Hewlett Packard Enterprise Development LP

Entit Software LLC

Robert Block

Anurag Singla

Suranjan Pramanik

Daniel Juergen Gmach

Alvin AuYoung

Dhiraj Sharan

Jayaram Kallapalayam Radhakrishnan

Dilraba Ibrahim

Julian James Stephen

In response to determining that an event matches a condition of a rule, a given one of a plurality of computing nodes is selected to send the event, based on one or both of an attribute of the event and an identifier of the rule. Information of the event is sent to the given computing node to perform correlation of the event with another event.

Selecting from computing nodes for correlating events

According to an example, a confidence factor function may be applied to determine a confidence factor for a condition of a rule to correlate events. The confidence factor may be an approximation of whether an event or a set of events satisfies the condition in the rule. The confidence factor may be compared to a threshold to determine whether the condition is satisfied.

Event correlation based on confidence factor

According to an example, a master node is to divide an event field in events into partitions including ordered contiguous blocks of values for the event field. Each partition may be assigned to a pair of cluster nodes. A partition map is determined from the partitions and may identify for each partition, the block of the event field values for the partition, a primary cluster node, and a failover cluster node for the primary cluster node.

Distributed event correlation system

Systems and methods for evaluation of events are provided. A user-specific reference baseline comprising a set of temporally-ordered sequences of events. An event of a sequence of events in a current session is received. A determination is made as to whether the event at least partially matches the reference baseline using an attribute of the event and a temporal position of the event within the sequence of events in the current session.

Systems and methods for evaluation of events based on a reference baseline according to temporal position in a sequence of events

A network asset information management system () may include an asset determination and event prioritization module () to generate real-time asset information based on network activity involving an asset (). A rules module () may include a set of rules for monitoring the network activity involving the asset. An information analysis module () may evaluate the real-time asset information and the rules to generate a notification () related to the asset. The rules may include rules for determining vulnerabilities and risks associated with the asset based on comparison of a level of traffic identified to or from an IP address related to the asset to a predetermined threshold. The notification may include a level of risk associated with the asset.

Growing community of inventors

Sunnyvale, CA, United States of America

Robert Block