Zero hit analysis system
AssigneeCardinalOps Ltd.
InventorsYair Manor, Amihai Hadar, Yair Rascovsky, David Baumstein, Guy Haimovitz
Life of this patent
Estimating the term…
Abstract
In one embodiment, a device includes a processor configured to receive a given rule from a service, the given rule including multiple statements, identify a zero-hit statement being a statement of the multiple statements of the given rule causing zero hits against the log data, and perform an action responsively to identifying the zero-hit statement.
Claims25
A device, comprising:
- a processor configured to:
- receive a given rule from a detection service, the given rule including multiple statements;
- identify a zero-hit statement being a statement of the multiple statements of the given rule causing zero hits against the log data;
- and
- perform an action responsively to identifying the zero-hit statement;
- and
- a memory configured to store data used by the processor.
A method, comprising:
- receiving a given rule from a detection service, the given rule including multiple statements;
- identifying a zero-hit statement being a statement of the multiple statements of the given rule causing zero hits against the log data;
- and
- performing an action responsively to identifying the zero-hit statement.
A software product, comprising a non-transient computer-readable medium in which program instructions are stored, which instructions, when read by a central processing unit (CPU), cause the CPU to:
- receive a given rule from a detection service, the given rule including multiple statements;
- identify a zero-hit statement being a statement of the multiple statements of the given rule causing zero hits against the log data;
- and
- perform an action responsively to identifying the zero-hit statement.
Dependencies are inferred from the claim text.