# US 2025/0097244 A1 · Devices, systems, and methods for streamlining and standardizing the ingest of security data across multiple tenants > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2025/0097244 A1 - Document ID: US20250097244A1 - Status: Published application - Kind: A1 - Application number: 18/725,988 - Filed: 2022-12-21 - Published: 2025-03-20 - Earliest claimed: 2021-12-30 - Assignees: BlueVoyant LLC - Applicants: BlueVoyant LLC - Inventors: Chris White; Jake Vance; Allen Duet; Ed Schernau; Neel Arora; Chris Surel - Web page: https://patentgrep.com/patent/US20250097244A1 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 65/102: Gateways (arrangements for connecting between networks having differing types of switching systems, e.g. gateways, H04L12/66) - H04L 63/0263: {Rule management} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for streamlining and standardizing the ingest of security data across a plurality of tenant networks is disclosed. Each of the plurality of tenant networks comprises at least one log source, the method comprising receiving, by each of a plurality of data gateway modules, raw log data from the log source associated therewith; generating, by each of the plurality of data gateway modules, formatted log data based on the raw log data; ingesting, by an edge module, formatted log data from the plurality of data gateway modules; automatically updating, by a central control plane module, a configuration of at least one of the plurality of data gateway modules based on a change to the log source(s) associated therewith; and implementing, by a security monitoring system, a security action related to at least one of the plurality of tenant networks based on the ingested formatted data. ## Claims ### Claim 1 A method for streamlining and standardizing the ingest of data in a security monitoring system across a plurality of tenant networks, the security monitoring system comprising an edge module, a central control plane module, and a plurality of data gateway modules, each of the plurality of data gateway modules associated with a different log source, each of the plurality of tenant networks comprising at least one log source, the method comprising: receiving, by each of the plurality of data gateway modules of the security monitoring system, raw log data from the log source associated therewith; generating, by each of the plurality of data gateway modules of the security monitoring system, formatted log data based on the raw log data; ingesting, by the edge module of the security monitoring system, formatted log data from the plurality of data gateway modules; automatically updating, by the central control plane module of the security monitoring system, a configuration of at least one of the plurality of data gateway modules based on a change to the log source(s) associated therewith; and implementing, by the security monitoring system, a security action related to at least one of the plurality of tenant networks based on the ingested formatted data. ### Claim 2 (depends on 1) The method of claim 1, further comprising: filtering, by each of the plurality of data gateway modules of the security monitoring system, the raw log data to include only relevant security fields to generate the formatted log data; and normalizing, by each of the plurality of data gateway modules of the security monitoring system, the raw log data based on a standard schema to generate the formatted log data. ### Claim 3 (depends on 2) The method of claim 2, further comprising: updating, by the central control plane module of the security monitoring system, the filtering of the raw log data performed by the plurality of gateway modules based on an update to the relevant security fields. ### Claim 4 (depends on 1) The method of claim 1, further comprising: routing, by each of the plurality of data gateway modules of the security monitoring system, the raw log data to a tenant storage archive; and routing, by each of the plurality of data gateway modules of the security monitoring system, the formatted log data to a SIEM detection engine. ### Claim 5 (depends on 4) The method of claim 4, further comprising: hosting the edge module by a SIEM provider server; hosting the SIEM detection engine by the SIEM provider server; and hosting the tenant storage archive by a tenant server. ### Claim 6 (depends on 4) The method of claim 4, further comprising: hosting the edge module by a SIEM provider server; hosting the SIEM detection engine by the SIEM provider server, and hosting the tenant storage archive by the SIEM provider server. ### Claim 7 (depends on 4) The method of claim 4, further comprising: hosting the SIEM detection engine by a third party server; hosting the edge module by the third party server; hosting the tenant storage archive by the tenant server. ### Claim 8 (depends on 4) The method of claim 4, further comprising: hosting the SIEM detection engine by a third-party server; and hosting the tenant storage system by the third-party server. ### Claim 9 (depends on 1) The method of claim 1, further comprising: simultaneously updating, by the central control plane module of the security monitoring system, a configuration of the plurality of gateway modules based on a common change to the log sources associated therewith; and updating, by the central control plane module of the security monitoring system, a configuration of at least one of the plurality of gateway modules based on an exception related to the log source(s) associated therewith. ### Claim 10 (depends on 1) The method of claim 1, further comprising: generating, by the central control plane module of the security monitoring system, a new gateway module to be associated with a new log source. ### Claim 11 (depends on 1) The method of claim 1, wherein at least one of the plurality of tenant networks of the security monitoring system comprises a cloud-based log source and an on-premises log source, the method further comprising: generating the raw log data by the cloud-based log source; and generating the raw log data by the on-premises log source. ### Claim 12 (depends on 1) The method of claim 1, further comprising: hosting