US 8,782,784 B1Granted

Framework for implementing security incident and event management in an enterprise

AssigneeEMC Corporation

InventorDavid Bruskin

Life of this patent

Estimating the term…

Loading patent…

Abstract

An improved technique involves verifying whether a client has proper resources, processes, procedures and ability to successfully implement SIEM infrastructure according to a SIEM maturity evaluation metric. Along these lines, a SIEM maturity evaluation program produces a SIEM maturity result that indicates whether the client has proper resources to successfully implement SIEM infrastructure in a computing environement. For example, the SIEM maturity result indicates whether there are enough people having a certain skill set within the enterprise to properly react to events in an event log to which SIEM software receives. When the SIEM maturity result indicates that the client has proper resources, processes, procedures and ability, then the program outputs the calculate score to the SIEM evaluator and client. Otherwise, the program delays such an installation or configuration to allow the enterprise time to acquire the proper resources.

Claims18

Dependent claims

A method of providing security incident and event management (SIEM) infrastructure in a computer networking environment of a client, the SIEM infrastructure being constructed and arranged to monitor and record in an event log events within the computer networking environment, the SIEM infrastructure including i) software installed on a computer-readable medium that is configured to generate event log data and incident reports, and ii) hardware on which the software runs, the method comprising:

performing, on a computer, a SIEM maturity evaluation operation that is configured to produce a SIEM maturity result indicative of whether the client has proper resources to achieve a successful implementation of the SIEM infrastructure on the computer networking environment, the successful implementation of the SIEM infrastructure enabling the client to react to events recorded in the event log;
performing an install operation on the SIEM infrastructure in the computer networking environment when the SIEM maturity result indicates that the client has the proper resources to successfully implement the SIEM infrastructure;
and
delaying the install operation on the SIEM infrastructure in the computer networking environment when the SIEM maturity result indicates that the client does not have the proper resources to successfully implement the SIEM infrastructure;
wherein the SIEM maturity evaluation operation involves defining a SIEM framework, the SIEM framework including a set of SIEM components, each SIEM component of the set of SIEM components representing a resource necessary for successful implementation of the SIEM infrastructure and having a value that is indicative of a contribution of that SIEM component to the SIEM maturity result;
wherein performing the SIEM maturity evaluation operation includes:
for each SIEM component of the set of SIEM components of the SIEM framework, assigning the value of that SIEM component based on the resources of the client that are represented by that SIEM component.

4 more elements

A computer program product comprising a non-transitory computer readable storage medium which stores code to provide security incident and event management (SIEM) infrastructure in a computer networking environment of a client, the SIEM infrastructure being constructed and arranged to monitor and record in an event log events within the computer networking environment, the SIEM infrastructure including i) software installed on a computer-readable medium that is configured to generate event log data and incident reports, and ii) hardware on which the software runs, the code including instructions which, when performed by a computer, cause the computer to:

perform a SIEM maturity evaluation operation that is configured to produce a SIEM maturity result indicative of whether the client has proper resources to achieve a successful implementation of the SIEM infrastructure on the computer networking environment, the successful implementation of the SIEM infrastructure enabling the client to react to events recorded in the event log;
perform an install operation on the SIEM infrastructure in the computer networking environment when the SIEM maturity result indicates that the client has proper resources to successfully implement the SIEM infrastructure;
and
delay the install operation on the SIEM infrastructure in the computer networking environment when the SIEM maturity result indicates that the client does not have the proper resources to successfully implement the SIEM infrastructure;
wherein the SIEM maturity evaluation operation involves defining a SIEM framework, the SIEM framework including a set of SIEM components, each SIEM component of the set of SIEM components representing a resource necessary for successful implementation of the SIEM infrastructure and having a value that is indicative of a contribution of that SIEM component to the SIEM maturity result;
wherein performing the SIEM maturity evaluation operation includes:
for each SIEM component of the set of SIEM components of the SIEM framework, assigning the value of that SIEM component based on the resources of the client that are represented by that SIEM component.

4 more elements

Dependencies are inferred from the claim text.

Facts

Application: 13/625,982Filed 25 Sep 2012
Granted: 15 Jul 2014
Term ends: Not estimatedThe source records don’t support an estimate.

Classification4 codes

H04L 63/20
Network architectures or network communication protocols for network security: for managing network security; network security policies in general
H04L 63/1425
By monitoring network traffic: traffic logging, e.g. anomaly detection
H04L 63/1433
For detecting or protecting against malicious traffic: vulnerability analysis
H04L
Digital communication

Family

No related US applications are recorded in the indexed filing history.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key