Automated local exception rule generation system, method and computer program product
View Patent ↗A system, method and computer program product are provided for automatically generating a rule exception. An event is identified that at least potentially violates a rule. Thereafter, an exception to the rule is automatically generated.
1. A method, comprising:
receiving, by a processor in a computer system, an event associated with an operation of the computer system, the event having one or more aspects;
comparing at least one of the event's aspects to a database comprising rules;
identifying one or more rules from the database based on the act of comparing the at least one aspect of the event to the database's rules information;
making a preliminary determination that the event violates at least one of the identified one or more rules;
determining that a preliminarily violated rule has one or more preconditions to a final determination regarding a rule violation;
collecting information associated with the event;
automatically analyzing the preconditions based on the one or more aspects of the event and the collected information; and
storing the the result of the analysis in a memory.
2. The method of claim 1 , wherein the preliminarily violated rule includes an intrusion detection rule.
3. The method of claim 1 , wherein the step of determining that the preliminarily violated rule has preconditions to a final determination regarding a rule violation is based at least in part on a type of the violation.
4. The method of claim 1 , wherein the collected information includes an identifier associated with the rule.
5. The method of claim 1 , wherein the collected information is used to limit a scope of the preconditions.
6. The method of claim 1 , wherein the preconditions only apply to the computer system.
7. The method of claim 1 , further comprising the step of sending a notification to a user upon the step of analyzing the preconditions.
8. The method of claim 1 , further comprising the act of allowing a user to negate any use of the analysis in making a final determination regarding a rule violation.
9. The method of claim 1 , wherein the preconditions apply to computer systems other than the computer system to which the event is associated.