the edge module by a SIEM provider server; and hosting the central control plane module by the SIEM provider server. ### Claim 13 (depends on 1) The method of claim 1, further comprising: identifying, by the central control plane module, a log source that is no longer generating raw log data. ### Claim 14 (depends on 1) The method of claim 1, wherein implementing the security action comprises generating a security alert to be transmitted to an administrator of the at least one tenant network. ### Claim 15 (depends on 1) The method of claim 1, wherein implementing the security action comprises removing access to the at least one tenant network from one or more devices configured to access the at least one tenant network. ### Claim 16 A security monitoring system capable of streamlining and standardizing the ingest of data across a plurality of tenant networks, each of the plurality of tenant networks comprising at least one log source, the security monitoring system comprising: a plurality of data gateway modules, each of the plurality of data gateway modules associated with a different log source, each of the plurality of data gateway modules configured to: receive raw log data from the log source associated therewith; and generate formatted log data based on the raw log data; an edge module configured to: ingest the formatted log data from the plurality of data gateway modules; and a central control plane module configured to: automatically update the configuration of at least one of the plurality of gateway modules in response to a change to the log source(s) associated therewith; wherein the security monitoring system is configured to implement a security action related to at least one of the plurality of tenant networks based on the ingested formatted data. ### Claim 17 (depends on 16) The system of claim 16, wherein each of the plurality of data gateway modules is configured to: filter the raw log data to include only relevant security fields to generate the formatted log data; and normalize the raw data based on a standard schema to generate the formatted log data. ### Claim 18 (depends on 17) The system of claim 17, wherein the central control plane module is configured update the configuration of the plurality of gateway modules to update the filtration of the raw log data based on an update to the relevant security fields. ### Claim 19 (depends on 16) The system of claim 16, wherein at least one of the plurality of data gateway modules is configured to: route the raw log data to a tenant storage archive; and route the formatted log data to a SIEM detection engine. ### Claim 20 (depends on 19) The system of claim 19, wherein the edge module is hosted by a SIEM provider server, wherein the SIEM detection engine is hosted by the SIEM provider server, and wherein the tenant storage archive is hosted by a tenant server. ### Claim 21 (depends on 19) The system of claim 19, wherein the edge module is hosted by a SIEM provider server, wherein the SIEM detection engine is hosted by the SIEM provider server, and wherein the tenant storage archive is hosted by the SIEM provider server. ### Claim 22 (depends on 19) The system of claim 19, wherein the SIEM detection engine is hosted by a third-party server, wherein the edge module is hosted by the third-party server, and wherein the tenant storage archive is hosted by a tenant server. ### Claim 23 (depends on 19) The system of claim 19, wherein the SIEM detection engine is hosted by a third-party server, and wherein the tenant storage archive is hosted by the third-party server. ### Claim 24 (depends on 16) The system of claim 16, wherein the central control plane module is configured to: simultaneously update the configuration of the plurality of gateway modules based on a common change to the log sources associated therewith; and update the configuration of at least one of the plurality of gateway modules based on an exception related to the log source(s) associated therewith. ### Claim 25 (depends on 16) The system of claim 16, wherein the central control plane module is configured to generate a new gateway module to be associated with a new log source. ### Claim 26 (depends on 16) The system of claim 16, wherein at least one of the plurality of tenant networks comprises a cloud-based log source and an on-premises log source. ### Claim 27 (depends on 16) The system of claim 16, wherein the edge module is hosted by a SIEM provider server, and wherein the central control plane module is hosted by the SIEM provider server. ### Claim 28 (depends on 16) The system of claim 16, wherein the central control plane module is configured to identify a log source that is no longer generating raw log data. ### Claim 29 (depends on 16) The system of claim 16, wherein the security action comprises generating a security alert to be transmitted to an administrator of the at least one tenant network. ### Claim 30 (depends on 16) The system of claim 16, wherein the security action comprises removing access to the at least one tenant network from one or more devices configured to access the at least one tenant network. ### Claim 31 A system for streamlining and standardizing the ingest of security data, the system comprising: a plurality of tenant networks, each of the plurality of tenant networks comprising at least one log source; and a security monitoring subsystem comprising: a plurality of data gateway modules, each of the plurality of data gateway modules associated with a different log source, each of the plurality of data gateway modules configured to: receive raw log data from the log source associated therewith; and generate formatted log data based on the raw log data; an edge module configured to: ingest the formatted log data from the plurality of data gateway modules; and a central control plane module configured to: automatically update the configuration of at least one of the plurality of gateway modules in response to a change to the log source(s) associated therewith; wherein the security monitoring subsystem is configured to implement a security action related to at least one of the plurality of tenant networks based on the ingested formatted data.