Novell, Inc.

Novell Intellectual Property Holdings, Inc.

Cptn Holdings LLC

Frank Anthony Pellegrino

Dipto Chakravarty

Usman Choudhary

John Paul Gassner

William Matthew Weiner

Yuriy Fuksenko

Robert Price

Ofer Zajicek

John Melvin Antony

Prathap Adusumilli

Michael Howard Cooper

Srinivasa Phanindra Mallapragada

Srivani Sangita

Vasile Adiaconitei

Shahid Saied Malik

Karthik Ramu

Walter Mathews

Adedoyin Akinnurun

Brett Hankins

Melvin Antony

Tao Yu

Magdalene Ramona Merritt

Peng Liu

Raghunath Boyalakuntla

The system and method described herein relates to managing multiple network device connections, collecting event source data from one or more network devices with one or more collectors, filtering the event source data, continuously monitoring the network device connections, controlling raw data collection from the one or more network devices, parsing the event source data into normalized data structures, and managing configurations for the collectors, among other things. Event sources may be physical or logical network devices distributed across a network, including but not limited to, firewalls, routers, biometric devices, mainframes, databases, and applications. The network devices may be sources from which the collectors may receive or request the event source data.

Event source management using a metadata-driven framework

A computer-implemented device provides security events from publishers to subscribers. There is provided a message bus, configured to contain a plurality of security events. Also provided is a receiver unit, responsive to a plurality of publishers, to receive the plurality of security events from the publishers. There is also a queue unit, responsive to receipt of the security events, to queue the plurality of security events in the message bus. Also, there is a transport unit, responsive to the security events in the message bus, to transport the plurality of security events in the message bus to a plurality of subscribers.

Computer-implemented method and system for security event transport using a message bus

A system and method for analyzing events from devices relating to network security, includes a device interface(s), for receiving events from devices. One or more processors, responsive to the event received pursuant to the device interfaces, evaluate the event in accordance with rules, wherein the rules define, inter alia, an operation the system is to take to evaluate the event and an action to be taken under specified conditions. Also, the processor can determine, responsive to the received event, whether the event is of interest, and if not, discarding the event. The processor can provide a correlation corresponding to the at least one event, for the rules.

Computer-implemented method and system for security event correlation

Growing community of inventors

Greenbelt, MD, United States of America

Frank Anthony Pellegrino