Aggregating network security data for export

Patent metadata

Field	Value
Publication number	US-11223640-B2
Application number	US-201916418657-A
Country	US
Kind code	B2
Filing date	May 21, 2019
Priority date	May 3, 2017
Publication date	Jan 11, 2022
Grant date	Jan 11, 2022

Abstract

Systems and methods are disclosed for computing network operations. For example, methods may include receiving, at a computing device located within a private network, a message sent from a server located outside of the private network, the message including an observable; invoking, within the private network, a search of data associated with the private network to obtain a search result that includes data matching the observable; aggregating, within the private network, data from the search result that matches the observable to obtain a report that includes an indication of the observable, a count of occurrences of the observable, and identification of one or more components associated with the observable; and transmitting the report to the server.

First claim

What is claimed is:

1. A tangible, non-transitory, and machine-readable medium, comprising machine-readable instructions stored thereon that, when executed, cause a processor to:
transmit a message to a component of a private network, wherein the message includes an observable that comprises data representing properties, events, or both related to an operation of a network, a network-connected device, or both;
receive a report based on a search of data associated with the private network, wherein the report includes an identification of one or more components associated with the observable, wherein the report is generated in response to the message, wherein the one or more components comprise one or more software components of the private network, one or more hardware components of the private network, or any combination thereof, and wherein the report omits sensitive data identified as desirable to remain in the private network; and
store data associating the one or more components with the observable.

2. The tangible, non-transitory, and machine-readable medium of claim 1 , comprising machine-readable instructions stored thereon that, when executed, cause the processor to:
identify a relationship between the one or more components and a security incident based on an association between the one or more components and the observable; and
present, via a graphical user interface, a priority associated with at least the security incident and to present the relationship between the one or more components and the security incident.

3. The tangible, non-transitory, and machine-readable medium of claim 1 , comprising machine-readable instructions stored thereon that, when executed, cause the processor to:
receive a count of occurrences of the observable via the report; and
determine a score indicative of an impact of a security incident based on the count of occurrences, wherein the observable is associated with security incident.

4. The tangible, non-transitory, and machine-readable medium of claim 3 , comprising machine-readable instructions stored thereon that, when executed, cause the processor to:
determine the score based at least in part on a linear combination of the count of occurrences.

5. The tangible, non-transitory, and machine-readable medium of claim 4 , wherein the score is based at least in part on a weight indicating relative importance of computing resources impacted by the security incident associated with the observable.

6. The tangible, non-transitory, and machine-readable medium of claim 1 , wherein the report includes timestamps for respective occurrences of the observable.

7. The tangible, non-transitory, and machine-readable medium of claim 1 , wherein the report includes a histogram of occurrences of the observable bucketed by time intervals.

8. The tangible, non-transitory, and machine-readable medium of claim 1 , wherein the one or more components associated with the observable include a host that is associated with a configuration item maintained by a server.

9. The tangible, non-transitory, and machine-readable medium of claim 1 , wherein the report comprises an indication of the observable and a count of occurrences of the observable.

10. A method for obtaining from a private network, information relevant to network security incidents via a server located outside the private network, the method comprising:
transmitting a message including an observable to initiate a search of private network data of the private network, wherein the observable comprises data representing properties, events, or both related to an operation of the private network, a network-connected device of the private network, or both;
receiving a report based at least in part on the search of the private network data performed in response to the message, wherein the report includes an identification of one or more components associated with the observable, wherein the one or more components correspond to one or more computing resources of the private network, and wherein the report omits sensitive data identified as desirable to remain in the private network; and
storing data associating the one or more components with the observable.

11. The method of claim 10 , comprising:
determining a network event corresponding to the observable; and
determining a relationship between the one or more components and the network event based on the identification of the one or more components associated with the observable.

12. The method of claim 11 , comprising:
receiving a count of occurrences of the observable; and
determining a score based at least in part on relative weightings associated with the one or more components, wherein the score indicates an impact of the network event on the private network.

13. The method of claim 11 , comprising:
receiving a count of occurrences of the observable; and
determining a score based at least in part on a linear combination of the count of occurrences, wherein the score indicates an impact of the network event on the private network.

14. A system operable to gather information relevant to a network security incident, the system comprising:
a network interface that is connected to a first network, wherein the first network is communicatively coupled to, but outside of, a private network;
a memory; and
a processor, wherein the memory includes instructions executable by the processor to cause the system to:
transmit, via the network interface, a message to a device of the private network, wherein the message includes an observable, and wherein the observable comprises data representing properties or events related to an operation of a network, a network-connected device, or both;
receive, via the network interface, a report generated based on a search of data associated with the private network, wherein the report includes an identification of one or more components associated with the observable, wherein the search of data is configured to be performed in response to the message, wherein the one or more components comprise one or more software components of the private network, one or more hardware components of the private network, or any combination thereof, and wherein the report omits sensitive data identified as desirable to remain in the private network; and
store, in the memory, data associating the one or more components with the observable.

15. The system of claim 14 , wherein the memory includes instructions executable by the processor to cause the system to:
receive a count of occurrences of the observable in the data associated with the private network; and
determine a score based at least in part on the count of occurrences and the identification of the one or more components associated with the observable.

16. The system of claim 14 , wherein the memory includes instructions executable by the processor to cause the system to:
present information about the network security incident that is associated with the observable; and
receive a command to perform the search of data based on the observable, wherein the message is transmitted in response to the command.

17. The system of claim 14 , wherein the memory includes instructions executable by the processor to cause the system to:
receive an alert based on network security threat information shared among a group of associated private networks that includes the private network, wherein the alert includes the observable, and wherein the message is transmitted in response to the alert.

18. The system of claim 14 , comprising a configuration

Assignees

• Servicenow Inc

Inventors

• Zettel Ii Kurt Joseph
• Reybok Jr Richard
• Dicorpo Phillip
• Allen Simon N
• Sharma Amit
• Tamir Giora

Classifications

• H04L63/1433

  Vulnerability analysis · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• H04L43/062

  related to network traffic · CPC title

• G06F16/951

  Indexing; Web crawling techniques · CPC title