Granted Patent B1

US 12,204,531 · App. 17/702,500 · Granted Jan 21, 2025

Inventor: Michael Dickey (Palo Alto, CA)

Assignee: Splunk Inc.

G06F16/245G06F16/24568

Abstract

Claims (49)

1. A computer-implemented method, comprising:

monitoring, by a remote capture agent, network packets traversing a network interface of a computing device in an information technology (IT) environment;

obtaining, by the remote capture agent from a configuration server, configuration information identifying a first network component to which the remote capture agent is to send timestamped events;

obtaining network data from the network packets;

generating a first plurality of timestamped events based on the network data;

sending the first plurality of timestamped events to the first network component for subsequent processing;

obtaining, by the configuration server from one or more applications running on one or more separate servers in communication with the configuration server, updated configuration information identifying a second network component to which the remote capture agent is to send timestamped events;

obtaining, by the remote capture agent from the configuration server, the updated configuration information identifying the second network component to which the remote capture agent is to send timestamped events;

generating a second plurality of timestamped events; and

sending the second plurality of timestamped events to the second network component for subsequent processing.

2. The method of claim 1 , wherein an event of the first plurality of timestamped events includes a field specified by the configuration information.

3. The method of claim 1 , wherein the updated configuration information specifies a second field to be included in timestamped events generated by the remote capture agent, and wherein the second plurality of timestamped events includes the second field.

4. The method of claim 1 , wherein the remote capture agent executes in a cloud computing system.

5. The method of claim 1 , wherein the remote capture agent monitors network packets traversing a plurality of network interfaces including the network interface.

6. The method of claim 1 , wherein the remote capture agent initiates generation of the first plurality of timestamped events responsive to identification of a potential security risk, and wherein the remote capture agent identifies the potential security risk based on network packets monitored by the remote capture agent.

7. The method of claim 1 , further comprising identifying network packets associated with a source specified by the configuration information, and wherein the network data is obtained from the network packets associated with the source.

8. The method of claim 1 , further comprising identifying a protocol used by the network packets, wherein the remote capture agent obtains network data from the network packets based on the protocol associated with the network packets.

9. The method of claim 1 , further comprising generating the first plurality of timestamped events based on a time interval specified by the configuration information.

10. The method of claim 1 , further comprising assembling the network packets into a packet flow, wherein the network data is obtained from the packet flow.

11. A computing device, comprising:

a processor; and

a non-transitory computer-readable medium having stored thereon instructions that, when executed by the processor, cause the processor to perform operations including:

monitoring, by a remote capture agent, network packets traversing a network interface of a computing device in an information technology (IT) environment;

obtaining, by the remote capture agent from a configuration server, configuration information identifying a first network component to which the remote capture agent is to send timestamped events;

obtaining network data from the network packets;

generating a first plurality of timestamped events based on the network data;

sending the first plurality of timestamped events to the first network component for subsequent processing;

obtaining, by the configuration server from one or more applications running on one or more separate servers in communication with the configuration server, updated configuration information identifying a second network component to which the remote capture agent is to send timestamped events;

obtaining, by the remote capture agent from the configuration server, the updated configuration information identifying the second network component to which the remote capture agent is to send timestamped events;

generating a second plurality of timestamped events; and

sending the second plurality of timestamped events to the second network component for subsequent processing.

12. The computing device of claim 11 , wherein an event of the first plurality of timestamped events includes a field specified by the configuration information.

13. The computing device of claim 11 , wherein the updated configuration information specifies a second field to be included in timestamped events generated by the remote capture agent, and wherein the second plurality of timestamped events includes the second field.

14. The computing device of claim 11 , wherein the remote capture agent executes in a cloud computing system.

15. The computing device of claim 11 , wherein the remote capture agent monitors network packets traversing a plurality of network interfaces including the network interface.

16. A non-transitory computer-readable medium having stored thereon instructions that, when executed by one or more processors, cause the one or more processors to perform operations including:

monitoring, by a remote capture agent, network packets traversing a network interface of a computing device in an information technology (IT) environment;

obtaining, by the remote capture agent from a configuration server, configuration information identifying a first network component to which the remote capture agent is to send timestamped events;

obtaining network data from the network packets;

generating a first plurality of timestamped events based on the network data;

sending the first plurality of timestamped events to the first network component for subsequent processing;

obtaining, by the configuration server from one or more applications running on one or more separate servers in communication with the configuration server, updated configuration information identifying a second network component to which the remote capture agent is to send timestamped events;

obtaining, by the remote capture agent from the configuration server, the updated configuration information identifying the second network component to which the remote capture agent is to send timestamped events;

generating a second plurality of timestamped events; and

sending the second plurality of timestamped events to the second network component for subsequent processing.

17. The non-transitory computer-readable medium of claim 16 , wherein an event of the first plurality of timestamped events includes a field specified by the configuration information.

18. The non-transitory computer-readable medium of claim 16 , wherein the updated configuration information specifies a second field to be included in timestamped events generated by the remote capture agent, and wherein the second plurality of timestamped events includes the second field.

19. The non-transitory computer-readable medium of claim 16 , wherein the remote capture agent executes in a cloud computing system.

20. The non-transitory computer-readable medium of claim 16 , wherein the remote capture agent monitors network packets traversing a plurality of network interfaces including the network interface.

Assignments (4)

Continuity (2)

References Cited (400)