Creating security incident records using a remote network management platform

Patent metadata

Field	Value
Publication number	US-10826942-B2
Application number	US-201816100464-A
Country	US
Kind code	B2
Filing date	Aug 10, 2018
Priority date	Aug 10, 2018
Publication date	Nov 3, 2020
Grant date	Nov 3, 2020

Abstract

An example embodiment performed by a scoped software application executable on a computing device of a computational instance of a remote network management platform may involve: requesting and receiving, from an application database associated with a third-party software application, alert rules that trigger alerts when associated events occur in a managed network; receiving data representing selection of a set of the alert rules and, based on the data, requesting and receiving, from the application database, a set of past alerts that have been triggered by the set of the alert rules; using mapping data to map fields of the set of the past alerts to fields of a sample security incident record; displaying a preview region including the sample security incident record; using the mapping data to create security incident records that map to the set of the past alerts; and writing, to a security incident database, the security incident records.

First claim

What is claimed is:

1. A system comprising:
a memory device and a processor configured to execute a computational instance of a remote network management platform, wherein the computational instance is communicatively coupled and dedicated to a managed network and contains a security incident database, wherein the managed network contains one or more servers and an application database associated with a third-party software application executable on the one or more servers, wherein the application database stores, in respective fields defined in accordance with the third-party software application: (i) alert rules that trigger alerts when associated events occur in the managed network and (ii) past alerts that have been triggered by the alert rules;
a scoped software application, executable on a computing device of the computational instance, wherein the system is configured to:
receive, from the application database, the alert rules based on the occurrence of the associated events;
receive input data representing selection of a set of the alert rules;
transmit a request for a set of the past alerts that have been triggered based on the set of the alert rules;
based on the input data and the request for the set of the past alerts, receive, from the application database, the set of the past alerts that have been triggered by the set of the alert rules;
using mapping data stored within the computational instance, map fields of the set of the past alerts to fields of a sample security incident record without writing the sample security incident record to the security incident database, wherein the mapping data defines pairwise associations between the fields of the set of the past alerts and fields of the sample security incident record;
generate and provide for display a representation of a graphical user interface, the representation comprising a preview region including the sample security incident record;
using the mapping data, create security incident records that map to the set of the past alerts; and
write, to the security incident database, the security incident records.

2. The system of claim 1 , wherein the system is configured to:
before using the mapping data to create the security incident records, generate and provide for display the representation of the graphical user interface, the representation comprising:
an alert rule selection region for enabling the selection of the set of the alert rules, and
a mapping region for enabling selection of the fields of the set of the past alerts and selection of the fields of the security incident records to which to associate to the fields of the set of the past alerts; and

generate the mapping data based on the selection of the fields of the set of the past alerts and the selection of the fields of the security incident records.

3. The system of claim 1 , wherein the system is configured to:
while providing for display the representation comprising the preview region, receive second input data representing selection of a link that, when selected, causes the scoped software application to generate and provide for display a second representation of the graphical user interface, the second representation comprising a scheduling region for enabling selection of a frequency at which to transmit the request for the set of the past alerts from the application database; and
in response to receiving the second input data, generate and provide for display the second representation comprising the scheduling region,
wherein transmitting the request comprises receiving the set of the past alerts from the application database and receiving the set of the past alerts from the application database at the selected frequency.

4. The system of claim 1 , wherein the system is configured to:
before using the mapping data to create the security incident records, generate and provide for display the representation of the graphical user interface, the representation comprising a filtering rules region for enabling selection of filtering rules, wherein the filtering rules specify data that, when contained in one or more fields of a past alert, causes the scoped software application to omit creating a security incident record that maps to the past alert,
wherein creating the security incident records comprises creating the security incident records in accordance with the filtering rules.

5. The system of claim 1 , wherein the system is configured to:
receive input data representing selection of an update to the mapping data, wherein the updated mapping data includes a change in the pairwise associations between the fields of the set of the past alerts and the fields of the security incident records;
compare an identifier of a past alert of the set of the past alerts to data that is stored in the security incident database, wherein the data indicates, for each of a plurality of past alerts, whether a corresponding security incident record has previously been created and written to the security incident database for the past alert;
based on the comparison, determine that the corresponding security incident record has previously been created and written to the security incident database for the past alert identified by the identifier;
using the updated mapping data, update the corresponding security incident record; and
write the updated security incident record to the security incident database.

6. The system of claim 1 , wherein the system is configured to:
determine that a security incident record in the security incident database includes data indicating that a security incident associated with the security incident record has been resolved or cancelled;
based on the determination, refer to the security incident database to determine an identifier of a past alert that is associated with the security incident record; and
generate and transmit, to the application database, a request to update the application database to indicate that the past alert is closed, wherein the request to update the application database includes the identifier of the past alert.

7. The system of claim 1 , wherein the fields of the set of the past alerts include, for each past alert of the set of the past alerts, event data representing one or more events that have occurred in the managed network and contributed to triggering a corresponding past alert.

8. The system of claim 7 , wherein the event data for a past alert includes an Internet Protocol (IP) address of each computing device involved in the one or more events and a classification of the past alert.

9. The system of claim 1 , wherein the fields of the set of the past alerts include, for each past alert of the set of the past alerts, one or more of: a time at which the past alert was triggered, an identifier of the past alert, an identifier of an alert rule that triggered the past alert, a status of the past alert, and a severity rating of the past alert.

10. The system of claim 1 , wherein the fields of the security incident records include, for each security incident record of the security incident records, one or more of: a time at which the security incident record was created, an identifier of the security incident record, an identifier of a computing device with which the security incident record is associated, an identifier of a user with which the security incident record is associated, a status of the security incident record, a description of a security incident with which the security incident record is associated, a priority level of the security incident record, a category of the security incident record, and an enterprise impact rating associated with the security incident record.

11. A method

Assignees

• Servicenow Inc

Inventors

• Brotherton Thomas Woodley
• Madala Vamsi Krishna
• Chava Teja
• Ferguson John Gerald
• Haymar Hnin
• Cherian Betsy
• Watson Eun-Sook

Classifications

• H04L67/53

  using third party service providers · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L63/0281

  Proxies · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/0272

  Virtual private networks · CPC title