Splunk Inc.

Anvilogic, Inc.

Jeswanth Manikonda

Karthik Kannan

Bo Lei

George Apostolopoulos

Marios Iliofotou

Essam Zaky

Sitaram Venkatraman

Deb Banerjee

Mackenzie Kyle

Kevin Gonzalez

Benjamin Arnold

A dynamic threat landscape to which computer resources of a specific enterprise are subject is tracked. Data feeds maintained by a security system of the enterprise are assessed. The effectiveness of data feed utilization by the security system is quantified, relative to the threat landscape. Threat detection rules deployed by the security system are assessed, and the effectiveness thereof by the security system is quantified. Processing capability of alerts generated by threat detection rules and threat response capability may also be assessed and quantified. The effectiveness of the security system as a whole is automatically quantified, based on the tracked threat landscape, the quantifications of the effectiveness of data feed utilization, threat detection rule utilization, processing capability of alerts generated by threat detection rules and/or threat response capability. Recommendations concerning more effectively protecting the enterprise against specific threats are output. Actions are automatically taken to mitigate specific threats.

Automated quantified assessment, recommendations and mitigation actions for enterprise level security operations

A network connection between a server group of a data intake and query system and each of one or more source network nodes is established. Source data at the server group is received from at least one of the one or more source network nodes via the respective network connections and transformed, by the indexer server, to timestamped data entries of machine data. A model management server detects data constraints for a security model that include a data element used by the security model and an availability requirement set. Using the timestamped data entries, the data constraints are validated, and the validation used to determine a data availability assessment of the security model.

Systems data availability validation

A network connection between a server group of a data intake and query system and each of one or more source network nodes is established. Source data at the server group is received from at least one of the one or more source network nodes via the respective network connections and transformed, by the indexer server, to timestamped entries of machine data. A model management server detects data constraints for a security model. Using the timestamped entries, the data constraints are validated to obtain a validation result, where validating the data constraints includes determining whether the timestamped entries satisfy the availability requirement set for the data element. The model management server determines a data availability assessment of the security model based on the validation result.

Validation of systems data

Described are platforms, systems, and methods for providing a threat scenario rule to detect a specified threat scenario use case. In one aspect, a method comprises: receiving, from an interface, a set of threat detection parameters; determining a set of recommended threat identifier use cases from a plurality of threat identifier use cases based on the set of threat detection parameters; providing, to the interface, the set of recommended threat identifier use cases; receiving, from the interface, a threat scenario use case comprising a selection of the set of recommended threat identifier use cases; determining a threat scenario rule comprising logic to detect the threat scenario use case; and providing the threat scenario rule to the interface.

Platform for developing high efficacy detection content

A network connection between a server group of a data intake and query system and each of one or more source network nodes is established. The server group includes an indexer server and a model management server. Source data at the server group is received from at least one of the one or more source network nodes. A model management server detects data constraints for a security model. The data constraints include a data element used by the security model and an availability requirement set. Using the timestamped entries, the data constraints are validated to obtain a validation result. The model management server determines a data availability assessment of the security model based on the validation result. The data availability assessment of the security model is stored in computer storage.

Growing community of inventors

San Jose, CA, United States of America

Jeswanth Manikonda