Granted Patent B2

US 12,641,126 · App. 18/541,405 · Granted May 26, 2026

Inventors: Jeffrey J. Guy (Austin, TX); Dean Mekkawy (Austin, TX); Jeremiah Clark (Austin, TX); Nevins Bartolomeo (Austin, TX); Aaron Griffin (Austin, TX); Michael Alfonse (Austin, TX); Jacob Hackett (Austin, TX); Nick Murdock (Austin, TX); Jim LoRusso (Austin, TX); Jason McFarland (Austin, TX); Luis Diego Cabezas (Austin, TX)

Assignee: Arctic Wolf Networks, Inc.

H04L63/20

Abstract

Claims (77)

1 . A method comprising:

accessing a first set of objects, generated by a set of sources during a first time interval, representing attributes of a first set of assets;

grouping the first set of objects into a first set of object groups, each object group in the first set of object groups representing an asset in the first set of assets;

for each object group in the first set of object groups, aggregating objects in the object group into an asset container, in a first set of asset containers, representing attributes of an asset in the first set of assets;

generating a first manifest of assets in communication with a computer network during the first time interval based on the first set of asset containers;

identifying a first subset of assets, specified in the first manifest of assets, corresponding to a first attribute category characterized by a first combination of attributes, each asset in the first subset of assets exhibiting a set of attributes comprising the first combination of attributes; and

by a computer system, executing a first action, assigned to the first attribute category, on the first subset of assets.

2 . The method of claim 1 , further comprising:

generating a second set of asset containers by, for each asset in a second set of assets, aggregating objects, generated by the set of sources during a second time interval, representing the asset into an asset container, in the second set of asset containers, representing attributes of the asset in the second set of assets;

generating a second manifest of assets in communication with the computer network during the second time interval based on the second set of asset containers;

identifying a second subset of assets specified in the second manifest of assets, each asset in the second subset of assets exhibiting a set of attributes comprising the first combination of attributes; and

executing the first action on the second subset of assets.

3 . The method of claim 2 , further comprising:

identifying the first subset of assets excluding a first asset;

identifying the second subset of assets comprising the first asset; and

in response to identifying the second subset of assets comprising the first asset, serving a notification via an operator portal specifying the first asset in the second subset of assets.

4 . The method of claim 2 , further comprising:

generating a chart depicting a trendline representing:

a first count of assets in the first subset of assets; and

a second count of assets in the second subset of assets; and

serving the chart via an operator portal.

5 . The method of claim 1 , further comprising:

defining the first attribute category based on a set of threat intelligence specifying the first combination of attributes; and

assigning the first action to the first attribute category based on the set of threat intelligence specifying the first action.

6 . The method of claim 1 , further comprising assigning the first action to the first attribute category based on a first risk score assigned to the first attribute category.

7 . The method of claim 6 , further comprising:

extracting, from a set of historical data representing a computer network attack, attributes of assets involved the computer network attack; and

assigning the first risk score to the first attribute category based on proximity of the first combination of attributes to the attributes of assets involved in the computer network attack.

8 . The method of claim 1 , further comprising, for each attribute category in a set of attribute categories and exhibiting a combination of attributes:

querying the first manifest of assets for a count of assets, in the first manifest of assets, that exhibit all attributes of the attribute category; and

storing the count of assets within the attribute category for the first time interval.

9 . The method of claim 8 , further comprising:

generating a first count of assets within the first attribute category for the first time interval; and

serving the first count of assets via an operator portal.

10 . The method of claim 8 , further comprising:

identifying a subset of attribute categories in the set of attribute categories, each attribute category in the subset of attribute categories exhibiting a nonzero count of assets for the first time interval;

for each attribute category in the subset of attribute categories:

identifying the count of assets within the attribute category for the first time interval; and

specifying the count of assets in a list of the subset of attribute categories; and

serving the list via the operator portal.

11 . The method of claim 10 , further comprising:

for each attribute category in the subset of attribute categories, ranking the attribute category based on the count of assets within the attribute category for the first time interval; and

prompting a user to investigate the subset of attribute categories in order of rank.

12 . The method of claim 8 , further comprising:

generating a graphical representation of counts of assets within the set of attribute categories for the first time interval; and

serving the graphical representation via an operator portal.

13 . The method of claim 12 :

wherein generating the graphical representation comprises generating a histogram representing counts of assets within the set of attribute categories for the first time interval; and

further comprising, for each attribute category in a first cluster of attribute categories in the histogram:

labeling the attribute category with a risk level; and

assigning an action to the attribute category.

14 . The method of claim 8 , further comprising prompting a user to assign the first action to the first attribute category, in the set of attribute categories, exhibiting a null count of assets during a second time interval preceding the first time interval.

15 . The method of claim 1 , further comprising assigning the first action to the first attribute category, the first action comprising quarantining an asset.

16 . The method of claim 15 , further comprising:

initializing a set of attribute categories comprising the first attribute category and a second attribute category, each attribute category in the set of attribute categories characterized by a combination of attributes; and

assigning a second action to the second attribute category, the second action comprising serving an alert via an operator portal.

17 . The method of claim 1 , further comprising:

extracting a target combination of attributes defined in a security policy for the computer network;

initializing a second attribute category characterized by the target combination of attributes; and

withholding an action assignment for the second attribute category.

18 . The method of claim 1 , further comprising:

labeling each asset in the first manifest of assets with a combination of sources, in the set of sources, deployed on the asset;

receiving selection of a subset of sources in the set of sources; and

rendering a visualization depicting quantities of assets labeled with permutations of the subset of sources in the first manifest.

19 . A method comprising:

accessing a set of objects, generated by a set of sources during a target time interval, representing attributes of a set of assets comprising a first asset;

assigning the set of objects to a set of object groups comprising a first object group representing the first asset;

generating a first asset container in a set of asset containers, the first asset container:

comprising objects in the first object group; and

representing a first set attributes exhibited by the first asset during the target time interval;

by a computer system, executing a first action, assigned to a first attribute category characterized by a first combination of attributes, on the first asset in response to the first set of attributes comprising the first combination of attributes.

20 . A method comprising:

accessing a set of objects, generated by a set of sources during a target time interval, representing attributes of a set of assets;

grouping the first set of objects into a first set of object groups, each object group in the first set of object groups representing an asset in the set of assets;

for each object group in the first set of object groups, aggregating objects in the object group into an asset container, in a set of asset containers, representing attributes exhibited by an asset in the set of assets during the target time interval;

based on the set of asset containers, identifying a first subset of assets in the set of assets corresponding to a first attribute category characterized by a first combination of attributes, each asset in the first subset of assets exhibiting a set of attributes comprising the first combination of attributes; and

by a computer system, executing a first action, assigned to the first attribute category, on the first subset of assets.

Assignments (4)

Continuity (3)

References Cited (10)