Microsoft Technology Licensing, LLC

Gueorgui Chkodrov

Tihomir Tsvetkov Tarnavski

Richard Zachary Jason

Richard Douglas Hill

Vijay Mital

Roger Shane Barga

Craig Andrew Critchley

Krishnan Srinivasan

Wayne A Clark

Lucy Chao

Pramod Gurunath

Andrew C Ng

Zach Jason

Mitchell G Morris

Tolga Yildirim

Paul F Ringseth

Jonathan David Goldstein

Yotam Livny

Hani Hana Neuvirth

Andy Shen

Dawn Antonette Burns

Eric Anthony Reel

Jose Wilson Morris

Narinder Kaur

Andre Oneal Alfred

William Kendall Hollis

Vidhi Agarwal

Russell Biles

Dan Alexandru Nicolescu

Khoi Hong

Anitta Maria Miller

Maria Belousova

Chandrika G Shankarnarayan

Sangeetha Madderla

Gregory Robert Prickril

Justin Matthew Powell

Tin Qian

Elad Yom-Tov

Igor Sedukhin

Dotan Patrich

Michael Marucheck

Amol Kulkarni

Haoran Andy Wu

Daniel Eshner

Mohamed Rouatbi

Mariusz Gerard Borsa

David Shigeru Taniguchi

John David Ballard

Shuangtong Feng

Julian Federico Gonzalez

Ari Pekka Niikkonen

Gilles C J A Zunino

Zhipeng Zhao

Lucius B Fleuchaus

Mansoor Mohsin

Dave Dopson

Darene Brice Lewis

Anthony Goodrich Jones

Marek Jedrzejewicz

Jonathan Peary Morris

Jeffrey Scott Shaw

Jared Green

Scott Elliott Gorlick

David St Pierre

Shi Min Sharon Ko

Ryan John Littlefield

Ying Qian

David Lloyd Fosth

Zane Alexander Coppedge

Juan Miguel Paredes

Justin Minaker

Larry J Matuska

Jwalin Buch

Ahmed M S A W Moustafa

Owen Joseph Davis

Kevin M Grady

Yuesu Liu

Douglas M Setser

Chun Yu

William K Hollis

The handling of protocol exceptions for deterministic code that communicates with external component(s). A protocol exception host updates an execution state object associated with the deterministic code as the execution of the deterministic code proceeds. The component also detects whether a protocol exception has occurred that was caused by the deterministic code communicating using the protocol with an external component. If the component detects that such a protocol exception has occurred, the component handles the protocol exception. The component also determines whether the handled protocol exception has been successfully handled. If the exception is not successfully handled, the component stops the execution of the deterministic code such that the execution state object includes execution state of the deterministic code up to the stop. Accordingly, the execution state of the deterministic code up to the stop may be later used to resume execution of the deterministic code.

Protocol exception handling external to deterministic code

Event-triggered forensics capture technologies balance security incident data availability against data processing and storage costs. A forensic correlation engine receives basic status data of a monitored computing system. A forensic computing system detects a trigger event in the basic status data, and starts capturing extended status data per a corresponding capture specification. Captured data is submitted to a forensic analysis tool. Different trigger events may cause different data captures. A query specifying which data to capture from a live stream or from virtual machines may operate as a capture trigger start event. Extended status data capture activity may be stopped by a change in the basic status data being received, by a timeout, or by forensic analysis that finds no vulnerability or threat based on captured data. Data transfers and storage may be restricted to comply with privacy regulations or policies.

Event-triggered forensics capture

Methods, systems, and computer storage media for providing observation stream data of security incidents using an observation stream engine in a security management system. An observation stream framework supports continuously generating and presenting observation stream data that facilitates developing a working hypothesis of an active security incident. The observation stream framework can also include observation stream query-types that can be selected for running queries against a plurality of security data sources. In operation, an observation stream query is accessed. The observation stream query is a user-generated observation stream query associated with an observation stream query-type. The observation stream query-type comprises parameters for querying a plurality of security data sources and dynamic tracking of a security incident. The observation stream query is executed and observation stream data is generated. The observation stream data is caused to be displayed on an observation stream interface comprising data visualizations of the observation stream data.

Observation stream engine in a security management system

The automated creation of a dataflow graph of a standing query. Once the standing query dataflow graph is created, events may be flowed into the dataflow graph to execute the standing query. In execution, a store query is accessed. The store query is structured in accordance with a store query language. A syntax graph (such as an abstract syntax tree) of the store query may then be generated. Then, using the syntax graph and a set of rules of the store query language, the dataflow graph is automatically generated. This significant speeds up and makes more easy and efficient the conversion of a store query into a standing query.

