Amazon Technologies, Inc.

Emc Corporation

John Jamail

Wayne Mesard

Daniel B Reich

Justin Schoeff

Kevin Sellers

Ian Marshal Wharton

Catherine V Hart

Adam Daniel Kropelin

Frederick Dushin

Maxim Pevzner

Mark F McLaughlin

Paul W Stoecker

Systems and methods are described herein for more efficiently updating a data directory, which maps data objects stored by a data storage service, such as maintained by on premise computing resources of a client of the data storage service. In one example, event data corresponding to operations performed on a plurality of data objects stored in a data storage partition of a data storage service may be obtained. A set of data objects relevant to a directory maintained locally by a client device may be determined. The event data may be filtered, such as by removing entries of the plurality of entries not corresponding to the set of data objects. The filtered event data may then be stored or pushed to a client device, to cause the directory to be updated, without requiring a full examination of the data storage partition.

Continuous file metadata refresh for file gateway

Techniques for a service provider network to authenticate client devices and determine authorizations for users by sending requests for information in remotely managed user directories. The service provider network may provide computing infrastructure to service requests from users who have accounts with a subscriber of the service provider network. The subscriber may maintain user information for the various user accounts usable to authenticate client devices and/or determine authorizations of users. The service provider network may receive a request from a client device to execute a workflow for a service of the subscriber that is supported by resources of the service provider network. The service provider network may send a request to a subscriber device for user account information for authentication and determining authorization. For instance, the service provider network may request a public key to authenticate the client device, and/or authorization information indicating permissions granted for a user account.

Authentication and authorization with remotely managed user directories

A file system interface receives, from one or more clients, file system operations over a network. In response to receiving a file system operation for a file, a file-object manager calls an object storage interface to store, via an application-level network protocol, a log object indicating the file system operation into a file system log in the object storage system and creates or updates a file object in a file object construction buffer in volatile system memory. To evict the file object, the file-object manager calls the object storage interface to store the file object into a file object store in the object storage system. The file-object manager does not have access to local persistent storage. After power failure, the file-object manager calls the object storage interface to retrieve log objects from the file system log and replays file system operations to restore file objects in the volatile system memory.

Using log objects in object storage for durability of file objects in volatile memory

A methodology and related system operable to store a plurality of complex event processing (CEP) rules, the CEP rules being based on a plurality of events that are to be monitored. The CEP rules are pre-processed by, e.g., generating and storing a de-duplicated list of events from the plurality of events that are to be monitored. A received event from a received event stream is compared to events in the de-duplicated list of events and when a match between the received event (e.g., an event instance) and any one of the events in the de-duplicated list of events is detected, the received event (the event instance) is stored in an input repository. The plurality of CEP rules are then applied to the received event in the input repository, and any other previously stored events in the input repository.

Scalable alerter for security information and event management

An improved technique involves providing a tool that connects standardized content bundles in order to carry out an arbitrarily complex investigation. An investigation server makes content bundles, which perform a standardized set of investigative actions based on a set of inputs, available to an investigation analyst. The investigation analyst selects particular content bundles based on a specified set of input parameters and a desired set of output parameters defining the investigation. The investigation analyst then connects the particular content bundles to form a single, complex workflow configured to produce the desired set of output parameters from the specified set of input parameters as a result of the investigation.

Visual security workflow

There is disclosed techniques for generating alerts in an event management system which comprises event management device and risk assessment device. In one example, a method comprises the following steps. There is received data in an event management device related to events associated with an asset in a network environment. The received data is filtered in order to provide an input to risk assessment device. The filtered data is forwarded to risk assessment device. A score indicative of risk based on filtered data is determined in risk assessment device. The score is forwarded to event management device and received in event management device. A score chart is generated in the event management device. The score chart includes the score and enables the prioritization of threats based on their respective scores.

Generating alerts in event management systems

A method is used in managing analysis of activity data. Activity data is analyzed for a security investigation by using a content bundle. The content bundle specifies a set of actions. The set of actions are performed based on a set of inputs provided to the content bundle. Results of analysis of the activity data is provided in a format based on a set of outputs configured for the content bundle.

Growing community of inventors

Sudbury, MA, United States of America

John Jamail