Security event transformation and logging systems and methods

Patent metadata

Field	Value
Publication number	US-12368728-B2
Application number	US-202218071349-A
Country	US
Kind code	B2
Filing date	Nov 29, 2022
Priority date	Nov 29, 2022
Publication date	Jul 22, 2025
Grant date	Jul 22, 2025

Abstract

Embodiments provide systems and methods for logging events. A computer-implemented method comprises receiving input for selecting one or more event types to receive from an event collector, receiving, based on the one or more event types, a plurality of security events from the event collector, transforming each of the plurality of security events to a standard format to generate a plurality of formatted security events and transmitting the plurality of formatted security events to a security information and event management (SIEM) server.

First claim

What is claimed is:

1. A system for security event transformation, the system comprising:
a processor;
a non-transitory computer-readable medium; and
stored instructions translatable by the processor for:
at a security event receiver:
receiving a plurality of security events of different formats from an event collector;
selecting, from the plurality of security events based on one or more criteria, security events of interest; and
forwarding the security events of interest to a security event transformer;

at the security event transformer:
receiving the security events of interest from the security event receiver; and
transforming each of the security events of interest to a standard event format so as to generate a plurality of formatted security events processable by a security information and event management (SIEM) server; and

at a security event transmitter coupled to the security event transformer:
receiving the plurality of formatted security events from the security event transformer; and
transmitting the plurality of formatted security events to the SIEM server for processing the plurality of formatted security events agnostic to the different formats.

2. The system of claim 1 , wherein the plurality of security events is pushed from the event collector to the security event receiver.

3. The system of claim 1 , wherein the plurality of security events is fetched from the event collector by the security event receiver.

4. The system of claim 3 , wherein the security event receiver further receives input for a fetch time interval, the security event receiver fetching events at every fetch time interval and forwarding to the security event transformer.

5. The system of claim 1 , wherein the event collector collects a corpus of endpoint events from a plurality of endpoints coupled over a network to the event collector, the security event receiver receiving the endpoint events.

6. The system of claim 1 , wherein the event collector collects a corpus of events, the system further comprising a Security Event Application Programming Interface (Security Event API) coupled between the event collector and the security event receiver, the Security Event API receiving input for one or more event subscriptions, each of the one or more event subscriptions describing attributes of events within the corpus of events to receive, transform, and transfer to the SIEM server.

7. The system of claim 1 , wherein the SIEM server comprises a plurality of SIEM servers, and wherein the standard event format is a universal event format processable by the plurality of SIEM servers.

8. A method for security event transformation, the method comprising:
at a security event receiver:
receiving a plurality of security events of different format from an event collector;
selecting, from the plurality of security events based on one or more criteria, security events of interest; and
forwarding the security events of interest to a security event transformer;

at the security event transformer:
receiving the security events of interest from the security event receiver; and
transforming each of the security events of interest to a standard event format so as to generate a plurality of formatted security events processable by a security information and event management (SIEM) server; and

at a security event transmitter coupled to the security event transformer:
receiving the plurality of formatted security events from the security event transformer; and
transmitting the plurality of formatted security events to the SIEM server for processing the plurality of formatted security events agnostic to the different formats.

9. The method of claim 8 , wherein receiving the plurality of security events from the event collector further comprises:
pushing the plurality of security events from the event collector.

10. The method of claim 8 , wherein receiving the plurality of security events from the event collector further comprises:
fetching the plurality of security events from the event collector.

11. The method of claim 10 , further comprising:
receiving input for a fetch time interval; and
fetching events from the event collector at the fetch time interval.

12. The method of claim 8 , further comprising:
collecting, by the event collector, a corpus of endpoint events from a plurality of endpoints coupled over a network to the event collector; and
receiving, by the security event receiver, the endpoint events.

13. The method of claim 8 , further comprising:
collecting, by the event collector, a corpus of events from a plurality of endpoints coupled over a network to the event collector;
receiving input for one or more event subscriptions, each of the one or more event subscriptions describing attributes of events within the corpus of events; and
receiving, based at least on the one or more event subscriptions, a plurality of security events from the event collector.

14. The method of claim 8 , wherein the SIEM server comprises a plurality of SIEM servers, and wherein the standard event format is a universal event format processable by the plurality of SIEM servers.

15. A computer program product comprising a non-transitory computer-readable medium storing instructions translatable by a processor for:
at a security event receiver:
receiving a plurality of security events of different format from an event collector;
selecting, from the plurality of security events based on one or more criteria, security events of interest; and
forwarding the security events of interest to a security event transformer;

at the security event transformer:
receiving the security events of interest from the security event receiver; and
transforming each of the security events of interest to a standard event format so as to generate a plurality of formatted security events processable by a security information and event management (SIEM) server; and

at a security event transmitter coupled to the security event transformer:
receiving the plurality of formatted security events from the security event transformer; and
transmitting the plurality of formatted security events to the SIEM server for processing the plurality of formatted security events agnostic to the different formats.

16. The computer program product of claim 15 , wherein receiving the plurality of security events from the event collector further comprises:
pushing the plurality of security events from the event collector.

17. The computer program product of claim 15 , wherein receiving the plurality of security events from the event collector further comprises:
fetching the plurality of security events from the event collector by the security event receiver.

18. The computer program product of claim 17 , wherein the instructions are further translatable by the processor for:
receiving input for a fetch time interval; and
fetching events from the event collector at the fetch time interval.

19. The computer program product of claim 15 , wherein the instructions are further translatable by the processor for:
collecting, by the event collector, a corpus of endpoint events from a plurality of endpoints coupled over a network to the event collector; and
receiving, by the security event receiver, the endpoint events.

20. The computer program product of claim 15 , wherein the instructions are further translatable by the processor for:
collecting, by the event collector, a corpus of events from a plurality of endpoints coupled over a netwo

Assignees

• Webroot Inc
• Open Text Inc

Inventors

• Goknel Niyazi Eray
• Fellner Paul
• Mayr Johannes
• Ahmed Aqil

Classifications

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title