# US 8,752,178 B2 · Blacklisting and whitelisting of security-related events > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,752,178 B2 - Document ID: US8752178B2 - Status: Granted - Kind: B2 - Application number: 13/956,285 - Filed: 2013-07-31 - Published: 2013-11-28 - Granted: 2014-06-10 - Earliest claimed: 2013-07-31 - Assignees: Splunk Inc. - Applicants: Splunk Inc. - Inventors: John Coates; Lucas Murphey; David Hazekamp; James Hansen - Web page: https://patentgrep.com/patent/US8752178B2 ## CPC - H04L 63/1433: {Vulnerability analysis} - G06F 16/285: {Clustering or classification} - G06F 21/554: {involving event detection and direct action} - H04L 63/14: {for detecting or protecting against malicious traffic} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 2221/034: Test or assess a computer or a system - G06F 2221/2151: Time stamp - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A disclosed computer-implemented method includes receiving and indexing the raw data. Indexing includes dividing the raw data into time stamped searchable events that include information relating to computer or network security. Store the indexed data in an indexed data store and extract values from a field in the indexed data using a schema. Search the extracted field values for the security information. Determine a group of security events using the security information. Each security event includes a field value specified by a criteria. Present a graphical interface (GI) including a summary of the group of security events, other summaries of security events, and a remove element (associated with the summary). Receive input corresponding to an interaction of the remove element. Interacting with the remove element causes the summary to be removed from the GI. Update the GI to remove the summary from the GI. ## Claims ### Claim 1 A computer-implemented method, comprising: receiving, on a computing device, raw data; identifying one or more events in the raw data, wherein each of the one or more events includes information relating to computer security or network security; storing the one or more events in a searchable data store, wherein an event includes one or more fields, and wherein a field has a corresponding value; using a schema to extract values for fields in the one or more events; determining a subset group of events, wherein the subset group of events is determined using the extracted values corresponding to the one or more fields; presenting a graphical interface including a summary of the subset group of events, one or more other summaries of events, and a remove element, wherein the remove element is associated with the summary of the subset group of events; receiving input corresponding to an interaction with of the remove element, wherein interacting with the remove element causes the summary of the subset group of events to be removed from the graphical interface that displays the one or more other summaries of events; and in response to an interaction with the remove element, updating the graphical interface to remove the summary of the subset group of events from the graphical interface that displays the one or more other summaries of events. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the raw data includes unstructured data or machine data. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the raw data includes web logs. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the information relating to computer security or network security includes a http agent string, a network traffic size, a length of a uniform resource locator string, a byte count per request, a domain name, or a source address. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the one or more events include network-type events. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, further comprising: receiving an input corresponding to a selection of the summary of the subset group of events; and updating the graphical interface to display information related to at least one event in the subset group of events. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, wherein the schema is used at query time to extract the values for the fields in the one or more events. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, wherein the graphical interface includes a modify element associated with the summary of the subset group of events, and wherein interaction with the modify element causes the summary of the subset group of events to be visually modified in the graphical interface. ### Claim 9 (depends on 1) The computer-implemented method of claim 1, further comprising: generating a display that includes an add element and one or more summaries that have been removed from the graphical interface, wherein the one or more summaries include the summary of the subset group of events, and wherein interacting with the add element causes the summary of the subset group of events to be added back to the graphical interface; and in response to an interaction with the add element, updating the graphical interface to add the summary of the subset group of events back to the graphical interface. ### Claim 10 (depends on 1) The computer-implemented method of claim 1, wherein the summary of the subset group of events includes a result of a correlation search. ### Claim 11 (depends on 1) The computer-implemented method of claim 1, wherein the subset group of events is determined using an agent string that has been extracted from one or more events in the subset group of events. ### Claim 12 (depends on 1) The computer-implemented method of claim 1, wherein the subset group of events is determined using a particular length of a uniform resource locator string that has been extracted from one or more events in the subset group of events or a source address that has been extracted from one or more events in the subset group of events. ### Claim 13 (depends on 1) The computer-implemented method of claim 1, wherein the searchable data store includes a time-series data store, and wherein an event is locatable in the searchable data store using a time stamp of the event. ### Claim 14 (depends on 1) The computer-implemented method of claim 1, wherein each event of the subset group of events includes a time stamp and is locatable in the searchable data store using the time stamp. ### Claim 15 A system, comprising: one or more data processors; and a non-transitory computer-readable storage medium containing instructions which when executed on the one or more data processors, cause the one or more processors to perform operations including: receiving raw data; identifying one or more events