Splunk Inc.

Luke K Murphey

David Hazekamp

Vijay Chauhan

Wenhui Yu

Cary Glen Noel

Devendra M Badhani

Alexander Lynn Raitz

Liu-Yuan Lai

John Robert Coates

Patrick Schulz

Banipal Shahbaz

Siri Atma Oaklander De Licori

Sri Atma Oaklander De Licori

Techniques and mechanisms are disclosed for configuring actions to be performed by a network security application in response to the detection of potential security incidents, and for causing a network security application to report on the performance of those actions. For example, users may use such a network security application to configure one or more 'modular alerts.' As used herein, a modular alert generally represents a component of a network security application which enables users to specify security modular alert actions to be performed in response to the detection of defined triggering conditions, and which further enables tracking information related to the performance of modular alert actions and reporting on the performance of those actions.

Executing modular alerts and associated security actions

Provided are systems and methods for indicating deployment of application features. In one embodiment, a method is provided that includes determining available features of a current deployment of an application for receiving machine-generated data from one or more data sources of a data system, determining un-deployed features of the current deployment of the application, wherein the un-deployed features comprise one or more of the available features that is configured to use input data from a data source and wherein the input data is not available to the feature in the current deployment of the application, and causing display of a deployment graphical user interface (GUI) that comprises an indication of the un-deployed features.

Presenting un-deployed features of an application

Techniques and mechanisms are disclosed that enable network security analysts and other users to efficiently conduct network security investigations and to produce useful representations of investigation results. As used herein, a network security investigation generally refers to an analysis by an analyst (or team of analysts) of one or more detected network events that may pose internal and/or external threats to a computer network under management. A network security application provides various interfaces that enable users to create investigation timelines, where the investigation timelines display a collection of events related to a particular network security investigation. A network security application further provides functionality to monitor and log user interactions with the network security application, where particular logged user interactions may also be added to one or more investigation timelines.

Generating investigation timeline displays including user-selected screenshots

Identifying un-deployed features of an application

Generating investigation timeline displays including activity events and investigation workflow events

Assigning workflow network security investigation actions to investigation timelines

The disclosed embodiments provide a system that facilitates the processing of network data. During operation, the system provides a risk-identification mechanism for identifying a security risk from time-series event data generated from network packets captured by one or more remote capture agents distributed across a network. Next, the system provides a capture trigger for generating additional time-series event data from the network packets on the one or more remote capture agents based on the security risk, wherein the additional time-series event data includes one or more event attributes.

Configuring the generation of additional time-series event data by remote capture agents

Displaying network security events and investigation activities across investigation timelines

Configuring modular alert actions and reporting action performance information

Reporting un-deployed application features

Systems and methods for indicating deployment of application features

Network security investigation workflow logging

Storyboard displays of information technology investigative events along a timeline

Configuring the generation of event data based on a triggering search query

Growing community of inventors

Wadsworth, IL, United States of America

Luke K Murphey