Security information and event management
AssigneeFortinet, Inc.
InventorDong Liang
Life of this patent
Estimating the term…
Abstract
Systems and methods are described for conducting work flows by an SIEM device to carry out a complex task automatically. According to one embodiment, an SIEM device may create a work flow that includes multiple security tasks that are performed by one or more security devices. When a security event is captured or the work flow is scheduled to be executed, the SIEM device starts the work flow by scheduling the security tasks defined in the work flow. The SIEM device then collects results of security tasks performed by the one or more security devices.
Claims20
A method comprising:
- starting, by a security information and event management (SIEM) device associated with a private network, a work flow instance by
- deriving said work flow instance from a work flow template, including translating information contained within the work flow template, defining a plurality of security tasks at an abstract level, into commands and parameters (i) for accomplishing the plurality of security tasks by a plurality of security devices from at least two different manufacturers and (ii) that are specific to the plurality of security devices, wherein the plurality of security devices are associated with the private network and managed by the SIEM device, wherein the plurality of security tasks include operations that are intended to protect the private network against attacks;
- and
- scheduling the plurality of security devices to perform the plurality of security tasks defined in the work flow template by sending the commands and parameters to the plurality of security devices through a device adapter layer implemented by the SIEM device;
- and
- collecting, by the STEM device, results of the plurality of security tasks after they are performed by the plurality of security devices.
A security information and event management (SIEM) system of a private network, the SIEM system comprising:
- a non-transitory storage device having embodied therein one or more routines;
- and
- one or more processors coupled to the non-transitory storage device and operable to execute the one or more routines to perform a method comprising:
- starting a work flow instance by
- deriving said work flow instance from a work flow template, including translating information contained within the work flow template, defining a plurality of security tasks at an abstract level, into commands and parameters (i) for accomplishing the plurality of security tasks by a plurality of security devices from at least two different manufacturers and (ii) that are specific to the plurality of security devices, wherein the plurality of security devices are associated with the private network and managed by the SIEM system, wherein the plurality of security tasks include operations that are intended to protect the private network against attacks;
- and
- scheduling the plurality of security devices to perform the plurality of security tasks defined in the work flow template by sending the commands and parameters to the plurality of security devices through a device adapter layer implemented by the SIEM system;
- and
- collecting, by the STEM system, results of the plurality of security tasks after they are performed by the plurality of security devices.
Dependencies are inferred from the claim text.