Configuring the generation of event data based on a triggering search query
View Patent ↗The disclosed embodiments provide a system that facilitates the processing of network data. During operation, the system provides a risk-identification mechanism for identifying a security risk from time-series event data generated from network packets captured by one or more remote capture agents distributed across a network. Next, the system provides a capture trigger for generating additional time-series event data from the network packets on the one or more remote capture agents based on the security risk, wherein the additional time-series event data includes one or more event attributes.
1. A computer-implemented method, comprising:
receiving input specifying a search query for time-series event data;
causing execution of the search query based on a recurring schedule to search time-series event data stored by a data storage server, the time-series event data generated, by a remote capture agent located in a computer network, based on network traffic monitored by the remote capture agent and involving at least one resource running in the computer network;
identifying, based on the execution of the search query, one or more events of the time-series event data stored by the data storage server satisfying the search query; and
in response to identifying the one or more events, sending configuration information to the remote capture agent, the configuration information causing the remote capture agent to generate additional time-series event data.
2. The computer-implemented method of claim 1 , wherein the configuration information causes the remote capture agent to disable the generation of the additional time-series event data after a specified period has passed.
3. The computer-implemented method of claim 1 , further comprising:
receiving input related the generation of the additional time-series event data by the remote capture agent; and
sending updated configuration information to the remote capture agent based on the received input.
4. The computer-implemented method of claim 1 , further comprising causing display of a graphical user interface (GUI) including interface elements used to receive the input specifying the search query.
5. The computer-implemented method of claim 1 , further comprising causing display of a graphical user interface (GUI) including interface elements used to receive input specifying the recurring schedule with which to cause execution of the search query.
6. The computer-implemented method of claim 1 , wherein the identified one or more events relate to a security risk.
7. The computer-implemented method of claim 1 , wherein the input specifying the search query includes identification of one or more event attributes contained in the time-series event data.
8. The computer-implemented method of claim 1 , wherein the remote capture agent is one of a plurality of remote capture agents located in the computer network.
9. The computer-implemented method of claim 1 , wherein the additional time-series event data comprises an event attribute associated with one or more protocols.
10. The computer-implemented method of claim 1 , wherein the input specifying the search query includes specification of a frequency with which to execute the search query.
11. An apparatus, comprising:
one or more processors; and
a non-transitory computer readable storage medium storing instructions which, when executed by the one or more processors, cause the apparatus to:
receive input specifying a search query for time-series event data;
cause execution of the search query based on a recurring schedule to search time-series event data stored by a data storage server, the time-series event data generated, by a remote capture agent located in a computer network, based on network traffic monitored by the remote capture agent and involving at least one resource running in the computer network;
identify, based on the execution of the search query, one or more events of the time-series event data stored by the data storage server satisfying the search query; and
in response to identifying the one or more events, send configuration information to the remote capture agent, the configuration information causing the remote capture agent to generate additional time-series event data.
12. The apparatus of claim 11 , where the configuration information causes the remote capture agent to disable the generation of the additional time-series event data after a specified period has passed.
13. The apparatus of claim 11 , wherein the storage medium further stores instructions which, when executed by the one or more processors, cause the apparatus to:
receive input related the generation of the additional time-series event data by the remote capture agent; and
send updated configuration information to the remote capture agent based on the received input.
14. The apparatus of claim 11 , wherein the storage medium further stores instructions which, when executed by the one or more processors, cause the apparatus to cause display of a graphical user interface (GUI) including interface elements used to receive the input specifying the search query.
15. The apparatus of claim 11 , wherein the storage medium further stores instructions which, when executed by the one or more processors, cause the apparatus to cause display of a graphical user interface (GUI) including interface elements used to receive input specifying the recurring schedule with which to cause execution of the search query.
16. The apparatus of claim 11 , wherein the identified one or more events related to a security risk.
17. The apparatus of claim 11 , wherein the input specifying the search query includes identification of one or more event attributes contained in the time-series event data.
18. The apparatus of claim 11 , wherein the remote capture agent is one of a plurality of remote capture agents located in the computer network.
19. The apparatus of claim 11 , wherein the additional time-series event data comprises an event attribute associated with one or more protocols.
20. The apparatus of claim 11 , wherein the input specifying the search query includes specification of a frequency with which to execute the search query.
21. A non-transitory computer-readable storage medium storing instructions which, when executed by one or more processors, cause performance of operations comprising:
receiving input specifying a search query for time-series event data;
causing execution of the search query based on a recurring schedule to search time-series event data stored by a data storage server, the time-series event data generated, by a remote capture agent located in a computer network, based on network traffic monitored by the remote capture agent and involving at least one resource running in the computer network;
identifying, based on the execution of the search query, one or more events of the time-series event data stored by the data storage server satisfying the search query; and
in response to identifying the one or more events, sending configuration information to the remote capture agent, the configuration information causing the remote capture agent to generate additional time-series event data.
22. The non-transitory computer-readable storage medium of claim 21 , wherein the configuration information causes the remote capture agent to disable the generation of the additional time-series event data after a specified period has passed.
23. The non-transitory computer-readable storage medium of claim 21 , wherein the instructions which, when executed by the one or more processors, further cause performance of operations comprising:
receiving input related the generation of the additional time-series event data by the remote capture agent; and
sending updated configuration information to the remote capture agent based on the received input.
24. The non-transitory computer-readable storage medium of claim 21 , wherein the instructions which, when executed by the one or more processors, further cause performance of operations comprising causing display of a graphical user interface (GUI) including interface elements used to receive the input specifying the search query.
25. The non-transitory computer-readable storage medium of claim 21 , wherein the instructions which, when executed by the one or more processors, further cause display of a graphical user interface (GUI) including interface elements used to receive input specifying the recurring schedule with which to cause execution of the search query.
26. The non-transitory computer-readable storage medium of claim 21 , wherein the identified one or more events relate to a security risk.
27. The non-transitory computer-readable storage medium of claim 21 , wherein the input specifying the search query includes identification of one or more event attributes contained in the time-series event data.
28. The non-transitory computer-readable storage medium of claim 21 , wherein the remote capture agent is one of a plurality of remote capture agents located in the computer network.
29. The non-transitory computer-readable storage medium of claim 21 , wherein the additional time-series event data comprises an event attribute associated with one or more protocols.
30. The non-transitory computer-readable storage medium of claim 21 , wherein the input specifying the search query includes specification of a frequency with which to execute the search query.