Reducing costs for alerting engines

Abstract

A system, including a computer with a processor and memory executing an application configured to perform: receiving one or more events occurring in a computer network, querying a feature suppression list to determine if to suppress generation of specific features, generating features from the received events, which are not in the feature suppression list, examining each feature to determine if to initiate an alert and setting a severity level for the alert, analyzing the alert suppression rules to determine which features serve as a basis for alerts that are acted on and which features serve as a basis for alerts that are suppressed, generating the feature suppression list, listing features that should be suppressed.

Dependencies are inferred from the claim text.