International Business Machines Corporation

Emc Corporation

Rapid7, Inc.

Green Market Square Limited

Noetic Cyber Inc.

Kenneth Allen Rogers

Allen Hadden

David Giroux

Hugh Pyle

John W Bruce

Allen D Hadden

Peter J Thompson

Aditya Vinayak Kothekar

Craig Roberts

An entity tracking system and method for a computer network employs proactive data collection and enrichment driven by configurable rules and workflows responsive to the discovery of new entities, changes to existing entities, and specifics about the entities' attributes. The data collection is used in conjunction with graph technologies to map interactions and relationships between various entities interacting in the computer environment and deduce interactions and relationships between the entities. The method and system provides for abstract entity types and collation nodes.

System for collecting computer network entity information employing abstract models

An entity tracking system and method for a computer network employs proactive data collection and enrichment driven by configurable rules and workflows responsive to the discovery of new entities, changes to existing entities, and specifics about the entities' attributes. The data collection is used in conjunction with graph technologies to map interactions and relationships between various entities interacting in the computer environment and deduce interactions and relationships between the entities. Machine learning techniques further identify, group or categorize entities and identify patterns which are indicative of anomalies that might be due to nefarious actions or compromised security.

System for automatically discovering, enriching and remediating entities interacting in a computer network

A system and method for responding to incidents in an enterprise network is disclosed. The system tracks incidents by creating, in an incident Manager, incident objects for each incident. Each incident object includes details for the incidents, also known as incident characteristics. The system also creates one or more indicators of compromise (IOCs) associated with the incident characteristics for each incident. When processing a new incident or an update to an incident, the system compares IOCs associated with the incident object for the incident being processed to stored IOCs for other incidents to determine if other incidents are related to the incident being processed. In embodiments, the system can then generate tasks for responding to new incidents based on incident characteristics of and IOCs associated with the new incidents, and can regenerate tasks for responding to incidents based on updates to incident characteristics of and IOCs associated with the incidents.

Incident response plan based on indicators of compromise

An incident manager application (IM) for responding to data security incidents in enterprise networks is disclosed. An IM tracks the incidents in an enterprise network by storing incident objects and incident artifact (IA) metadata created for the incidents, where the incident objects and IAs include information concerning the incidents. Incident response team (IRT) personnel of the enterprise networks can define action conditions within the IM that are associated with the incident objects. When the information within the incident objects and/or IAs meets the defined action conditions, the IM includes the objects that cause the action conditions to be satisfied in messages. Devices such as user account databases and configuration servers within the enterprise network can then download the messages and execute actions that reference the objects extracted from the downloaded messages to implement a response to the incidents.

Action response framework for data security incidents

A system and method for responding to data security incidents in enterprise networks using an incident response bus (IR bus) within an incident management system is disclosed. An Incident Manager (IM) application of the system stores objects that include information concerning data security incidents that occur in enterprise networks managed by the incident management system. Users configure action conditions on the IM, the satisfaction of which cause the IM to send messages that include the information concerning the incidents to message queues, or destinations. Correspondingly, the IR bus includes plugins associated with the devices in each client's enterprise network, where each plugin can access the message destinations for the messages. The plugins, in one embodiment, also configure one or more chains of plugins that process the messages. The plugins then execute the chains of plugins to specify actions for the devices to execute to provide a response to the incidents.

Incident response bus for data security incidents

A DRM system is provided wherein when a protected content unit is provided to an access device, the access information associated with the protected content unit is retrieved from the DRM server and provided to the access device in the same transaction in which the protected content unit is provided. Therefore, when the user seeks to access the protected content unit, the access request can be handled locally without the need to rely upon potentially constrained connectivity to the DRM server. The techniques described herein enable an access device to access content protected by a DRM system. When a protected content unit and access information is received at the access device, in one transaction, the protected content unit can be decrypted on the access device using the access information, and/or the access information can be used to enforce a DRM policy associated with the protected content unit.

Accessing rights-managed content from constrained connectivity devices

A data security incident correlation and dissemination system and method is disclosed. In an exemplary implementation of the system, a service provider of a managed security service receives incident information regarding data security incidents at different business organizations of the security service. One or more incident managers operated by different organizations send incident information, and a server system within the service provider's network creates aggregated data from the incident information received from the incident managers. The server system analyzes the aggregated data to create correlated incident records that include incident information from related data security incidents at the different organizations, and provides threat intelligence data based on the correlated incident records for the organizations. In embodiments, the server system can 'push' threat intelligence data to the organizations, or the organizations can request the threat intelligence data from the server system.

Data security incident correlation and dissemination system and method

An incident response system and method for tracking data security incidents in enterprise networks is disclosed. An Incident Manager application (IM) stores incident objects and incident artifacts (IAs) created in response to the incidents, where the incident objects include the information for the incident and the IAs are associated with data resources (e.g. IP addresses and malware hashes) identified within the incident objects. In response to creation of the IAs, the IM issues queries against one or more external threat intelligence sources (TISs) to obtain information associated with the IAs and augments the IAs with the obtained information. In examples, the IM can identify known threats by comparing the contents of IAs against TIS(s) of known threats, and can identify potential trends by correlating the created incident objects and augmented IAs for an incident with incident objects and IAs stored for other incidents.

System for tracking data security threats and method for same

A DRM system is provided wherein a policy can be established such that the DRM system controls access to a protected content unit, wherein the policy evaluates a condition so that the DRM system adaptively varies the actions that a user is authorized to perform with the protected content unit in response to changes in the condition. The techniques described herein enable a protection level for a protected content unit to be varied in response to changes in one or more condition, such as environmental conditions and/or an historical usage conditions. The techniques described herein also enable a set of policies to be established for a DRM system such that the DRM system controls access to multiple protected content units in accordance with the set of policies. Pursuant to these policies, the DRM system can adaptively vary access to multiple protected content units in response to one or more conditions.

Methods and apparatus for adapting the protection level for protected content

An object classification system is provided that receives, from a user, at least one piece of information relating to the object, wherein the information does not directly specify a classification for the object, and that applies at least one rule that classifies the object based, at least in part, on the at least one piece of information received from the user. The techniques described herein also enable classifying an object by, in response to a request from at least one application to access the object, applying at least one rule that dynamically classifies the object.

Growing community of inventors

Stow, MA, United States of America

Kenneth Allen Rogers