Splunk Inc.

Splunkinc.

Vijay Chauhan

David Hazekamp

Luke K Murphey

Wenhui Yu

Cary Glen Noel

Devendra M Badhani

Alexander Lynn Raitz

Liu-Yuan Lai

Banipal Shahbaz

Ravi Iyer

Provided are systems and methods for indicating deployment of application features. In one embodiment, a method is provided that includes determining available features of a current deployment of an application for receiving machine-generated data from one or more data sources of a data system, determining un-deployed features of the current deployment of the application, wherein the un-deployed features comprise one or more of the available features that is configured to use input data from a data source and wherein the input data is not available to the feature in the current deployment of the application, and causing display of a deployment graphical user interface (GUI) that comprises an indication of the un-deployed features.

Presenting un-deployed features of an application

Techniques and mechanisms are disclosed that enable network security analysts and other users to efficiently conduct network security investigations and to produce useful representations of investigation results. As used herein, a network security investigation generally refers to an analysis by an analyst (or team of analysts) of one or more detected network events that may pose internal and/or external threats to a computer network under management. A network security application provides various interfaces that enable users to create investigation timelines, where the investigation timelines display a collection of events related to a particular network security investigation. A network security application further provides functionality to monitor and log user interactions with the network security application, where particular logged user interactions may also be added to one or more investigation timelines.

Generating investigation timeline displays including user-selected screenshots

Identifying un-deployed features of an application

Generating investigation timeline displays including activity events and investigation workflow events

A data intake and query system measures an amount of raw data ingested by the system during defined periods of time. As used herein, ingesting raw data generally refers to receiving the raw data from one or more computing devices and processing the data for storage and searchability. Processing the data may include, for example, parsing the raw data into 'events,' where each event includes a portion of the received data and is associated with a timestamp. Based on a calculated number of events generated by the system during one or more defined time periods, the system may calculate various metrics including, but not limited to, a number of events generated during a particular day, a number of events generated per day over a period of time, a maximum number of events generated in a day over a period of time, an average number of events generated per day, etc.

Identifying metrics related to data ingestion associated with a defined time period

Assigning workflow network security investigation actions to investigation timelines

Selecting network security event investigation timelines in a workflow environment

Scaling available storage based on counting generated events

The disclosed embodiments provide a system that facilitates the processing of network data. During operation, the system provides a risk-identification mechanism for identifying a security risk from time-series event data generated from network packets captured by one or more remote capture agents distributed across a network. Next, the system provides a capture trigger for generating additional time-series event data from the network packets on the one or more remote capture agents based on the security risk, wherein the additional time-series event data includes one or more event attributes.

Configuring the generation of additional time-series event data by remote capture agents

Displaying network security events and investigation activities across investigation timelines

Reporting un-deployed application features

Systems and methods are disclosed for associating an entity with a risk score that may indicate a security threat associated with the entity's activity. An exemplary method may involve monitoring the activity of a subset of the set of entities (e.g., entities included in a watch list) by executing a search query against events indicating the activity of the subset of entities. The events may be associated with timestamps and may include machine data. Executing the search query may produce search results that pertain to activity of a particular entity from the subset. The search results may be evaluated based on a triggering condition corresponding to the statistical baseline. When the triggering condition is met, a risk score for the particular entity may be updated. The updated risk score may be displayed to a user via a graphical user interface (GUI).

Supplementary activity monitoring of a selected subset of network entities

Systems and methods for indicating deployment of application features

Display of data ingestion information based on counting generated events

Network security investigation workflow logging

Growing community of inventors

Burlingame, CA, United States of America

Vijay Chauhan