# US 2021/0344649 A1 · System and method for creating buffered firewall logs for reporting > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0344649 A1 - Document ID: US20210344649A1 - Status: Published application - Kind: A1 - Application number: 16/862,655 - Filed: 2020-04-30 - Published: 2021-11-04 - Earliest claimed: 2020-04-30 - Assignees: Forcepoint LLC - Applicants: Forcepoint LLC - Inventors: Michael Oliver O'Mahony; Nicole Carin Petersen; Mandar Harish Harkare; Damien Christopher Monaghan - Web page: https://patentgrep.com/patent/US20210344649A1 ## CPC - H04L 63/0263: {Rule management} - G06F 9/451: Execution arrangements for user interfaces - G06F 9/4881: {Scheduling strategies for dispatcher, e.g. round robin, multi-level priority queues} - G06F 11/302: {where the computing system component is a software system} - G06F 11/3086: {where the reporting involves the use of self describing data formats, i.e. metadata, markup languages, human readable formats} - G06F 11/323: {Visualisation of programs or trace data} - G06F 11/3476: {Data logging (G06F11/14, G06F11/2205 take precedence)} - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 8/38: for implementing user interfaces - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system for firewall data log processing, comprising a firewall logging system operating on a first processor and configured to cause the first processor to receive firewall log data and to process the firewall log data on a periodic basis to reduce the size of the firewall log data and a firewall reporting system operating on a second processor and configured to process the reduced size firewall log data to generate a report on a user interface that includes one or more analytics from the reduced size firewall data. ## Claims ### Claim 1 A system for firewall data log processing, comprising: a firewall logging system operating on a first processor and configured to cause the first processor to receive firewall log data and to process the firewall log data on a periodic basis to reduce the size of the firewall log data; and a firewall reporting system operating on a second processor and configured to process the reduced size firewall log data to generate a report on a user interface that includes one or more analytics from the reduced size firewall data. ### Claim 2 (depends on 1) The system of claim 1 further comprising an extract, transform and load service operating on a third processor and configured to extract two or more subsets of data from the firewall log data, to transform the extracted firewall log data into a metadata schema and to load the metadata schema into a data processing system configured to analyze the firewall log data using the metadata schema. ### Claim 3 (depends on 2) The system of claim 2 wherein the extract, transform and load service further comprises a metadata repository configured to receive the metadata schema and to store the metadata schema. ### Claim 4 (depends on 2) The system of claim 2 wherein the extract, transform and load service further comprises a scheduler configured to periodically process an update using the metadata schema. ### Claim 5 (depends on 1) The system of claim 1 wherein the firewall reporting system comprising a window reporting system operating on the second processor and configured to generate a window user interface display for selecting a predetermined period of time. ### Claim 6 (depends on 1) The system of claim 1 wherein the firewall reporting system comprising a window reporting system operating on the second processor and configured to generate a window user interface display for relocating a display for a predetermined period of time. ### Claim 7 (depends on 1) The system of claim 1 wherein the firewall reporting system comprising a window reporting system operating on the second processor and configured to generate a window user interface display for relocating a display of firewall statistics for a predetermined period of time. ### Claim 8 (depends on 1) The system of claim 1 wherein the firewall reporting system comprising a window reporting system operating on the second processor and configured to generate a window user interface display for relocating a display of firewall statistics for a predetermined user for a predetermined period of time. ### Claim 9 A method for firewall data log processing, comprising: receiving firewall log data using one or more first algorithms at a first processor that is configured to load and execute the one or more algorithms; processing the firewall log data on a periodic basis to reduce the size of the firewall log data using the one or more first algorithms and the first processor; and processing the reduced size firewall log data using one or more second algorithms at a second processor to generate a report on a user interface that includes one or more analytics from the reduced size firewall data. ### Claim 10 (depends on 9) The method of claim 9 further comprising extracting two or more subsets of data from the firewall log data using one or more third algorithms operating on a third processor, to transform the extracted firewall log data into a metadata schema and to load the metadata schema into a data processing system that is configured to analyze the firewall log data using the metadata schema. ### Claim 11 (depends on 10) The method of claim 10 further comprising receiving the metadata schema and storing the metadata schema. ### Claim 12 (depends on 10) The Method of claim 10 further comprising periodically process an update using the metadata schema. ### Claim 13 (depends on 9) The method of claim 9 further comprising generating a window user interface display for selecting a predetermined period of time for a report. ### Claim 14 (depends on 9) The method of claim 9 further comprising generating a window user interface display for relocating a display for reporting data for a predetermined period of time. ### Claim 15 (depends on 9) The method of claim 9 further comprising generating a window user interface display for relocating a display for reporting firewall statistics for a predetermined period of time. ### Claim 16 The method of claim further comprising generating a window user interface display for relocating a display of firewall statistics for a predetermined user for a predetermined period of time.