Analysis of event information to perform contextual audit
View Patent ↗Analysis of audit information that takes into account a wide context allows for a rich picture from which system conditions may be assessed. Event information about various events that have occurred or are occurring, on various sources in the computing arrangement, is maintained. Each entity has an “activity identifier”, which remains the same across various events performed by that entity at the various sources. Event information associated with the various sources is contextually analyzed on the basis of the activity identifier, to assess whether a condition exists that impacts the performance and/or security of the computing arrangement. In case it is determined that such a condition exists, an action is performed to remediate the condition.
1. A method of assessing the existence of a condition that has an impact on performance or security of a computing arrangement, the method comprising:
receiving, at a first device, event information from a plurality of sources, said plurality of sources comprising a first source and a second source, said first and second sources requiring sign-on by an entity in order to be used, said event information comprising a plurality of events, each of said plurality of events having an identifier tied to the respective sign-on, said identifier being created at time of a sign-on into said computing arrangement, said identifier being identical for said plurality of events performed by said entity across various sources in said computing arrangement, said event information including information generated by said first source and by said second source;
analyzing said event information at said first device;
determining that said condition exists based on said analyzing, said determining being based at least in part on a finding that said plurality of events originating from said first and second source pertain to the same entity, said finding being made based on said identifier being the same in each of said two events; and
performing at least one action to remediate said condition.
2. The method of claim 1 , said analyzing taking into account a timestamp associated with each of said plurality of events.
3. The method of claim 1 , said analyzing taking into account the identity of the source associated with each event.
4. The method of claim 1 , said analyzing taking into account the identity of a remote machine from which said entity was connected to said first device when each of said plurality of events was generated.
5. The method of claim 1 , said events being generated by both trusted and non-trusted sources, and said analyzing taking into account whether a given event was generated by a trusted or non-trusted source.
6. The method of claim 1 , said analyzing taking into account information about events that are occurring or have occurred at devices, within said computing arrangement, other than said first device.
7. The method of claim 1 , said performing at least one action to remediate said condition comprising notifying a human administrator that said condition exists.
8. The method of claim 1 , said computing arrangement being said first device.
9. The method of claim 1 , said computing arrangement comprising a network of connected computing devices including said first device.
10. A system for assessing whether a condition exists that has an impact on performance or security of a computing arrangement, the system comprising:
one or more processors;
one or more data remembrance devices;
an analysis module that is stored in at least one of said data remembrance devices and executable on at least one of said one or more processors, said analysis module receiving event information from a plurality of sources, the plurality of sources comprising a first source and a second source, said first and second sources requiring sign-on by an entity in order to be used, said event information comprising a plurality of events, each of said plurality of events having an identifier tied to the respective sign-on, said identifier being created at time of a sign-on into said computing arrangement, said identifier being identical for said plurality of events performed by said entity across various sources in said computing arrangement, said event information including information generated by said first source and by said second source;
said analysis module further analyzes event information occurring at said first device, said analysis module determining whether said condition exists based analysis of the event information including a finding that two different events originating from said first and second source pertain to the same entity, said finding being made based on said identifier being the same in each of said two events; and
a remediation module that performs at least one action to remediate the condition if the condition exists.
11. The system of claim 10 , said events being generated by both trusted and non-trusted sources, and said analysis module taking into account whether a given event was generated by a trusted or non-trusted source.
12. The system of claim 10 , said analysis module taking into account information about events that are occurring or have occurred at devices, within said computing arrangement, other than said first device.
13. The system of claim 10 , the remediation module notifying a human administrator that said condition exists.
14. The system of claim 10 , said computing arrangement being said first device.
15. The method of claim 10 , said computing arrangement comprising a network of connected computing devices including said first device.
16. One or more computer-readable storage devices encoded with computer-executable instructions to perform a method of assessing the existence of a condition that has an impact on performance or security of a computing arrangement, the method comprising:
receiving, at a first device, event information from a plurality of sources, the plurality of sources comprising a first source and a second source, said first and second sources requiring sign-on by an entity in order to be used, said identifier is being created at time of a sign-on into said computing arrangement, said event information comprising a plurality of events, each of said plurality of events having an identifier tied to the respective sign-on, said identifier being identical for said plurality of events performed by said entity across various sources in said computing arrangement, said event information including information generated by said first source and by said second source;
analyzing said event information at said first device;
determining that said condition exists based on said analyzing, said determining being based at least in part on a finding that said plurality of events originating from said first and second source pertain to the same entity, said finding being made based on said identifier being the same in each of said two events; and
performing at least one action to remediate said condition.
17. The one or more computer-readable storage devices of claim 16 , said analyzing taking into account a timestamp associated with each of said plurality of events.
18. The one or more computer-readable storage devices of claim 16 , said analyzing taking into account the identity of a remote machine from which said entity was connected to said first device when each of said plurality of events was generated.
19. The one or more computer-readable storage devices of claim 16 , said events being generated by both trusted and non-trusted sources, and said analyzing taking into account whether a given event was generated by a trusted or non-trusted source.
20. The one or more computer-readable storage devices of claim 16 , said analyzing taking into account information about events that are occurring or have occurred at devices, within said computing arrangement, other than said first device.