Microsoft Technology Licensing, LLC

Shi Min Sharon Ko

Gueorgui Chkodrov

Mohamed Rouatbi

Vidhi Agarwal

Sangeetha Madderla

Event-triggered forensics capture technologies balance security incident data availability against data processing and storage costs. A forensic correlation engine receives basic status data of a monitored computing system. A forensic computing system detects a trigger event in the basic status data, and starts capturing extended status data per a corresponding capture specification. Captured data is submitted to a forensic analysis tool. Different trigger events may cause different data captures. A query specifying which data to capture from a live stream or from virtual machines may operate as a capture trigger start event. Extended status data capture activity may be stopped by a change in the basic status data being received, by a timeout, or by forensic analysis that finds no vulnerability or threat based on captured data. Data transfers and storage may be restricted to comply with privacy regulations or policies.

Growing community of inventors

Redmond, WA, United States of America

Shi Min Sharon Ko