Standing query creation using store query

Performing anomaly lookup on data sources that include an entity related to an alert. One or more entities related to an alert and a date when the alert occurred are received. The alert may indicate that an anomaly in data collected from a various data sources may be present in at least one of the data sources. The various data sources are searched for the one or more entities around the alert date to determine which of the data sources include the one or more entities. For those data sources including the one or more entities, an anomaly lookup procedure is performed on the data sources during a first time window to determine an initial set of suspicious anomalies.

Anomaly lookup for cyber security hunting

Using a set of anomalies indicative of a malicious pattern of behavior collected from data to determine new alerts for anomalies included in subsequently collected data. A set of anomalies found in data collected from data sources is accessed. The set of anomalies is determined by a prior analysis to be indicative of a malicious pattern of behavior by entities associated with the set of anomalies. Data that is subsequently collected from the data sources is searched to determine if any of the data includes the set of anomalies. Alerts are generated for any of the subsequently collected data that includes the set of anomalies.

Automatic generation of detection alerts

According to examples, an apparatus may include a processor and a computer readable medium on which is stored machine readable instructions that may cause the processor to receive a query, in which the query may define an event pertaining to the apparatus to be identified and summarization instructions. The processor may also implement the query on tracked events pertaining to the apparatus to identify event data pertaining to the apparatus that matches the event defined in the query and summarize the identified event data according to the summarization instructions to generate summarized event data responsive to the query. The processor may further output the summarized event data.

Summarized event data responsive to a query

Disclosed herein is a system for generating and displaying information useful to help a security analyst understand a scale and a root cause of a potential security issue associated with a resource. The resource can include a server, a storage device, a user device (e.g., a personal computer, a tablet computer, a smartphone, etc.), a virtual machine, networking equipment, etc. The resource may be one that is under control of an entity operating a security operations center. Additionally or alternatively, the resource may be one that is configured to be monitored by the security operations center. The information provides the security analyst with a broader context of the potential security issue based on relationships between the potential security issues and other security issues. Consequently, the information enables the security analyst to implement more efficient and effective actions to handle the potential security issue.

Providing context associated with a potential security issue for an analyst

Performance data generated according to a first schema is read. From the first schema, object descriptors having common primitive types are identified. A second schema is then created. The second schema defines a plurality of rows and at least one column. The rows include a record corresponding to an identified object descriptor. The at least one column corresponds to a primitive type in common with the identified object descriptors.

Performance data storage

Pushing an event that is identified within a data stream to a remote computer system. Event characteristic(s) that are to be searched for within the data stream are determined (e.g., in response to a query). The event(s) in the data stream is evaluated to determine if it includes the event characteristic mentioned above. If an event is determined to include the event characteristic, then the event may be pushed to the remote computer system. In this manner, the event may be responded to at the remote computer system. This process enables the events to be pushed in a very fast manner. Furthermore, the process of evaluating the events may happen without storing the events, which process further increases the speed of pushing the events.

Push-based event stream processing

Creating and executing a distributed stream processing operator graph based on a query. The operator graph includes movable stream algebra operators for processing events received from high volume data streams. The operators are partially compiled and distributed to computing devices for completion of the compilation and subsequent execution. During execution, the operators maintain minimal state information associated with received events via an expiration time assigned to each of the event instances. Additional events are generated and aggregated by the operators for communication to a service responsible for the query.

Implementation of stream algebra over class instances

Validating executable data for interactions among a plurality of process artifacts at design time. A data context is created to include the plurality of process artifacts. The data context carries interaction rules among the plurality of process artifacts. The executable data from a data source is associated with the plurality of process artifacts in the created data context. A subset of the interaction rules is selected corresponding to at least one of the plurality of process artifacts. The associated executable data is validated when the associated executable data is in accordance with the selected subset of the interaction rules.

Time business process validations within data context

Challenges associated with maintaining information about multiple instances of an activity are addressed. Separate database tables are maintained for data corresponding to active instances of an organization's activities and for data corresponding to inactive instances of an organization's activities. Multiple database tables can be maintained for data corresponding to inactive instances of an activity. In another aspect, data from the active instances table and one or more inactive instances tables are processed to generate combined analysis data.

Method for maintaining databases information about multiple instances of an activity generating, updating virtual OLAP cube based on modified star-schema

The present invention extends to methods, systems, and computer program products for monitoring distributed applications. Declarative application models are used. Operational data for a deployed application can be compared to an application intent expressed in a corresponding declarative application to provide more effective monitoring of application behavior. Application components can subscribe to an event fabric to receive configurations that indicate what events the application is to emit (i.e., publish into the event fabric) for monitoring. Thus, applications essentially subscribe to produce information (as opposed to subscribing to receive information). Monitoring can be dynamically adjusted in response to environment changes.

Monitoring distributed applications

Growing community of inventors

Redmond, WA, United States of America

Gueorgui Chkodrov