Geo-mapping system security events

#This disclosure relates in general to the field of data analytics and, more particularly, to graphical user interfaces in data analytics software.

#Computer security tools have been deployed throughout the world to assist in protecting computing systems, devices, and resources from various threats, vulnerabilities, and risks. The evolution of malware, viruses, worms, system vulnerabilities, hacks, and threats originating from a continually-growing and internationalized universe of sources continues to keep pace with the advances in computing. Accordingly, demand for robust and sophisticated security tools to counteract such threats has also increased. Given the increasing complexity of such tools and the increasing degree to which administrators can customize their security tools to deal with specific threats, including threats unique to particular devices, systems, and applications, managing and understanding the functionality of some security tools has become too complex for all but the most sophisticated of users. One such example of a security tool that has become notoriously complex to manage is modern network firewalls. A firewall can be a device or set of devices designed to permit or deny data transmission both in and out of a system, including transmissions over a network transmissions. A firewall's operation can be based upon a set of rules or policies and can be used, for instance, to protect networks and systems from unauthorized access by nefarious users and programs, while still permitting legitimate communications. In some instances, operating systems can also include software-based firewalls to protect a corresponding system or host from various threats, such as threats commonly found and delivered via the Internet.

#The patent or application file contains at least one drawing executed in color. Copies of this patent or patent application publication with color drawing(s) will be provided by the Office upon request and payment of the necessary fee.

#FIG. 1 is a simplified schematic diagram of an example computing system including security event management and geo-mapping functionality in accordance with at least some embodiments;

#FIG. 2 is a simplified block diagram of an example system including an example geo-mapping engine in accordance with at least some embodiments;

#Like reference numbers and designations in the various drawings indicate like elements.

#In general, one aspect of the subject matter described in this specification can be embodied in methods that include the actions of identifying a particular security event detected in a particular computing system, the particular security event detected as targeting a particular computing device included in the particular computing system. A particular grouping of assets in a plurality of asset groupings defined for devices within the particular computing system can be identified as including the particular computing device. A source of the particular security event can be identified associated with at least one second computing device and at least one of a geographic location and a grouping of assets included in the plurality of asset groupings can be associated with the source of the particular security event. Data can be generated that is adapted to cause or render a presentation of a graphical representation of the particular security event on a display device, the graphical representation including: a first graphical element representing the particular computing device as included in the particular grouping of assets and a second graphical element representing the source associated with the at least one of a geographic location and a grouping of assets included in the plurality of asset groupings.

#Further, in another general aspect, a system can be provided including at least one processor device, at least one memory element, and a geo-mapping engine. The geo-mapping engine, when executed by the processor, can identify a particular security event detected in a particular computing system (the particular security event detected as targeting a particular computing device included in the particular computing system), identify a particular grouping of assets in a plurality of asset groupings defined for devices within the particular computing system as including the particular computing device, identify a source of the particular security event, associate the source with at least one of a geographic location and a grouping of assets included in the plurality of asset groupings, and generate data adapted to cause a graphical representation of the particular security event to be presented on a display device. The graphical representation can include a first graphical element representing the particular computing device as included in the particular grouping of assets and a second graphical element representing the source associated with the at least one of a geographic location and a grouping of assets included in the plurality of asset groupings.