IP Library Granted Patent US 9,026,646
Granted Patent B2
US 9,026,646 · App. 13/235,141 · Granted May 5, 2015

Methods and apparatus for remediating policy test failures, including correlating changes to remediation processes

Inventors: David Whitlock (Portland, OR); Guy Gascoigne-Piggford (Portland, OR); Geoff Granum (Portland, OR); Mark Petrie (Portland, OR)
Assignee: Tripwire, Inc.
H04L12/00H04L41/0681H04L41/0695H04L41/0654G06F11/0793H04L63/1416G06F11/30
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 9,026,646
App. No.
13/235,141
Granted
May 5, 2015
Kind
B2
Abstract

Disclosed herein are methods, systems, and articles associated with correlating detected changes within a computer network with remediation processes performed in response to policy test failures. In embodiments, on determination that a failure of a policy test has occurred within a computer network having a number of nodes, a remediation process may be executed to remediate the failure. Change at a node may be detected. Further, the detected change may be correlated with the execution of the remediation process, and the correlation may be identified.

Claims (44)

1. A method comprising:

detecting, by a computing device, a change at a node within a computer network having a plurality of nodes, wherein the change occurred in response to execution of a remediation process in the computer network, wherein the remediation process was performed to remediate an earlier failure of a policy test in the computer network, and wherein the detecting is performed in response to the performance of the remediation process;

correlating, by the computing device, the detected change as having been in response to the execution of the remediation process; and

identifying, by the computing device, the detected change as being correlated with the execution of the remediation process so that the detected change is not treated as a further policy test failure.

2. The method of claim 1 , further comprising executing, by the computing device, the remediation process prior to the detecting, correlating, and identifying, the executing including executing a remediation script.

3. The method of claim 1 , wherein correlating the detected change comprises correlating the detected change with a remediation approval identification (ID) or an ID of a remediation work order, wherein the remediation approval ID and the ID of a remediation work order are related to execution of a remediation script.

4. The method of claim 3 , wherein the remediation approval ID and the ID of a remediation work order are the same.

5. The method of claim 1 , wherein detecting a change at a node within the computer network comprises:

determining a pre-remediation state of the node, prior to execution of the remediation process;

subsequent to executing the remediation process, determining a post-remediation state of the node; and

comparing the pre-remediation state with the post-remediation state.

6. The method of claim 1 , detecting a change at a node within a computer network comprises: compiling, by the computing device, a list of one or more nodes of the computer network, whose respective one or more states have changed.

7. The method of claim 6 , wherein correlating the detected change comprises correlating the detected changes with respect to the list of one or more nodes whose respective one or more states have changed with a remediation approval identifications (ID) or an ID of a remediation work order, wherein the remediation approval ID and the ID of the remediation work order are related to execution of the remediation process.

8. The method of claim 7 , wherein identifying the detected change as correlated with execution of the remediation process comprises identifying the list of one or more nodes as correlated with execution of the remediation process.

9. An article of manufacture comprising:

a non-transitory computer-readable storage medium; and

a plurality of programming instructions stored on the storage medium and configured to program one or more computing devices, in response to execution of the programming instructions, to perform operations including:

detecting a change at a node within a computer network having a plurality of nodes, wherein the change occurred in response to execution of a remediation process in the computer network, wherein the remediation process was performed to remediate an earlier failure of a policy test in the computer network, and wherein the detecting is performed in response to the performance of the remediation process;

correlating the detected change as having been in response to the execution of the remediation process; and

identifying the detected change as being correlated with the execution of the remediation process and consequently not treating the detected change as a further policy test failure.

10. The article of manufacture of claim 9 , wherein correlating the detected change comprises: correlating the detected change with a remediation approval identification (ID) or an ID of a remediation work order, wherein the remediation approval ID and the ID of a remediation work order are related to execution of a remediation script.

11. The article of manufacture of claim 10 , wherein the remediation approval ID and the ID of a remediation work order are the same.

12. The article of manufacture of claim 9 , wherein detecting a change at a node within the computer network comprises:

determining a pre-remediation state of the node, prior to execution of the remediation process;

subsequent to executing the remediation process, determining a post-remediation state of the node; and

comparing the pre-remediation state with the post-remediation state.

13. The article of manufacture of claim 9 , wherein detecting a change at a node within the computer network comprises:

compiling a list of one or more nodes of the computer network, whose respective one or more states have changed.

14. The article of manufacture of claim 13 , wherein correlating the detected change comprises:

correlating the detected change with respect to the list of one or more nodes whose respective one or more states have changed with a remediation approval identification (ID) or an ID of a remediation work order, wherein the remediation approval ID and the ID of a remediation work order are related to execution of the remediation process.

15. The article of manufacture of claim 14 , wherein identifying the detected change comprises:

identifying the list of one or more nodes as correlated with the remediation process.

16. The article of manufacture of claim 9 , wherein the operations further comprise executing the remediation process prior to the detecting, correlating, and identifying, the executing including executing a remediation script.

17. An apparatus comprising:

one or more processor; and

a non-transitory computer-readable storage medium coupled with the one or more processors, and having stored therein a plurality of programming configured to enable the apparatus, in response to execution of the programming instructions, to

detect a change at a node within a computer network having a plurality of nodes, wherein the change occurred in response to execution of a remediation process in the computer network, wherein the remediation process was performed to remediate a failure of a policy test in the computer network, and wherein the detection is performed in response to the performance of the remediation process;

correlate the detected change as having been in response to the execution of the remediation process; and

identify the detected change as being correlated with execution of the remediation process so that the detected change is not treated as a further policy test failure.

