Symantec Corporation

Eric Bothwell

Kevin T Rowney

Chris Jones

Alexander Fontana

Dirk Kessler

Michael R Wolfe

Hai Chen

Christopher C Jones

Jeremy Hermann

Daren Desjardins

Michel Zoppas

Conal O'Raghallaigh

Vitali Fridman

A method and apparatus for automatically correlating policy violation incidents. In one embodiment, the method includes receiving user input identifying one of policy violation incidents stored in a data repository, where each policy violation incident is associated with one or more attributes. The method further includes automatically correlating the identified policy violation incident with other policy violation incidents that have in common at least one attribute with the identified policy violation incident, and presenting the resulting correlation information to a user.

Method and apparatus for automatically correlating related incidents of policy violations

A method and apparatus for creating a policy based on a pre-configured template is described. In one embodiment, source data having a tabular structure is identified. Further, one of multiple policy templates is used to automatically create a policy for detecting information from any one or more rows within the tabular structure of the source data.

Method and apparatus for creating an information security policy based on a pre-configured template

A method and apparatus for defining the scope of a search is described. In one embodiment, user input is received, and the scope is defined, based on the user input, for a search of free-form text for information from any random rows within a tabular structure of source data. In one embodiment, the search is intended for finding, in the free-form text, a sub-set of data fragments that matches information from any single row within the tabular structure of the source data.

Method and apparatus to define the scope of a search for information from a tabular data source

A method and apparatus for scanning structured data from a data repository having an arbitrary data schema and for applying a policy to the data of the data repository are described. In one embodiment, the structured data is converted to unstructured text data to allow a schema-independent policy to be applied to the text data in order to detect a policy violation in the data repository regardless of the data schema used by the data repository.

Method and apparatus for detecting policy violations in a data repository having an arbitrary data schema

A method and apparatus for blocking messages containing pre-selected data is described. In one embodiment, the method includes determining that a message transmitted to a recipient via a network includes pre-selected data. The pre-selected data contains information from at least one random row within the tabular structure of source data. The method further includes preventing an unauthorized transmission of the pre-selected data to the recipient.

Growing community of inventors

Redwood City, CA, United States of America

Eric Bothwell