# US 8,782,784 B1 · Framework for implementing security incident and event management in an enterprise

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,782,784 B1
- Document ID: US8782784B1
- Status: Granted
- Kind: B1
- Application number: 13/625,982
- Filed: 2012-09-25
- Granted: 2014-07-15
- Earliest claimed: 2012-09-25
- Assignees: EMC Corporation
- Applicants: EMC Corporation
- Inventors: David Bruskin
- Web page: https://patentgrep.com/patent/US8782784B1

## CPC

- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1433: {Vulnerability analysis}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

An improved technique involves verifying whether a client has proper resources, processes, procedures and ability to successfully implement SIEM infrastructure according to a SIEM maturity evaluation metric. Along these lines, a SIEM maturity evaluation program produces a SIEM maturity result that indicates whether the client has proper resources to successfully implement SIEM infrastructure in a computing environement. For example, the SIEM maturity result indicates whether there are enough people having a certain skill set within the enterprise to properly react to events in an event log to which SIEM software receives. When the SIEM maturity result indicates that the client has proper resources, processes, procedures and ability, then the program outputs the calculate score to the SIEM evaluator and client. Otherwise, the program delays such an installation or configuration to allow the enterprise time to acquire the proper resources.

## Claims

### Claim 1

A method of providing security incident and event management (SIEM) infrastructure in a computer networking environment of a client, the SIEM infrastructure being constructed and arranged to monitor and record in an event log events within the computer networking environment, the SIEM infrastructure including i) software installed on a computer-readable medium that is configured to generate event log data and incident reports, and ii) hardware on which the software runs, the method comprising:
performing, on a computer, a SIEM maturity evaluation operation that is configured to produce a SIEM maturity result indicative of whether the client has proper resources to achieve a successful implementation of the SIEM infrastructure on the computer networking environment, the successful implementation of the SIEM infrastructure enabling the client to react to events recorded in the event log;
performing an install operation on the SIEM infrastructure in the computer networking environment when the SIEM maturity result indicates that the client has the proper resources to successfully implement the SIEM infrastructure; and
delaying the install operation on the SIEM infrastructure in the computer networking environment when the SIEM maturity result indicates that the client does not have the proper resources to successfully implement the SIEM infrastructure;
wherein the SIEM maturity evaluation operation involves defining a SIEM framework, the SIEM framework including a set of SIEM components, each SIEM component of the set of SIEM components representing a resource necessary for successful implementation of the SIEM infrastructure and having a value that is indicative of a contribution of that SIEM component to the SIEM maturity result;
wherein performing the SIEM maturity evaluation operation includes:
for each SIEM component of the set of SIEM components of the SIEM framework, assigning the value of that SIEM component based on the resources of the client that are represented by that SIEM component.

### Claim 2 (depends on 1)

The method as in claim 1,
wherein assigning the value of that SIEM component includes:
generating the value of that SIEM component within a spreadsheet on the computer, the spreadsheet being configured to organize information related to the set of SIEM components such that input for each SIEM component of the set of SIEM components is located in a separate sheet of the spreadsheet.

### Claim 3 (depends on 1)

The method as in claim 1,
wherein performing the SIEM maturity evaluation operation further includes:
combining the values of the SIEM components of the set of SIEM components to produce a value of a SIEM maturity score, the SIEM maturity result being based on the value of the SIEM maturity score.

### Claim 4 (depends on 3)

The method as in claim 3,
wherein combining the values of the SIEM components of the set of SIEM components includes:
generating, as the value of the SIEM maturity score, an average of the values of the SIEM components of the set of SIEM components.

### Claim 5 (depends on 1)

The method as in claim 1,
wherein a SIEM component of the set of SIEM components is a Business Alignment component, the Business Alignment component representing an identification of a mission of the SIEM maturity evaluation operation and stakeholders of the client in the mission;
wherein the value of that Business Alignment component is indicative of the degree to which the client is able to define the mission and the stakeholders;
wherein assigning the value of the SIEM component for the Business Alignment component based on the resources of the client that are represented by that SIEM component includes:
assessing the degree to which the client is able to define the mission and the stakeholders to produce a Business Alignment assessment, and
generating the value based on the Business Alignment assessment.

### Claim 6 (depends on 5)

The method as in claim 5,
wherein another SIEM component of the set of SIEM components is an Asset Management component, the Asset Management component representing an identification of event sources, locations, and logical groupings;
wherein the value of the Asset Management component is indicative of the degree to which the client is able to identify the event sources, locations, and logical groupings;
wherein assigning the value of that SIEM component for the Asset Management component based on the resources of the client that are represented by that SIEM component includes:
assessing the degree to which the client is able to define the mission and the stakeholders to produce a Asset Management assessment, and
generating the value based on the Asset Management assessment.

### Claim 7 (depends on 6)

The method as in claim 6,
wherein another SIEM component of the set of SIEM components is an Infrastructure Management component, the Infrastructure Management component including business contingency planning, infrastructure monitoring and maintenance;
wherein the value of the Infrastructure Management component is indicative of the degree to which the client is able to identify business contingency planning and infrastructure monitoring and maintenance;
wherein assigning the value of that SIEM component for the Infrastructure Management component based on the resources of the client that are represented by that SIEM component includes:
assessing the degree to which the client is able to define the mission and the stakeholders to produce a Infrastructure Management assessment, and
generating the value based on the Infrastructure Management assessment.

### Claim 8 (depends on 1)

The method as in claim 1,
wherein the value of each SIEM component of the set of SIEM components is composed of values of a set of attributes including Vision and Strategy, People, Infrastructure, Management, and Execution;
wherein assigning the value of that SIEM component based on the resources of the client that are represented by that SIEM component includes:
adding the values of each attribute of the set of attributes to produce the value of the SIEM component.

