Splunk Inc.

Alexander Lynn Raitz

Cary Glen Noel

David Hazekamp

Roy Arsan

Clark Allan

Vijay Chauhan

Luke K Murphey

Wenhui Yu

John Robert Coates

Lucas Keith Murphey

Munawar Monzy Merza

James Hansen

Michael Kinsley

Ian Matthew Link

Ashwin Mohan Iyer

Pohsin Wang

Fang I Hsiao

Melanie Ann Garcia Alrajhi

Shruti Shrivastava

Embodiments of the present invention are directed to managing process analytics across process components. In some embodiments, an indication of a state of a process instance associated with a process is determined by querying a process engine. In accordance with the indication of the state of the process instance, an augmented process model is used to search machine data for data corresponding with at least one component of the process. The data corresponding with the at least one component of the process is associated with a process instance identifier that uniquely identifies the process instance. Thereafter, the data along with the process instance identifier is provided to the process engine to update the state of the process instance.

Using an augmented process model to track process instances

A system and method that allows a user to view objects in a three-dimensional environment, where one or more of the objects have a data display (e.g., a data billboard, etc.) that shows data about the object. To enhance user experience and to provide relevant contextual data as the user navigates through the three-dimensional environment, the system calculates a location for the user and a location for each object and determines if a relationship between the user frame of reference and each object location satisfies a first criterion. If the first criterion is satisfied, the system is configured to move the data display to the bottom of a viewing area of the three-dimensional environment (e.g. docking the data display to the bottom of the viewing area, etc.). The system may also arrange the data displays in the same order as the objects are perceived by the user in the three-dimensional environment.

Dockable billboards for labeling objects in a display having a three dimensional perspective of a virtual or real environment

Techniques and mechanisms are disclosed that enable network security analysts and other users to efficiently conduct network security investigations and to produce useful representations of investigation results. As used herein, a network security investigation generally refers to an analysis by an analyst (or team of analysts) of one or more detected network events that may pose internal and/or external threats to a computer network under management. A network security application provides various interfaces that enable users to create investigation timelines, where the investigation timelines display a collection of events related to a particular network security investigation. A network security application further provides functionality to monitor and log user interactions with the network security application, where particular logged user interactions may also be added to one or more investigation timelines.

Generating investigation timeline displays including user-selected screenshots

Generating investigation timeline displays including activity events and investigation workflow events

Managing process analytics across process components

Embodiments of the present invention are directed to generating augmented process models for use in process analytics. In one embodiment, a process model, search indicators, composite attributes, and relationship indicators are received. The process model defines a process and includes a plurality of components of the process. Search indicators indicate a search that, when executed, provides data related to the corresponding component. Composite attributes indicate data to be captured by machine data searches associated with the corresponding component. Relationship indicators indicate relationships between components of the process. An augmented process model is generated based on the process model, the search indicators, the composite attributes, and the relationship indicators, wherein the augmented process model is used to manage process instances associated with the process.

Generating augmented process models for process analytics

A metric value is determined for each event in a set of events that characterizes a computational communication or object. For example, a metric value could include a length of a URL or agent string in the event. A subset criterion is generated, such that metric values within the subset are relatively separated from a population's center (e.g., within a distribution tail). Application of the criterion to metric values produces a subset. A representation of the subset is presented in an interactive dashboard. The representation can include unique values in the subset and counts of corresponding event occurrences. Clients can select particular elements in the representation to cause more detail to be presented with respect to individual events corresponding to specific values in the subset. Thus, clients can use their knowledge system operations and observance of value frequencies and underlying events to identify anomalous metric values and potential security threats.

Detection of potential security threats in machine data based on pattern detection

Systems and methods according to various embodiments enable a user to view three-dimensional representations of data objects ('nodes') within a 3D environment from a first person perspective. The system may be configured to allow the user to interact with the nodes by moving a virtual camera through the 3D environment. The nodes may have one or more attributes that may correspond, respectively, to particular static or dynamic values within the data object's data fields. The attributes may include physical aspects of the nodes, such as color, size, or shape. The system may group related data objects within the 3D environment into clusters that are demarked using one or more cluster designators, which may be in the form of a dome or similar feature that encompasses the related data objects. The system may enable multiple users to access the 3D environment simultaneously, or to record their interactions with the 3D environment.

Conveying data to a user via field-attribute mappings in a three-dimensional model

Dockable billboards for labeling objects in a display having a three-dimensional perspective of a virtual or real environment

Conveying machine data to a user via attribute mappings in a three-dimensional model

Displaying network security events and investigation activities across investigation timelines

Generating cluster states for hierarchical clusters in three-dimensional data models

Security threat detection based o patterns in machine data events

Growing community of inventors

San Francisco, CA, United States of America

Alexander Lynn Raitz