Network change auditing system

Patent metadata

Field	Value
Publication number	US-10248924-B2
Application number	US-201615040793-A
Country	US
Kind code	B2
Filing date	Feb 10, 2016
Priority date	Feb 10, 2016
Publication date	Apr 2, 2019
Grant date	Apr 2, 2019

Abstract

A network includes a workflow management system coupled to an administrator device, and servers coupled to a user device. A network change auditing system receives and stores workflow definitions from the workflow management system that are associated with respective workflows provided by the servers. The network change auditing system receives and stores activity events from the servers that are associated with instructions from user devices to the servers. The network change auditing system associates a first subset of the activity events with a first workflow based on the first subset of the activity events being defined by a first workflow definition. The network change auditing system receives an identification of a first activity event from an administrator device and, in response, provides an identification of the first workflow and at least one second activity event in the first subset of the activity events for display on the administrator device.

First claim

What is claimed is:

1. An information handling system (IHS) network, comprising:
a workflow management system that is configured to couple to an administrator device;
a plurality of servers that are configured to couple to a user device; and
a network change auditing system that is coupled to the workflow management system and the plurality of servers, wherein the network change auditing system is configured to:
receive and store a plurality of workflow definitions from the workflow management system, wherein each of the plurality of workflow definitions are associated with a respective workflow provided by at least one of the plurality of servers;
receive and store a plurality of activity events from the at least one of the plurality of servers, where each activity event is associated with instructions provided by the user device to at least one of the plurality of servers;
associate a first subset of the plurality of activity events with a first workflow based on the first subset of the plurality of activity events being defined by a first workflow definition of the plurality of workflow definitions;
receive an identification of a first activity event in the first subset of the plurality of activity events from the administrator device and, in response, provide an identification of the first workflow and at least one second activity event in the first subset of the plurality of activity events for display on the administrator device;
associate a second subset of the plurality of activity events with a second workflow based on the second subset of the plurality of activity events being defined by a second workflow definition of the plurality of workflow definitions; and
receive a request to undo at least one of the second subset of the plurality of activity events from the administrator device and, in response, reverse the instructions that were provided by the user device to the at least one of the plurality of servers to produce the at least one of the second subset of activity events.

2. The IHS network of claim 1 , wherein the network change auditing system is configured to:
associate a third subset of the plurality of activity events with a third workflow based on the third subset of the plurality of activity events being defined by a third workflow definition of the plurality of workflow definitions; and
receive an identification of the third workflow from the administrator device and, in response, provide an identification of each of the third subset of the plurality of activity events for display on the administrator device.

3. The IHS network of claim 1 , wherein the network change auditing system is configured to:
determine a third subset of the plurality of activity events is not associated with any workflow; and
provide an identification of the third subset of the plurality of activity events for display on the administrator device.

4. The IHS network of claim 1 , wherein the first workflow definition includes at least one workflow location, at least one workflow user, and at least one workflow time range.

5. The IHS network of claim 1 , wherein the network change auditing system is configured to:
receive a textual description of the first workflow and, in response, analyze the textual description to determine the first workflow definition.

6. The IHS network of claim 1 , wherein the workflow management system is configured to:
receive the plurality of workflow definitions from the administrator device; and
provide the plurality of workflow definitions to the network change auditing system.

7. A network change auditing system, comprising:
a communication system that is coupled to a plurality of servers;
a database storing a plurality of workflow definitions that are each associated with a respective workflow provided by at least one of the plurality of servers;
a processing system coupled to the database; and
a memory system that is coupled to the processing system and the communication system, wherein the memory system includes instructions that, when executed by the processing system, cause the processing system to provide a contextual grouping correlation engine that is configured to:
receive and store a plurality of activity events from the at least one of the plurality of servers through the communication system, where each activity event is associated with instructions provided by at least one user device to at least one of the plurality of servers;
associate a first subset of the plurality of activity events with a first workflow based on the first subset of the plurality of activity events being defined by a first workflow definition of the plurality of workflow definitions;
receive an identification of a first activity event in the first subset of the plurality of activity events from an administrator device through the communication system and, in response, provide an identification of the first workflow and at least one second activity event in the first subset of the plurality of activity events through the communication system for display on the administrator device;
associate a second subset of the plurality of activity events with a second workflow based on the second subset of the plurality of activity events being defined by a second workflow definition of the plurality of workflow definitions; and
receive a request to undo at least one of the second subset of the plurality of activity events from the administrator device through the communication system and, in response, reverse the instructions that were provided by the at least one user device to the at least one of the plurality of servers to produce the at least one of the second subset of activity events.

8. The system of claim 7 , wherein the contextual grouping correlation engine is configured to:
associate a third subset of the plurality of activity events with a third workflow based on the third subset of the plurality of activity events being defined by a third workflow definition of the plurality of workflow definitions; and
receive an identification of the third workflow from the administrator device through the communication system and, in response, provide an identification of each of the third subset of the plurality of activity events for display on the administrator device.

9. The system of claim 7 , wherein the contextual grouping correlation engine is configured to:
determine a third subset of the plurality of activity events is not associated with any workflow; and
provide an identification of the third subset of the plurality of activity events through the communication system for display on the administrator device.

10. The system of claim 7 , wherein the first workflow definition includes at least one workflow location, at least one workflow user, and at least one workflow time range.

11. The system of claim 7 , wherein the contextual grouping correlation engine is configured to:
receive a textual description of the first workflow and, in response, analyze the textual description to determine the first workflow definition.

12. A method for auditing changes in a network, comprising:
receiving and storing, by a network change auditing system, a plurality of workflow definitions from a workflow management system, wherein each of the plurality of workflow definitions are associated with a respective workflow provided by at least one of a plurality of servers;
receiving and storing, by the network change auditing system, a plurality of activity events from the at least one of the plurality of servers, where each activity event is associated with instructions provided by a user device to at least one of the plurality of servers;
associati

Assignees

• Quest Software Inc

Inventors

• Jury Derek Alfred
• Ali Sohail
• Seigel Jake

Classifications

• G06Q10/0633 Primary

  Workflow analysis · CPC title

• G06Q10/10

  Office automation; Time management · CPC title

• H04L47/22

  Traffic shaping · CPC title