### Claim 9 (depends on 8)

The method as in claim 8,
wherein each SIEM component of the set of SIEM components includes a set of subcomponents, each subcomponent of the set of subcomponents of the SIEM component having values of the set of attributes;
wherein adding the values of each attribute of the set of attributes includes:
for each subcomponent of the set of subcomponents, adding the values of each attribute of the set of attributes to produce a subvalue of the subcomponent, and
adding the subvalues of each subcomponent of the set of subcomponents to produce the value of the SIEM component.

### Claim 10 (depends on 9)

The method as in claim 9,
wherein, for each subcomponent of the set of subcomponents, the value of each attribute of the set of attributes the subcomponent is based on a maturity model having a set of levels, a value of each level of the set of five levels being a number between 1 and 5 inclusive and corresponding to a maturity level of the client with respect to that SIEM component;
wherein generating the value of the SIEM component within a spreadsheet on the computer includes:
for each subcomponent of the set of subcomponents, for each attribute of the set of attributes of the subcomponent, assigning a value of a level of the set of levels of the maturity model to that attribute.

### Claim 11

A computer program product comprising a non-transitory computer readable storage medium which stores code to provide security incident and event management (SIEM) infrastructure in a computer networking environment of a client, the SIEM infrastructure being constructed and arranged to monitor and record in an event log events within the computer networking environment, the SIEM infrastructure including i) software installed on a computer-readable medium that is configured to generate event log data and incident reports, and ii) hardware on which the software runs, the code including instructions which, when performed by a computer, cause the computer to:
perform a SIEM maturity evaluation operation that is configured to produce a SIEM maturity result indicative of whether the client has proper resources to achieve a successful implementation of the SIEM infrastructure on the computer networking environment, the successful implementation of the SIEM infrastructure enabling the client to react to events recorded in the event log;
perform an install operation on the SIEM infrastructure in the computer networking environment when the SIEM maturity result indicates that the client has proper resources to successfully implement the SIEM infrastructure; and
delay the install operation on the SIEM infrastructure in the computer networking environment when the SIEM maturity result indicates that the client does not have the proper resources to successfully implement the SIEM infrastructure;
wherein the SIEM maturity evaluation operation involves defining a SIEM framework, the SIEM framework including a set of SIEM components, each SIEM component of the set of SIEM components representing a resource necessary for successful implementation of the SIEM infrastructure and having a value that is indicative of a contribution of that SIEM component to the SIEM maturity result;
wherein performing the SIEM maturity evaluation operation includes:
for each SIEM component of the set of SIEM components of the SIEM framework, assigning the value of that SIEM component based on the resources of the client that are represented by that SIEM component.

### Claim 12 (depends on 11)

The computer program product as in claim 11,
wherein assigning the value of that SIEM component includes:
generating the value of that SIEM component within a spreadsheet, the spreadsheet being configured to organize information related to the set of SIEM components such that input for each SIEM component of the set of SIEM components is located in a separate sheet of the spreadsheet.

### Claim 13 (depends on 11)

The computer program product as in claim 11,
wherein performing the SIEM maturity evaluation operation further includes:
combining the values of the SIEM components of the set of SIEM components to produce a value of a SIEM maturity score, the SIEM maturity result being based on the value of the SIEM maturity score.

### Claim 14 (depends on 13)

The computer program product as in claim 13,
wherein combining the values of the SIEM components of the set of SIEM components includes:
generating, as the value of the SIEM maturity score, an average of the values of the SIEM components of the set of SIEM components.

### Claim 15 (depends on 11)

The computer program product as in claim 11,
wherein a SIEM component of the set of SIEM components is a Business Alignment component, the Business Alignment component representing an identification of a mission of the SIEM maturity evaluation operation and stakeholders of the client in the mission;
wherein the value of the Business Alignment component is indicative of the degree to which the client is able to define the mission and the stakeholders;
wherein assigning the value of that SIEM component for the Business Alignment component based on the resources of the client that are represented by that SIEM component includes:
assessing the degree to which the client is able to define the mission and the stakeholders to produce a Business Alignment assessment, and
generating the value based on the Business Alignment assessment.

### Claim 16 (depends on 11)

The computer program product as in claim 11,
wherein the value of each SIEM component of the set of SIEM components is composed of values of a set of attributes representing Vision and Strategy, People, Infrastructure, Management, and Execution;
wherein assigning the value of the SIEM component based on the resources of the client that are represented by that SIEM component includes:
adding the values of each attribute of the set of attributes to produce the value of the SIEM component.

### Claim 17 (depends on 16)

The computer program product as in claim 16,
wherein each SIEM component of the set of SIEM components includes a set of subcomponents, each subcomponent of the set of subcomponents of the SIEM component having values of the set of attributes;
wherein adding the values of each attribute of the set of attributes includes:
for each subcomponent of the set of subcomponents, adding the values of each attribute of the set of attributes to produce a subvalue of the subcomponent, and
adding the subvalues of each subcomponent of the set of subcomponents to produce the value of the SIEM component.

### Claim 18 (depends on 17)

The computer program product as in claim 17,
wherein, for each subcomponent of the set of subcomponents, the value of each attribute of the set of attributes the subcomponent is based on a maturity model having a set of levels, a value of each level of the set of five levels being a number between 1 and 5 inclusive and corresponding to a maturity level of the client with respect to that SIEM component;
wherein generating the value of the SIEM component within a spreadsheet on the computer includes:
for each subcomponent of the set of subcomponents, for each attribute of the set of attributes of the subcomponent, assigning a value of a level of the set of levels of the maturity model to that attribute.