System and method for enhanced visualization of exfiltration activities
AssigneeCode42 Software, Inc.
InventorsPeter John Lindquist, Austin Wolf, Kelly MacFarlane, Jonathan Klemm
Life of this patent
Estimating the term…
Abstract
A system is configured to perform operations including receiving an indication of a filesystem event detected by an event monitor; determining a platform domain from the indication of the filesystem event; storing content of the filesystem event in a data store with content from a plurality of filesystem events; and displaying in a graphical user interface, attributes of the plurality of filesystem events, grouped by platform domain.
Claims20
A system comprising:
- a processor subsystem;
- and
- memory including instructions that, when executed by the processor subsystem, cause the processor subsystem to perform operations comprising:
- receiving an indication of a filesystem event detected by an event monitor;
- determining a platform domain from the indication of the filesystem event;
- storing content of the filesystem event in a data store with content from a plurality of filesystem events;
- and
- displaying in a graphical user interface, attributes of the plurality of filesystem events, grouped by platform domain.
A method comprising:
- receiving an indication of a filesystem event detected by an event monitor;
- determining a platform domain from the indication of the filesystem event;
- storing content of the filesystem event in a data store with content from a plurality of filesystem events;
- and
- displaying in a graphical user interface, attributes of the plurality of filesystem events, grouped by platform domain.
A non-transitory machine-readable medium including instructions, which when executed by a machine, cause the machine to perform operations comprising:
- receiving an indication of a filesystem event detected by an event monitor;
- determining a platform domain from the indication of the filesystem event;
- storing content of the filesystem event in a data store with content from a plurality of filesystem events;
- and
- displaying in a graphical user interface, attributes of the plurality of filesystem events, grouped by platform domain.
Dependencies are inferred from the claim text.