Splunk Inc.

Bluebox Security, Inc.

Patrick Schulz

John Robert Coates

David Hazekamp

Luke K Murphey

Devendra M Badhani

Banipal Shahbaz

Lucas Keith Murphey

Chinmay Madhav Kulkarni

Francis E Gerard

Siri Atma Oaklander De Licori

Richard Barger

Bhavin Patel

Jason Szeto

Felix Matenaar

Kyle Champlin

Cory Chen

Sri Atma Oaklander De Licori

Techniques and mechanisms are disclosed for configuring actions to be performed by a network security application in response to the detection of potential security incidents, and for causing a network security application to report on the performance of those actions. For example, users may use such a network security application to configure one or more 'modular alerts.' As used herein, a modular alert generally represents a component of a network security application which enables users to specify security modular alert actions to be performed in response to the detection of defined triggering conditions, and which further enables tracking information related to the performance of modular alert actions and reporting on the performance of those actions.

Executing modular alerts and associated security actions

Techniques and mechanisms are disclosed for a data intake and query system to generate 'meta-notable' events by applying a meta-notable event rule to a collection of notable event data. A meta-notable event rule specifies one or more patterns of notable event instances defined by a set of notable event states and a set of transition rules (also referred to as association rules) indicating conditions for transitioning from one notable event state to another. The set of notable event states includes at least one start state and at least one end state. A meta-notable event is generated when a set of analyzed notable events satisfies a set of transition rules linking a start state to an end state (including transitions through any intermediary states between the start state and the end state).

Generating meta-notable event summary information

A software module ingests data into a data intake and query system. At least a portion of the data is cloud data. The software module includes an event type definition that specifies a type of data to be ingested by the software module, a first tag that associates ingested data of the event type with a data model, and a second tag that designates ingested data of the event type as cloud data. The ingested data is stored in a data repository, and subsequently a search query that includes the first tag and the second tag is executed against the data repository, to identify ingested cloud data that satisfies the search query and a first search constraint specified in the data model. A display device is caused to display a visualization based on the identified ingested cloud data that satisfies the search query.

Ingestion and processing of both cloud-based and non-cloud-based data by a data intake and query system

Configuring modular alert actions and reporting action performance information

Systems and methods for detecting network security threat event patterns

The present invention provides a mechanism to change how mobile device applications, particularly Android applications, work; essentially selectively modifying their behavior. Where an application provides a useful operation but also has functionality that can be detrimental to the desired action of a device, use of the application becomes problematic. The present invention provides a method of modifying the use of the application without invasive reprogramming of the code. The present invention provides a means to make modifications to the functionality without modifying the application. As a result, performance of the desired outcome is not affected and because there is no modification of the actual software, legal boundaries are maintained.

Methods for dynamic mobile application behavior modification subject to a behavior policy

Growing community of inventors

San Francisco, CA, United States of America

Patrick Schulz