third-party software application is executable on the one or more servers, and wherein the application database stores, in fields defined in accordance with the third-party software application:
(i) the alert rules and (ii) past alerts that have been triggered by the alert rules;
receiving input data representing selection of a set of the alert rules;
based on the input data, requesting and receiving, from the application database, a set of past alerts that have been triggered by the set of the alert rules;
using mapping data stored within the computational instance, mapping fields of the set of the past alerts to fields of a sample security incident record without writing the sample security incident record to the security incident database, wherein the mapping data defines pairwise associations between the fields of the set of the past alerts and fields of the security incident records;
generating and providing for display a representation of a graphical user interface, the representation comprising a preview region including the sample security incident record;
using the mapping data, creating security incident records that map to the set of the past alerts;
and
writing, to the security incident database, the security incident records.

6 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/100,464Filed 10 Aug 2018
Published: 13 Feb 2020
Term ends: Not estimatedThe source records don’t support an estimate.

Classification8 codes

H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection
H04L 63/20
Network architectures or network communication protocols for network security: for managing network security; network security policies in general
H04L 63/02
Network architectures or network communication protocols for network security: for separating internal from external traffic, e.g. firewalls
H04L 67/10
Protocols: in which an application is distributed across nodes in the network