Cisco Technology, Inc.

Oracle International Corporation

Other

Aji Joseph

Ashish Kolli

Yitzchak Weiser

Weifang Xie

Jingyu Cui

Moushmi Banerjee

Kanishk Mahajan

Lakshmi Hariharan

Paresh Raote

Partha P Bhattacharya

Imin T Lee

Eli Stevens

Diwakar Naramreddy

Navindra Yadav

Atul Mahamuni

Thomas Jeffrey Enderwick

Shashi Kumar

Bora A Akyol

Azim Ozakil

Peirong Feng

Sambasivam Valliappan

The present disclosure relates generally to threat detection, and more particularly, to techniques for analyzing security events using dynamic policies and displaying a consolidated view of active threats and user activity including the dynamic policies being triggered by the active threats and user activity. Some aspects are directed to the concept of a policy bus for injecting and communicating the dynamic policies to multiple enforcement entities and the ability of the entities to respond to the policies dynamically. Other aspects are directed providing a consolidated view of active threat categories, a count of policies being triggered for each threat category, and associated trends. Yet other aspects are directed to providing a consolidated view of users, applications being accessed by users, and the access policies, if any, implicated by the such accesses.

Dynamic policy injection and access visualization for threat detection

In one embodiment, a method includes receiving a communication from an endpoint device at a network access device located within a data path between the endpoint device and a network, identifying a network admission control policy for the endpoint device, enforcing at the network access device, the network admission control policy for traffic received from the endpoint device, and forwarding at the network access device, traffic from the endpoint device to the network in accordance with the network admission control policy. An apparatus is also disclosed.

Integration of network admission control functions in network access devices

A network security monitor system groups a plurality of security events into network sessions, correlates the network sessions according to a set of predefined network security event correlation rules and generates a security incident for the network sessions that satisfy one of the network security event correlation rules. The system then presents the information of the network sessions and security incidents to a user of the system in an intuitive form. The user is able to not only learn the details of a possible network attack, but also creates new security event correlation rules intuitively, including drop rules for dropping a particular type of events.

Method and system for displaying network security incidents

Growing community of inventors

San Jose, CA, United States of America

Aji Joseph