18. The apparatus of claim 17 , wherein correlate the detected change comprises:

correlate the detected change with a remediation approval identification (ID) or an ID of a remediation work order, wherein the remediation approval ID and the ID of a remediation work order are related to execution of a remediation script.

19. The apparatus of claim 17 , wherein detect a change at a node within the computer network comprises:

compile a list of one or more nodes of the computer network, whose respective one or more states have changed.

20. The apparatus of claim 17 , wherein the programming instructions are further configured to enable the apparatus, in response to execution of the programming instructions, to perform the remediation process, including execution of a remediation script.

Assignments (13)
SECURITY INTEREST Recorded Jan 6, 2026
From: ALERT LOGIC, INC.; DIGITAL GUARDIAN LLC; ECRIME MANAGEMENT STRATEGIES, INC.; FORTRA, LLC; GLOBALSCAPE, INC.; TRIPWIRE, INC.
To: ACQUIOM AGENCY SERVICES LLC, AS COLLATERAL AGENT
Reel/Frame 074233/0632 →
TERMINATION AND RELEASE OF SECOND LIEN INTELLECTUAL PROPERTY SECURITY INTEREST RECORDED AT REEL/FRAME 60306/0365 Recorded Nov 24, 2025
From: JEFFERIES FINANCE LLC
To: TRIPWIRE, INC.
Reel/Frame 074023/0235 →
TERMINATION AND RELEASE OF FIRST LIEN INTELLECTUAL PROPERTY SECURITY INTEREST RECORDED AT REEL/FRAME 60306/0555 Recorded Nov 24, 2025
From: JEFFERIES FINANCE LLC
To: TRIPWIRE, INC.
Reel/Frame 074023/0320 →
EXTENDED RCF FIRST LIEN INTELLECTUAL PROPERTY SECURITY AGREEMENT Recorded Nov 21, 2025
From: TRIPWIRE, INC.
To: JEFFERIES FINANCE LLC, AS COLLATERAL AGENT
Reel/Frame 073663/0639 →
TERMINATION AND RELEASE OF SECOND LIEN INTELLECTUAL PROPERTY SECURITY INTEREST RECORDED AT REEL/FRAME 60306/0649 Recorded Nov 21, 2025
From: ACQUIOM AGENCY SERVICES LLC
To: TRIPWIRE, INC.
Reel/Frame 073663/0698 →
EXTENDED FIRST LIEN INTELLECTUAL PROPERTY SECURITY AGREEMENT Recorded Nov 21, 2025
From: TRIPWIRE, INC.
To: JEFFERIES FINANCE LLC, AS COLLATERAL AGENT
Reel/Frame 073664/0124 →
NEW MONEY FIRST LIEN INTELLECTUAL PROPERTY SECURITY AGREEMENT Recorded Nov 21, 2025
From: ALERT LOGIC, INC.; DIGITAL GUARDIAN LLC; ECRIME MANAGEMENT STRATEGIES, INC.; FORTRA, LLC; GLOBALSCAPE, INC.; TRIPWIRE, INC.; VERA SECURITY, INC.
To: ARES CAPITAL CORPORATION, AS COLLATERAL AGENT
Reel/Frame 073683/0534 →
ASSIGNMENT OF INTELLECTUAL PROPERTY SECURITY AGREEMENT Recorded Aug 14, 2025
From: GOLUB CAPITAL MARKETS LLC (AS EXISTING AGENT)
To: ACQUIOM AGENCY SERVICES LLC (AS SUCCESSOR COLLATERAL AGENT)
Reel/Frame 072471/0665 →
FIRST LIEN INTELLECTUAL PROPERTY SECURITY AGREEMENT Recorded Jun 7, 2022
From: TRIPWIRE, INC.
To: JEFFERIES FINANCE LLC, AS COLLATERAL AGENT
Reel/Frame 060306/0365 →
SECOND LIEN INTELLECTUAL PROPERTY SECURITY AGREEMENT Recorded Jun 7, 2022
From: TRIPWIRE, INC.
To: GOLUB CAPITAL MARKETS LLC, AS COLLATERAL AGENT
Reel/Frame 060306/0649 →
RELEASE OF SECURITY INTEREST Recorded Feb 2, 2015
From: ARES CAPITAL CORPORATION, AS COLLATERAL AGENT
To: TRIPWIRE, INC.; NCIRCLE NETWORK SECURITY INC.
Reel/Frame 034874/0150 →
SECURITY AGREEMENT Recorded Apr 2, 2013
From: TRIPWIRE, INC.; NCIRCLE NETWORK SECURITY, INC.
To: ARES CAPITAL CORPORATION, AS COLLATERAL AGENT
Reel/Frame 030132/0101 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jan 30, 2012
From: WHITLOCK, DAVID; GASCOIGNE-PIGGFORD, GUY; GRANUM, GEOFF; PETRIE, MARK
To: TRIPWIRE, INC.
Reel/Frame 027618/0575 →
Continuity (1)
Related Publication 20130073715A1 · Mar 21, 2013