IP Library › Granted Patent US 12,074,901

Granted Patent B1

US 12,074,901 · App. 18/177,620 · Granted Aug 27, 2024

Security action verification in a computing network

Inventors: Sourabh Satish (Fremont, CA); Oliver Friedrichs (Woodside, CA); Atif Mahadik (Fremont, CA); Govind Salinas (Sunnyvale, CA)

Assignee: Splunk Inc.

H04L63/1433 H04L63/14 H04L63/1441 H04L63/20 G06F21/577

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 12,074,901
App. No.: 18/177,620
Granted: Aug 27, 2024
Kind: B1

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

Systems, methods, and software described herein provide for validating security actions before they are implemented in a computing network. In one example, a computing network may include a plurality of computing assets that provide a variety of different operations. During the operations of the network, administration systems may generate and provide security actions to prevent or mitigate the effect of a security threat on the network. However, prior to implementing the security actions within the network, computing assets may exchange security parameters with the administration systems to verify that the security actions are authentic.

Claims (61)

1. A computer-implemented method comprising:

identifying a security threat in a computing network monitored by an administration system for instances of security threats;

identifying a first security action to execute at a first computing asset of the computing network and a second security action to execute at a second computing asset of the computing network, wherein each of the first security action and the second security action are specified using a unified security language supported by the administration system, wherein each of the first security action and the second security action, when executed, mitigates an effect of the security threat in the computing network, and wherein the first security action includes one or more of: blocking an internet protocol (IP) address, removing a process from the first computing asset, segregating the first computing asset from other computing assets in the computing network, or preventing access to the first computing asset by a user;

in response to identifying the first security action to execute at the first computing asset and the second security action to execute at the second computing asset, causing a credential interface to be displayed;

receiving, by the administration system via the credential interface, first credentials associated with the first computing asset, wherein the first computing asset is a first type of computing asset;

receiving, by the administration system via the credential interface, second credentials associated with the second computing asset, wherein the second computing asset is a second type of computing asset that is different from the first type of computing asset;

sending, by the administration system to the first computing asset, a first request to execute the first security action, wherein the first request includes the first credentials associated with the first computing asset;

sending, by the administration system to the second computing asset, a second request to execute the second security action, wherein the second request includes the second credentials associated with the second computing asset;

authorizing, by the first computing asset, the first credentials associated with the first computing asset to enable the first computing asset to determine that the first security action is permitted; and

authorizing, by the second computing asset, the second credentials associated with the second computing asset to enable the second computing asset to determine that the second security action is permitted.

2. The method of claim 1 , further comprising:

translating, by the administration system, the first security action into a first one or more operations to be performed by the first computing asset, wherein the first security action is translated into the first one or more operations based on the first type of computing asset associated with the first computing asset; and

translating, by the administration system, the second security action into a second one or more operations to be performed by the second computing asset, wherein the second security action is translated into the second one or more operations based on the second type of computing asset associated with the second computing asset.

3. The method of claim 1 , wherein the first request includes a digital signature identifying the administration system as a source of the first request.

4. The method of claim 1 , further comprising:

receiving, by the administration system, input requesting to execute the first security action, wherein the input is associated with a user of the administration system; and

generating, by the administration system, a digital signature indicating approval by the user to execute the first security action, wherein the first request includes the digital signature.

5. The method of claim 1 , wherein the first security action is identified by the administration system based on a type of the security threat.

6. The method of claim 1 , wherein the first credentials include a first username and a first password associated with the first computing asset, and wherein the second credentials include a second username and a second password associated with the second computing asset.

7. The method of claim 1 , wherein each of the first computing asset and the second computing asset comprises at least one of: a firewall, a server, an end user computing system, a virtual machine, or a router.

8. The method of claim 1 , further comprising receiving, from the first computing asset, a response indicating that the first computing asset successfully executed the first security action using the first credentials.

9. The method of claim 1 , further comprising causing display of a graphical user interface including information about the first credentials, the first computing asset, the second credentials, and the second computing asset.

10. A computing device, comprising:

a processor; and

a non-transitory computer-readable medium having stored thereon instructions that, when executed by the processor, cause the processor to perform operations including:

identifying a security threat in a computing network monitored by an administration system for instances of security threats;

11. The computing device of claim 10 , wherein the instructions, when executed by the processor, further cause the processor to perform operations including:

12. The computing device of claim 10 , wherein the first request includes a digital signature identifying the administration system as a source of the first request.

13. The computing device of claim 10 , wherein the instructions, when executed by the processor, further cause the processor to perform operations including:

receiving, by the administration system, input requesting to execute the first security action, wherein the input is associated with a user of the administration system; and

generating, by the administration system, a digital signature indicating approval by the user to execute the first security action, wherein the first request includes the digital signature.

14. The computing device of claim 10 , wherein the first security action is identified by the administration system based on a type of the security threat.

15. A non-transitory computer-readable medium having stored thereon instructions that, when executed by one or more processors, cause the one or more processors to perform operations including:

identifying a security threat in a computing network monitored by an administration system for instances of security threats;

16. The non-transitory computer-readable medium of claim 15 , wherein the instructions, when executed by the one or more processors, further cause the one or more processors to perform operations including:

17. The non-transitory computer-readable medium of claim 15 , wherein the first request includes a digital signature identifying the administration system as a source of the first request.

18. The non-transitory computer-readable medium of claim 15 , wherein the instructions, when executed by the one or more processors, further cause the one or more processors to perform operations including:

receiving, by the administration system, input requesting to execute the first security action, wherein the input is associated with a user of the administration system; and

generating, by the administration system, a digital signature indicating approval by the user to execute the first security action, wherein the first request includes the digital signature.

19. The non-transitory computer-readable medium of claim 15 , wherein the first security action is identified by the administration system based on a type of the security threat.

20. The non-transitory computer-readable medium of claim 15 , wherein the first credentials include a first username and a first password associated with the first computing asset, and wherein the second credentials include a second username and a second password associated with the second computing asset.

Assignments (3)

CHANGE OF NAME Recorded Jul 22, 2025

From: SPLUNK INC.

To: SPLUNK LLC

Reel/Frame 072170/0599 →

ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jul 22, 2025

From: SPLUNK LLC

To: CISCO TECHNOLOGY, INC.

Reel/Frame 072173/0058 →

ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Mar 2, 2023

From: SATISH, SOURABH; FRIEDRICHS, OLIVER; MAHADIK, ATIF; SALINAS, GOVIND

To: SPLUNK INC.

Reel/Frame 062862/0817 →

Continuity (2)

Continuation 15170605 · Jun 1, 2016

Provisional Application 62169047 · Jun 1, 2015