Event evaluation pipeline for alert engine
Provided is a way of evaluating rules/conditions that span different domain entities against a set of disparate events from multiple sources that have occurred within a specific window or interval of time from the current time back to a specific time in the past. Events are stored in dedicated storage to enable an extended window of time to be used for multiple event evaluation. Only relevant event/rule pairs are evaluated. The system will record when an event relevant to a rule happens. When a second event that is relevant to the rule happens, the system checks the records to see if a previous relevant event had happened in the past that would cause the rule to trigger an alert. A mechanism is also provided for evaluating static state in combination with changed properties.
1. A method for evaluating events related to an electronic device, the method comprising:
receiving a stream of pre-filtered events each of which is matched with a corresponding rule;
determining that a first of the events satisfies a condition of its corresponding rule;
creating a document that includes said first event, an indication of its corresponding rule, and an expiry time measured from said first event;
storing the document in a non-volatile storage;
determining that a second of the events satisfies another condition of the rule corresponding to said first event before the expiry time;
adding said second event to the document and an indication that said other condition is satisfied; and
taking a security action in relation to the electronic device.
2. A method for evaluating events related to an electronic device, the method comprising:
analyzing a stream of pre-filtered events until a first of said events satisfies a condition of a rule corresponding to said first event;
creating a document that includes said first event, an identification of the rule, and an expiry time defined in the rule and measured from said first event;
storing the document in a non-volatile storage;
continuing to analyze said events until either (a) a second of the events satisfies another condition of the rule before the expiry time or (b) the expiry time has passed;
in the case of (a), adding said second event to the document and an indication that said other condition is satisfied, taking a security action in relation to the electronic device, and deleting the document;
in the case of (b), deleting the document and repeating the method with subsequent pre-filtered events.