Mandiant Corporation

Fireeye, Inc.

Jason Shiffer

Matthew F Frazier

Sean Cunningham

Eric Helvey

David Merkel

Kevin Mandia

Matthew Pepe

Scott Hogsten

James Butler

Peter Villadsen

David Ross

Lois Cozzi

Theodore Wilson

A system and method for analyzing data from a plurality of computer environments. The computer environments are authenticated and data is imported to a memory location. The data is converted into a uniform format to enable expedited searching by one or more authenticated users. The data may be marked so that a user may determine which computer environment provided the data. The system may also create one or more indexes of the data to assist one or more users in searching the data.

Method and system for collecting and organizing data corresponding to an event

A method to identify character strings associated with potentially malicious software items. The method includes employing a visual algorithm to translate one or more characters of a character string into corresponding characters in a visual ID for use in grouping and comparing computer items having similar visual IDs, such as a reference ID for a computer item that is known to be non-malicious. The method may, among other things, elucidate an attacker's attempt to obfuscate malicious software by using file names that are very similar to those used for harmless files.

Identification of obfuscated computer items using visual algorithms

A system and method for gathering data from a plurality of computer environments. The computer environments are authenticated, data is copied from the plurality of authenticated computer environments to a memory location, and access to the memory location is provided to a plurality of authenticated users. The data may be marked so that a user may determine which computer environment provided the data.

Method and system for collaboration during an event

A system and method for searching for computer environments, authenticating the computer environments, and copying data from the authenticated computer environments to a memory location. The data is marked or bound to the computer system it was copied from which provides a user with assurance that the data was obtained from a specific, authenticated source. The computer environments and the memory location may be coupled over a network.

System and method for data preservation and retrieval

A system and method for analyzing data from a plurality of computer environments. A user may search for computer environments that meet a certain criterion. The computer environments are authenticated and data is copied from the computer environments to a memory location. The data may be marked so that a user may determine which computer environment provided the data. The user may add notations to the data during a review. Changes to data on the computer environments may be provided to a user using a syndication feed.

Method and system for analyzing data related to an event

Growing community of inventors

Vienna, VA, United States of America

Jason Shiffer