Network-based alert management

A computer program, residing on a computer-readable medium, comprising instructions causing a computer to:

• receive alerts from a plurality of network sensors;
• consolidate the alerts that are indicative of a common incident;
• and
• generate output reflecting the consolidated alerts.

In a computer network that has a plurality of security or fault monitoring devices of various types, each of which generates an alert when an attack or anomalous incident is detected, a method for managing alerts comprising the steps of:

• ranking network resources and services based on their actual or perceived importance to effective operation of the network;
• receiving alerts from the security or fault monitoring devices;
• ranking each alert based on a potential or actual impact of each alert's underlying attack or incident on effective operation of the network;
• grouping alerts that may relate to a common attack or incident;
• and
• generating a report that shows at least a subset of the alert groups and that indicates a potential or actual impact of each alert group's underlying attack or incident on effective operation of the network.

In a computer network that has a plurality of security or fault monitoring devices of various types, each of which generates an alert when an attack or anomalous incident is detected, a method for managing alerts comprising the steps of:

• ranking network resources and services based on their actual or perceived importance to effective operation of the network;
• receiving alerts from the security or fault monitoring devices;
• grouping alerts that may relate to a common attack or incident;
• ranking each alert group based on a potential or actual impact of each alert group's underlying attack or incident on effective operation of the network;
• and
• generating a report that shows at least a subset of the alert groups and that indicates a potential or actual impact of each alert group's underlying attack or incident on effective operation of the network.

In a computer network that has a plurality of security or fault monitoring devices of various types, each of which generates an alert when an attack or anomalous incident is detected, a method for managing alerts comprising the steps of:

• receiving alerts from the security or fault monitoring devices;
• grouping alerts that may relate to a common attack or incident;
• ranking each alert group based on a potential or actual impact of each alert group's underlying attack or incident on effective operation of the network;
• and
• generating a report that shows at least a subset of the alert groups and that indicates a potential or actual impact of each alert group's underlying attack or incident on effective operation of the network.

In a computer network, a method for ranking alerts that are indicative of an attack or an anomalous incident, the method comprising the steps of:

• identifying and ranking different types of attacks or incidents according to their actual or perceived impact on effective operation of the network;
• identifying and ranking network resources or services according to their actual or perceived importance to effective operation of the network;
• determining vulnerability of network resources to different types of attacks or incidents;
• and
• assigning a relevance score to an alert based on the type of the underlying attack or incident, the target of the attack-or incident, and the vulnerability of the target.