Information security – Monitoring or scanning of software or data including attack...
Reexamination Certificate
2008-04-04
2011-11-08
Revak, Christopher (Department: 2431)
Information security
Monitoring or scanning of software or data including attack...
C709S224000
Reexamination Certificate
active
08056130
ABSTRACT:
Security events generated by a number of network devices are gathered and normalized to produce normalized security events in a common schema. The normalized security events are cross-correlated according to rules to generate meta-events. The security events may be gathered remotely from a system at which the cross-correlating is performed. Any meta-events that are generated may be reported by generating alerts for display at one or more computer consoles, or by sending an e-mail message, a pager message, a telephone message, and/or a facsimile message to an operator or other individual. In addition to reporting the meta-events, the present system allows for taking other actions specified by the rules, for example executing scripts or other programs to reconfigure one or more of the network devices, and or to modify or update access lists, etc.
REFERENCES:
patent: 5557742 (1996-09-01), Smaha et al.
patent: 5717919 (1998-02-01), Kodavalla et al.
patent: 5850516 (1998-12-01), Schneier
patent: 5956404 (1999-09-01), Schneier et al.
patent: 5978475 (1999-11-01), Schneier et al.
patent: 6070244 (2000-05-01), Orchier et al.
patent: 6088804 (2000-07-01), Hill et al.
patent: 6134664 (2000-10-01), Walker
patent: 6192034 (2001-02-01), Hsieh et al.
patent: 6202158 (2001-03-01), Urano et al.
patent: 6275942 (2001-08-01), Bernhard et al.
patent: 6321338 (2001-11-01), Porras et al.
patent: 6347374 (2002-02-01), Drake et al.
patent: 6408391 (2002-06-01), Huff et al.
patent: 6408404 (2002-06-01), Ladwig
patent: 6484203 (2002-11-01), Porras et al.
patent: 6542075 (2003-04-01), Barker et al.
patent: 6553377 (2003-04-01), Eschelbeck et al.
patent: 6553378 (2003-04-01), Eschelbeck
patent: 6567808 (2003-05-01), Eschelbeck et al.
patent: 6694362 (2004-02-01), Secor et al.
patent: 6704874 (2004-03-01), Porras et al.
patent: 6708212 (2004-03-01), Porras et al.
patent: 6711615 (2004-03-01), Porras et al.
patent: 6839850 (2005-01-01), Campbell et al.
patent: 6907430 (2005-06-01), Chong et al.
patent: 6928556 (2005-08-01), Black et al.
patent: 6966015 (2005-11-01), Steinberg et al.
patent: 6985920 (2006-01-01), Bhattacharya et al.
patent: 6988208 (2006-01-01), Hrabik et al.
patent: 6996551 (2006-02-01), Hellerstein et al.
patent: 7039953 (2006-05-01), Black et al.
patent: 7043727 (2006-05-01), Bennett et al.
patent: 7062783 (2006-06-01), Joiner
patent: 7089428 (2006-08-01), Farley et al.
patent: 7127743 (2006-10-01), Khanolkar et al.
patent: 7134141 (2006-11-01), Crosbie et al.
patent: 7143444 (2006-11-01), Porras et al.
patent: 7154857 (2006-12-01), Joiner et al.
patent: 7159125 (2007-01-01), Beadles et al.
patent: 7159237 (2007-01-01), Schneier et al.
patent: 7168093 (2007-01-01), Hrabik et al.
patent: 7171689 (2007-01-01), Beavers
patent: 7207065 (2007-04-01), Chess et al.
patent: 7219239 (2007-05-01), Njemanze et al.
patent: 7260844 (2007-08-01), Tidwell et al.
patent: 7278160 (2007-10-01), Black et al.
patent: 7308689 (2007-12-01), Black et al.
patent: 7318178 (2008-01-01), Steinberg et al.
patent: 7333999 (2008-02-01), Njemanze
patent: 7340776 (2008-03-01), Zobel et al.
patent: 7376969 (2008-05-01), Njemanze et al.
patent: 7483972 (2009-01-01), Bhattacharya et al.
patent: 7631354 (2009-12-01), Ross et al.
patent: 7644365 (2010-01-01), Bhattacharya et al.
patent: 2002/0019945 (2002-02-01), Houston et al.
patent: 2002/0038232 (2002-03-01), Nihira
patent: 2002/0147803 (2002-10-01), Dodd et al.
patent: 2002/0184532 (2002-12-01), Hackenberger et al.
patent: 2003/0084349 (2003-05-01), Friedrichs et al.
patent: 2003/0093514 (2003-05-01), Valdes et al.
patent: 2003/0093692 (2003-05-01), Porras
patent: 2003/0188189 (2003-10-01), Desai et al.
patent: 2003/0221123 (2003-11-01), Beavers
patent: 2004/0010718 (2004-01-01), Porras et al.
patent: 2004/0024864 (2004-02-01), Porras et al.
patent: 2004/0044912 (2004-03-01), Connary et al.
patent: 2004/0181685 (2004-09-01), Marwaha
patent: 2004/0221191 (2004-11-01), Porras et al.
patent: 2004/0260947 (2004-12-01), Brady et al.
patent: 2005/0027845 (2005-02-01), Secor et al.
patent: 2005/0028002 (2005-02-01), Christodorescu et al.
patent: 2005/0204404 (2005-09-01), Hrabik et al.
patent: 2005/0251860 (2005-11-01), Saurabh et al.
