Servicenow, Inc.

Henry Geddes

Kurt Joseph Zettel, Ii

Jeffrey Rhines

Mark Cornell Manning

Richard Kenneth Reybok

Scott Lewis

Volodymyr Osypov

Sean Brady

Andreas Seip Haugsnes

Richard Reybok, Jr

Andreis Seip Haugsnes

Kurt Joseph Zettle

Kurt Joseph Zettle Ii

Jr Richard Reybok

This disclosure provides techniques for pooling and searching network security events reported by multiple sources. As information representing a security event is received from one source, it is searched against a central or distributed database representing events reported from multiple, diverse sources (e.g., different client networks). Either the search or correlated results can be filtered and/or routed according at least one characteristic associated with the networks, for example, to limit correlation to events reported by what are presumed to be similarly situated networks. The disclosed techniques facilitate faster identification of high-relevancy security event information, and thereby help facilitate faster threat identification and mitigation. Various techniques can be implemented as standalone software (e.g., for use by a private network) or for a central pooling and/or query service. This disclosure also provides different examples of actions that can be taken in response to search results.

Techniques for sharing network security event information

Systems and methods are disclosed for computer network threat assessment. For example, methods may include receiving from client networks respective threat data and storing the respective threat data in a security event database; maintaining affiliations for groups of the client networks; detecting correlation between a network threat and one of the groups; identifying an indicator associated with the network threat, and, dependent on the affiliation for the group, identifying a client network and generating a message, which conveys an alert to the client network, comprising the indicator; responsive to the message, receiving, from the client network, a report of detected correlation between the indicator and security event data maintained by the client network; and updating the security event database responsive to the report of detected correlation.

Computer network threat assessment

Growing community of inventors

Corte Madera, CA, United States of America

Henry Geddes