Splunk Inc.

Munawar Monzy Merza

John Robert Coates

David Hazekamp

Alexander Lynn Raitz

Lucas Keith Murphey

James Hansen

Michael Kinsley

In a method, a plurality of events is accessed, wherein an event of the plurality of events includes a portion of raw-machine data from a data source of a plurality of data sources. For at least one event of the plurality of events, a transaction phase of a computer security transaction is correlated with the at least one event based at least in part on a data source associated with the at least one event. The transaction phase of the at least one event is correlated with a particular asset of a plurality of assets.

Identifying a cyber-attack impacting a particular asset

Domain names are determined for each computational event in a set, each event detailing requests or posts of webpages. A number of events or accesses associated with each domain name within a time period is determined. A registrar is further queried to determine when the domain name was registered. An object is generated that includes a representation of the access count and an age since registration for each domain names. A client can interact with the object to explore representations of domain names associated with high access counts and recent registrations. Upon determining that a given domain name is suspicious, a rule can be generated to block access to the domain name.

Clustering-based security monitoring of accessed domain names

A metric value is determined for each event in a set of events that characterizes a computational communication or object. For example, a metric value could include a length of a URL or agent string in the event. A subset criterion is generated, such that metric values within the subset are relatively separated from a population's center (e.g., within a distribution tail). Application of the criterion to metric values produces a subset. A representation of the subset is presented in an interactive dashboard. The representation can include unique values in the subset and counts of corresponding event occurrences. Clients can select particular elements in the representation to cause more detail to be presented with respect to individual events corresponding to specific values in the subset. Thus, clients can use their knowledge system operations and observance of value frequencies and underlying events to identify anomalous metric values and potential security threats.

Detection of potential security threats in machine data based on pattern detection

Performing rule-based actions for newly observed domain names

Performing rule-based actions for domain names accessed by particular parties

Security threat detection based o patterns in machine data events

Detection of potential security threats based on categorical patterns

Performing rule-based actions based on accessed domain name registrations

Blocking domain name access using access patterns and domain name registrations

Security threat detection using access patterns and domain name registrations

Analyzing a group of values extracted from events of machine data relative to a population statistic for those values

Security threat detection using domain name registrations

Security threat detection using domain name accesses

Security threat detection of newly registered domains

Investigative and dynamic detection of potential security-threat indicators from events in big data

Growing community of inventors

Albuquerque, NM, United States of America

Munawar Monzy Merza