Morgan Stanley Services Group Inc.

Alec R Kerr

Joseph Edmonds

A method of handling a failure in a pipeline between a source of alerts and a Security Incident & Event Management (SIEM) platform involves: deserializing data from at least one error state object in an error log; transferring the deserialized data to an offline environment; reconstituting at least some tasks of the pipeline, including the failed task, using contents of the error log and contents from a task log; re-running the at least some tasks of the pipeline; identifying a cause of the failed task; based upon the cause of the failed task, transferring at least one of a modified task or replacement task for use in the pipeline; instantiating a new version of the pipeline incorporating the at least one of the modified task or the replacement task; and re-executing the new version of the pipeline to process alerts and provide the processed alerts to the SIEM platform.

Method of handling a failure in a task pipeline between a source of alerts and a security incident and event management (SIEM) system

A system for improving efficiency of processing alerts by a Security Incident & Event Management (SIEM) platform involves a pipeline, and an error log associated with the pipeline, wherein the pipeline is coupled to a source of alerts and to an SIEM platform, the pipeline including a source task, at least one process task and at least one sink task, wherein the at least one sink task is configured to publish cases to the SIEM platform and wherein the error log is configured such that, when an exception occurs in a particular task in the pipeline, an object relating to the particular task and the exception will be stored in the error log.

Security incident and event management case creation system and method

A method of improving efficiency of processing alerts by a Security Incident & Event Management (SIEM) platform involves a SIEM case creation platform made up of at least one pipeline, made up of multiple tasks, and is interposed between an alerts database and the SIEM platform.

Growing community of inventors

Tuscaloosa, AL, United States of America

Alec R Kerr