Novell, Inc.

Emc Corporation

Novell Intellectual Property Holdings, Inc.

Cptn Holdings LLC

John Paul Gassner

Dipto Chakravarty

Usman Choudhary

Frank Anthony Pellegrino

William Matthew Weiner

Yuriy Fuksenko

Robert Price

Ofer Zajicek

Daniel S Sanders

John Melvin Antony

Prathap Adusumilli

Srinivasa Phanindra Mallapragada

Michael Howard Cooper

Raghunath Boyalakuntla

Srivani Sangita

Vasile Adiaconitei

Shahid Saied Malik

Karthik Ramu

Walter Mathews

Adedoyin Akinnurun

David Gordon Corlette

Brett Hankins

Melvin Antony

Tao Yu

Magdalene Ramona Merritt

Peng Liu

Daniel Spaugh Sanders

The system and method described herein relates to managing multiple network device connections, collecting event source data from one or more network devices with one or more collectors, filtering the event source data, continuously monitoring the network device connections, controlling raw data collection from the one or more network devices, parsing the event source data into normalized data structures, and managing configurations for the collectors, among other things. Event sources may be physical or logical network devices distributed across a network, including but not limited to, firewalls, routers, biometric devices, mainframes, databases, and applications. The network devices may be sources from which the collectors may receive or request the event source data.

Event source management using a metadata-driven framework

A syslog message routing system can include multiple syslog sources, a syslog message routing module, and multiple syslog parsers. The syslog message routing module can receive a syslog message from one of the syslog sources, identify a particular syslog parser to handle the syslog message, and send the syslog message to the selected syslog parser. The syslog message routing module can identify the syslog parser by applying at least one of an application ID-based policy, a unique pattern matching rule policy, and a universal syslog parser policy.

Syslog message routing systems and methods

A computer-implemented device provides security events from publishers to subscribers. There is provided a message bus, configured to contain a plurality of security events. Also provided is a receiver unit, responsive to a plurality of publishers, to receive the plurality of security events from the publishers. There is also a queue unit, responsive to receipt of the security events, to queue the plurality of security events in the message bus. Also, there is a transport unit, responsive to the security events in the message bus, to transport the plurality of security events in the message bus to a plurality of subscribers.

Computer-implemented method and system for security event transport using a message bus

A system and method for analyzing events from devices relating to network security, includes a device interface(s), for receiving events from devices. One or more processors, responsive to the event received pursuant to the device interfaces, evaluate the event in accordance with rules, wherein the rules define, inter alia, an operation the system is to take to evaluate the event and an action to be taken under specified conditions. Also, the processor can determine, responsive to the received event, whether the event is of interest, and if not, discarding the event. The processor can provide a correlation corresponding to the at least one event, for the rules.

Computer-implemented method and system for security event correlation

Growing community of inventors

Alexandria, VA, United States of America

John Paul Gassner