patent: 2005/0257264 (2005-11-01), Stolfo et al.
patent: 2006/0095587 (2006-05-01), Bhattacharya et al.
patent: 2006/0212932 (2006-09-01), Patrick et al.
patent: 2007/0118905 (2007-05-01), Morin et al.
patent: 2007/0136437 (2007-06-01), Shankar et al.
patent: 2007/0143842 (2007-06-01), Turner et al.
patent: 2007/0150579 (2007-06-01), Morin et al.
patent: 2007/0162973 (2007-07-01), Schneier et al.
patent: 2007/0169038 (2007-07-01), Shankar et al.
patent: 2007/0234426 (2007-10-01), Khanolkar et al.
patent: 2007/0260931 (2007-11-01), Aguilar-Macias et al.
patent: 2008/0104046 (2008-05-01), Singla et al.
patent: 2008/0104276 (2008-05-01), Lahoti et al.
patent: 2008/0162592 (2008-07-01), Huang et al.
patent: 2008/0165000 (2008-07-01), Morin et al.
patent: 2009/0319659 (2009-12-01), Terasaki et al.
patent: 2010/0058165 (2010-03-01), Bhattacharya et al.
patent: 2011/0161848 (2011-06-01), Purcell et al.
patent: 20030035142 (2003-09-01), None
patent: 20030035143 (2003-09-01), None
patent: WO 02/045315 (2002-06-01), None
patent: WO 02/060117 (2002-08-01), None
patent: WO 02/078262 (2002-10-01), None
patent: WO 02/101988 (2002-12-01), None
patent: WO 03/009531 (2003-01-01), None
patent: WO 2004/019186 (2004-03-01), None
patent: WO 2005/001655 (2005-01-01), None
patent: WO 2005/026900 (2005-03-01), None
“User Guide for Version 1.0 of the ArcSight Enterprise Security Center”, 2001, ArcSight Inc., Version 1.0, p. 1,5,11,13,14,17-19,22-26,47,50,70,121,135,136,141,248,249,269-273.
U.S. Appl. No. 10/308,767, filed Dec. 2, 2002.
U.S. Appl. No. 10/308,548, filed Dec. 2, 2002.
U.S. Appl. No. 10/308,941, filed Dec. 2, 2002.
U.S. Appl. No. 10/308,416, filed Dec. 2, 2002.
U.S. Appl. No. 10/308,418, filed Dec. 2, 2002.
U.S. Appl. No. 10/308,417, filed Dec. 2, 2002.
U.S. Appl. No. 10/308,584, filed Dec. 2, 2002.
U.S. Appl. No. 10/733,073, filed Dec. 10, 2003.
U.S. Appl. No. 10/713,471, filed Nov. 14, 2003.
U.S. Appl. No. 10/683,221, filed Oct. 10, 2003.
U.S. Appl. No. 10/683,191, filed Oct. 10, 2003.
U.S. Appl. No. 10/821,459, filed Apr. 9, 2004.
U.S. Appl. No. 10/839,563, filed May 4, 2004.
U.S. Appl. No. 10/976,075, filed Oct. 27, 2004.
U.S. Appl. No. 10/975,962, filed Oct. 27, 2004.
U.S. Appl. No. 10/974,105, filed Oct. 27, 2004.
U.S. Appl. No. 11/029,920, filed Jan. 4, 2005.
U.S. Appl. No. 11/021,601, filed Dec. 23, 2004.
U.S. Appl. No. 11/070,024, filed Mar. 1, 2005.
U.S. Appl. No. 11/740,203, filed Apr. 25, 2007.
U.S. Appl. No. 11/836,251, filed Aug. 9, 2007.
U.S. Appl. No. 11/023,942, filed Dec. 24, 2004, pp. 1-26.
ArcSight, “About ArcSight Team,” date unknown, [online] [Retrieved on Oct. 25, 2002] Retrieved from the Internet <URL: http://www.arcsight.com/about—team.htm>.
ArcSight, “About Overview,” Oct. 14, 2002, [online] [Retrieved on Apr. 21, 2006] Retrieved from the Internet <URL: http://web.archive.org/web/20021014041614/http://www.arcsight.com/about.htm>.
ArcSight, “Contact Info,” date unknown, [online] [Retrieved on Oct. 25, 2002] Retrieved from the Internet <URL: http://www.arcsight.com/contact.htm>.
ArcSight, “Enterprise Coverage: Technology Architecture,” date unknown, [online] [Retrieved on Nov. 11, 2007] Retrieved from the Internet <URL: http://www.snaiso.com/Documentation/Arcsight/arcsight—archdta.pdf>.
U.S. Appl. No. 60/405,921, filed Aug. 26, 2002, Gisby et al.
ArcSight, “Managed Process: ArcSight Reporting System,” date unknown, [online] [Retrieved on Nov. 11, 2007] Retrieved from the Internet <URL: http://www.snaiso.com/Documentation/Arcsight/arcsight—reportsys.pdf>.
ArcSight, “Managed Process: Console-Based Management,” date unknown, [online] [Retrieved on Nov. 11, 2007] Retrieved from the Internet <URL: http://www.snaiso.com/Documentation/Arcsight/arcsight—console.p
Kothari Pravin S.
Njemanze Hugh S.
Hewlett--Packard Development Company, L.P.
Revak Christopher
LandOfFree
Real time monitoring and analysis of events from multiple... does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Real time monitoring and analysis of events from multiple..., we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Real time monitoring and analysis of events from multiple... will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-4305407