Logrhythm Inc.

Phillip Villella

Chris Petersen

Brad Aisa

Christopher L Petersen

Dean Richard Wyatte

Daniel Kaslovsky

Ben Aldrich

Dean Wyatte

A processing pipeline for supporting advanced analytics for network monitoring and information management as well as specific analytics for particular use cases. The processing pipelinetakes in system data () and pre-processes () the system data. The system data () may include any of the types of data described above including text log files, and categorical data from various sources. The illustrated processing pipelineincludes two branches; a data modeling branch () where a model is developed for the data and a data evaluation branch () where the developed model is leveraged to evaluate live data. For certain event detection use cases, the output of the data evaluation branch () includes a score () (e.g., a threat level score) and context information for evaluating the threat.

Processing pipeline for monitoring information systems

An advanced intelligence engine (AIE) for use in identifying what may be complex events or developments on one or more data platforms or networks from various types of structured or normalized data generated by one or more disparate data sources. The AIE may conduct one or more types of quantitative, correlative, behavioral and corroborative analyses to detect events from what may otherwise be considered unimportant or non-relevant information spanning one or more time periods. Events generated by the AIE may be passed to an event manager to determine whether further action is required such as reporting, remediation, and the like.

Advanced intelligence engine for identifying an event of interest

A processing pipeline for supporting machine-learning processes for network monitoring and information management as well as specific analytics for particular use cases. The processing pipelinetakes in system data () and pre-processes () the system data. The system data () may include any of the types of data described above including text log files, and categorical data from various sources. The illustrated processing pipelineincludes two branches; a data fitting branch () where a model is developed for the data and a data transformation branch () where the developed model is leveraged to transform live data. For certain event detection use cases, the output of the data transformation branch () includes a score () (e.g., a threat level score) and an attribution ().

Analytics for processing information system data

Advanced intelligence engine

Tools for use in obtaining useful information from processed log messages generated by a variety of network platforms (e.g., Windows servers, Linux servers, UNIX servers, databases, workstations, etc.). The log messages may be processed by one or more processing platforms or 'log managers' using any appropriate rule base to identify 'events' (i.e., log messages of somewhat heightened importance), and one or more &#x201c;event managers&#x201d; may analyze the events to determine whether alarms should be generated therefrom. The tools may be accessed via any appropriate user interface of a console that is in communication with the various log managers, event managers, etc., to perform numerous tasks in relation to logs, events and alarms.

Log collection, structuring and processing

Scalable analytical processing of structured data

The present invention generally relates to log message processing such that events can be detected and alarms can be generated. For example, log messages are generated by a variety of network platforms (e.g., Windows servers, Linux servers, UNIX servers, databases, workstations, etc.). Often, relatively large numbers of logs are generated from these platforms in different formats. A log manager described herein collects such log data using various protocols (e.g., Syslog, SNMP, SMTP, etc.) to determine events. That is, the log manager may communicate with the network platforms using appropriate protocols to collect log messages therefrom. The log manager may then determine events (e.g., unauthorized access, logins, etc.) from the log data and transfer the events to an event manager. The event manager may analyze the events and determine whether alarms should be generated therefrom.

Growing community of inventors

Boulder, CO, United States of America

Phillip Villella