Managing alert profiles
AssigneeQuest Software, Inc.
InventorJake Seigel
Life of this patent
Estimating the term…
Abstract
Systems and techniques for managing alert profiles, including creating the alert profiles and deactivating the alert profiles, are described. Auditing software executing on a central server may receive an event log from a software agent. The event log may identify activities associated with a network element in a computer system. The auditing software may include a classifier trained using machine learning. The auditing software may determine that the event log is indicative of an interesting activity, such as malicious activity. The auditing software may create an alert profile. The auditing software may assign a severity to the alert profile. The auditing software may determine whether the alert profile is relevant. The auditing software may deactivate the alert profile based on determining that the alert profile is not relevant.
Claims20
A computer-implemented method, comprising:
- receiving, from a software agent, an event log identifying one or more activities associated with a network element;
- determining, by a classifier trained using machine learning, that the event log is indicative of an interesting activity;
- creating, by the classifier, an alert profile based at least partly on the event log;
- determining, by the classifier, a severity of the alert profile based at least partly on the event log;
- determining, by the classifier, a time interval associated with the alert profile;
- determining a time period by multiplying the time interval by the severity of the alert profile;
- associating, by the classifier, the time period with the alert profile;
- and
- deactivating, by the classifier, the alert profile after the time period has expired.
One or more non-transitory computer-readable media storing instructions that include a classifier algorithm, the instructions executable by one or more processors to perform operations comprising:
- receiving, from a software agent, an event log associated with a network element;
- determining that the event log is indicative of an interesting activity;
- creating an alert profile based at least partly on the event log;
- determining a severity of the alert profile based at least partly on the event log;
- determining a time interval associated with the alert profile;
- determining a time period by multiplying the time interval by the severity of the alert profile;
- associating the time period with the alert profile;
- and
- deactivating the alert profile based on determining that the time period has expired.
A server, comprising:
- one or more processors;
- and
- one or more non-transitory computer-readable media storing instructions comprising a classifier trained using machine learning, the instructions executable by the one or more processors to perform operations comprising:
- receiving, from a software agent, a first event log identifying one or more events associated with a network element;
- determining, by a classifier trained using machine learning, that the first event log is indicative of an interesting activity;
- creating, by the classifier, an alert profile based at least partly on the first event log;
- activating the alert profile;
- receiving at least a second event log;
- determining, by the classifier, that one or more conditions associated with the alert profile are satisfied based on the first event log and the second event log;
- determining, by the classifier, a severity of the alert profile based at least partly on the first event log and the second event log;
- determining, by the classifier, a time interval associated with the alert profile;
- determining, by the classifier, a time period by multiplying the time interval by the severity of the alert profile;
- associating, by the classifier, the time period with the alert profile;
- performing one or more actions associated with the alert profile based on determining that the one or more conditions associated with the alert profile are satisfied;
- and
- deactivating, by the classifier, the alert profile based on determining that the time period has expired.
Dependencies are inferred from the claim text.