in the raw data, wherein each of the one or more events includes information relating to computer security or network security; storing the one or more events in a searchable data store, wherein an event includes one or more fields, and wherein a field has a corresponding value; using a schema to extract values for fields in the one or more events; determining a subset group of events, wherein the subset group of events is determined using the extracted values corresponding to the one or more fields; presenting a graphical interface including a summary of the subset group of events, one or more other summaries of events, and a remove element, wherein the remove element is associated with the summary of the subset group of events; receiving input corresponding to an interaction with the remove element, wherein interacting with the remove element causes the summary of the subset group of events to be removed from the graphical interface that displays the one or more other summaries of events; and in response to an interaction with the remove element, updating the graphical interface to remove the summary of the subset group of events from the graphical interface that displays the one or more other summaries of events. ### Claim 16 (depends on 15) The system of claim 15, wherein the raw data includes unstructured data or machine data. ### Claim 17 (depends on 15) The system of claim 15, wherein the information relating to computer security or network security includes a http agent string, a network traffic size, a length of a uniform resource locator string, a byte count per request, a domain name, or a source address. ### Claim 18 (depends on 15) The system of claim 15, wherein the operations include: receiving an input corresponding to a selection of the summary of the subset group of events; and updating the graphical interface to display information related to at least one event in the subset group of events. ### Claim 19 (depends on 15) The system of claim 15, wherein the schema is used at query time to extract the values for the fields in the one or more events. ### Claim 20 (depends on 15) The system of claim 15, wherein the graphical interface includes a modify element associated with the summary of the subset group of events, and wherein interaction with the modify element causes the summary of the subset group of events to be visually modified in the graphical interface. ### Claim 21 (depends on 15) The system of claim 15, wherein the operations include: generating a display that includes an add element and one or more summaries that have been removed from the graphical interface, wherein the one or more summaries include the summary of the subset group of events, and wherein interacting with add element causes the summary of the subset group of events to be added back to the graphical interface; and in response to an interaction with the add element, updating the graphical interface to add the summary of the subset group of events back to the graphical interface. ### Claim 22 (depends on 15) The system of claim 15, wherein the searchable data store includes a time-series data store, and wherein an event is locatable in the searchable data store using a time stamp of the event. ### Claim 23 A computer-program product tangibly embodied in a non-transitory machine-readable storage medium, including instructions configured to cause one or more data processors to: receive, on a computing device, raw data; identify one or more events in index the raw data, wherein each of the one or more events includes information relating to computer security or network security; store the one or more events in a searchable data store, wherein an event includes one or more fields, and wherein a field has a corresponding value; using a schema to extract values for fields in the one or more events; determine a subset group of events, wherein the subset group of events is determined using the extracted values corresponding to the one or more fields; present a graphical interface including a summary of the subset group of events, one or more other summaries of events, and a remove element, wherein the remove element is associated with the summary of the subset group of events; receive input corresponding to an interaction with the remove element, wherein interacting with the remove element causes the summary of the subset group of events to be removed from the graphical interface that displays the one or more other summaries of events; and in response to an interaction with the remove element, update the graphical interface to remove the summary of the subset group of events from the graphical interface that displays the one or more other summaries of security events. ### Claim 24 (depends on 23) The computer-program product of claim 23, wherein the raw data includes unstructured data or machine data. ### Claim 25 (depends on 23) The computer-program product of claim 23, wherein the instructions are further configured to cause the one or more data processors to: receive an input corresponding to a selection of the summary of the subset group of events; and update the graphical interface to display information related to at least one event in the subset group of events. ### Claim 26 (depends on 23) The computer-program product of claim 23, wherein the schema is used at query time to extract the values for the fields in the one or more events. ### Claim 27 (depends on 23) The computer-program product of claim 23, wherein the graphical interface includes a modify element associated with the summary of the subset group of events, and wherein interaction with the modify element causes the summary of the subset group of events to be visually modified in the graphical interface. ### Claim 28 (depends on 23) The computer-program product of claim 23, wherein the instructions are further configured to cause the one or more data processors to: generate a display that includes an add element and one or more summaries that have been removed from the graphical interface, wherein the one or more summaries include the summary of the subset group of events, and wherein interacting with the add element causes the summary of the subset group of events to be added back to the graphical interface; and in response to an interaction with the add element, updating the graphical interface to add the summary of the subset group of events back to the graphical interface. ### Claim 29 (depends on 23) The computer-program product of claim 23, wherein the searchable data store includes a time-series data store, and wherein an event is locatable in the searchable data store using a time stamp of the event.