Locational tagging in a capture system
View Patent ↗A system and method for locational tagging in a capture system are described. Metadata associated with a captured object includes: information about a location in storage of an object and that objects association to a particular user; and/or tiered location information.
1. An article of manufacture including program code embodied on a memory which, when executed by a machine, causes the machine to perform a method, the method comprising:
maintaining a tiered location configuration for a capture system of a network having private internet protocol (IP) addresses, the capture system being configured for a network security application in which filtering occurs such that certain flows originated at a first computer are prohibited from reaching their originally intended destination;
maintaining a list of private internet protocol (IP) address relationships to tier location configuration values for the capture system;
capturing a packet with the capture system;
classifying the packet into a plurality of tiers included within the tiered location configuration by comparing source and destination IP addresses associated with the packet to a tier mapping element maintained by the capture system, and wherein a selected first one of tiers identifies a geographic characteristic associated with the packet, and a selected second one of the tiers identifies a separate location characteristic associated with the packet, and a selected third one of the tiers identifies a division of a company, and a selected fourth one of the tiers identifies a building from which the packet originated, wherein the tiered location configuration includes separate tiers having different levels of detail; and
receiving a search query specifying a selected one of the levels of detail associated with the tiered location configuration.
2. The article of manufacture of claim 1 , further comprising:
storing the tiered location configuration as a part of a metadata associated with the packet.
3. The article of manufacture of claim 1 , further comprising:
creating a tiered location configuration.
4. The article of manufacture of claim 1 , further comprising:
creating a list of internet protocol (IP) address relationships to tier location configuration values for the capture system.
5. The article of manufacture of claim 1 , wherein the tiered location configuration comprises:
four tiers, wherein each tier is of a different level of abstraction.
6. An article of manufacture including program code embodied on a memory which, when executed by a machine, causes the machine to perform a method, the method comprising:
initializing a log file, the log file to store internet protocol (IP) address assignment by MAC address;
reading the log to determine a relationship between an IP address and a user;
maintaining a tiered location configuration for a capture system of a network having private internet protocol (IP) addresses, the capture system being configured for a network security application in which filtering occurs such that certain flows originated at a first computer are prohibited from reaching their originally intended destination;
capturing a packet addressed to a particular IP address;
associating the packet to a user from the log, wherein the packet is classified within the tiered location configuration by comparing source and destination IP addresses associated with the packet to a tier mapping element maintained by the capture system, and wherein a selected first one of tiers identifies a geographic characteristic associated with the packet, and a selected second one of the tiers identifies a separate location characteristic associated with the packet, and a selected third one of the tiers identifies a division of a company, and a selected fourth one of the tiers identifies a building from which the packet originated, wherein the tiered location configuration includes separate tiers having different levels of detail; and
receiving a search query specifying a selected one of the levels of detail associated with the tiered location configuration.
7. The article of manufacture of claim 6 , further comprising:
storing an item associated with the packet in a storage system, wherein the item is associated with the user.
8. The article of manufacture of claim 7 , wherein the storage system is rolling storage.
9. The article of manufacture of claim 6 , wherein the log is a DHCP log.
10. A method comprising:
maintaining a tiered location configuration for a capture system of a network having private internet protocol (IP) addresses on a memory, the capture system being configured for a network security application in which filtering occurs such that certain flows originated at a first computer are prohibited from reaching their originally intended destination;
maintaining a list of private internet protocol (IP) address relationships to tier location configuration values for the capture system;
capturing a packet with the capture system;
classifying the packet into a plurality of tiers included within the tiered location configuration by comparing source and destination IP addresses associated with the packet to a tier mapping element maintained by the capture system, and wherein a selected first one of tiers identifies a geographic characteristic associated with the packet, and a selected second one of the tiers identifies a separate location characteristic associated with the packet, and a selected third one of the tiers identifies a division of a company, and a selected fourth one of the tiers identifies a building from which the packet originated, wherein the tiered location configuration includes separate tiers having different levels of detail; and
receiving a search query specifying a selected one of the levels of detail associated with the tiered location configuration.
11. The method of claim 10 , further comprising:
storing the tiered location configuration as a part of metadata associated with the packet.
12. The method of claim 10 , wherein the tiered location configuration comprises:
four tiers, wherein each tier is of a different level of abstraction.
13. A method comprising:
initializing a log file, the log file to store Internet protocol (IP) address assignment by MAC address on a memory;
reading the log to determine a relationship between an IP address and a user;
maintaining a tiered location configuration for a capture system of a network having private internet protocol (IP) addresses, the capture system being configured for a network security application in which filtering occurs such that certain flows originated at a first computer are prohibited from reaching their originally intended destination;
capturing a packet addressed to a particular IP address;
associating the packet to a user from the log, wherein the packet is classified within the tiered location configuration by comparing source and destination IP addresses associated with the packet to a tier mapping element maintained by the capture system, and wherein a selected first one of tiers identifies a geographic characteristic associated with the packet, and a selected second one of the tiers identifies a separate location characteristic associated with the packet, and a selected third one of the tiers identifies a division of a company, and a selected fourth one of the tiers identifies a building from which the packet originated, wherein the tiered location configuration includes separate tiers having different levels of detail; and
receiving a search query specifying a selected one of the levels of detail associated with the tiered location configuration.
14. The method of claim 13 , further comprising:
storing an item associated with the packet in a storage system, wherein the item is associated with the user.
15. The method of claim 14 , wherein the storage system is rolling storage.