Blacklisting and whitelisting of security-related events
View Patent ↗A disclosed computer-implemented method includes receiving and indexing the raw data. Indexing includes dividing the raw data into time stamped searchable events that include information relating to computer or network security. Store the indexed data in an indexed data store and extract values from a field in the indexed data using a schema. Search the extracted field values for the security information. Determine a group of security events using the security information. Each security event includes a field value specified by a criteria. Present a graphical interface (GI) including a summary of the group of security events, other summaries of security events, and a remove element (associated with the summary). Receive input corresponding to an interaction of the remove element. Interacting with the remove element causes the summary to be removed from the GI. Update the GI to remove the summary from the GI.
1. A computer-implemented method, comprising:
receiving, on a computing device, raw data;
identifying one or more events in the raw data, wherein each of the one or more events includes information relating to computer security or network security;
storing the one or more events in a searchable data store, wherein an event includes one or more fields, and wherein a field has a corresponding value;
using a schema to extract values for fields in the one or more events;
determining a subset group of events, wherein the subset group of events is determined using the extracted values corresponding to the one or more fields;
presenting a graphical interface including a summary of the subset group of events, one or more other summaries of events, and a remove element, wherein the remove element is associated with the summary of the subset group of events;
receiving input corresponding to an interaction with of the remove element, wherein interacting with the remove element causes the summary of the subset group of events to be removed from the graphical interface that displays the one or more other summaries of events; and
in response to an interaction with the remove element, updating the graphical interface to remove the summary of the subset group of events from the graphical interface that displays the one or more other summaries of events.
2. The computer-implemented method of claim 1 , wherein the raw data includes unstructured data or machine data.
3. The computer-implemented method of claim 1 , wherein the raw data includes web logs.
4. The computer-implemented method of claim 1 , wherein the information relating to computer security or network security includes a http agent string, a network traffic size, a length of a uniform resource locator string, a byte count per request, a domain name, or a source address.
5. The computer-implemented method of claim 1 , wherein the one or more events include network-type events.
6. The computer-implemented method of claim 1 , further comprising:
receiving an input corresponding to a selection of the summary of the subset group of events; and
updating the graphical interface to display information related to at least one event in the subset group of events.
7. The computer-implemented method of claim 1 , wherein the schema is used at query time to extract the values for the fields in the one or more events.
8. The computer-implemented method of claim 1 , wherein the graphical interface includes a modify element associated with the summary of the subset group of events, and wherein interaction with the modify element causes the summary of the subset group of events to be visually modified in the graphical interface.
9. The computer-implemented method of claim 1 , further comprising:
generating a display that includes an add element and one or more summaries that have been removed from the graphical interface, wherein the one or more summaries include the summary of the subset group of events, and wherein interacting with the add element causes the summary of the subset group of events to be added back to the graphical interface; and
in response to an interaction with the add element, updating the graphical interface to add the summary of the subset group of events back to the graphical interface.
10. The computer-implemented method of claim 1 , wherein the summary of the subset group of events includes a result of a correlation search.
11. The computer-implemented method of claim 1 , wherein the subset group of events is determined using an agent string that has been extracted from one or more events in the subset group of events.
12. The computer-implemented method of claim 1 , wherein the subset group of events is determined using a particular length of a uniform resource locator string that has been extracted from one or more events in the subset group of events or a source address that has been extracted from one or more events in the subset group of events.
13. The computer-implemented method of claim 1 , wherein the searchable data store includes a time-series data store, and wherein an event is locatable in the searchable data store using a time stamp of the event.
14. The computer-implemented method of claim 1 , wherein each event of the subset group of events includes a time stamp and is locatable in the searchable data store using the time stamp.
15. A system, comprising:
one or more data processors; and
a non-transitory computer-readable storage medium containing instructions which when executed on the one or more data processors, cause the one or more processors to perform operations including:
receiving raw data;
identifying one or more events in the raw data, wherein each of the one or more events includes information relating to computer security or network security;
storing the one or more events in a searchable data store, wherein an event includes one or more fields, and wherein a field has a corresponding value;
using a schema to extract values for fields in the one or more events;
determining a subset group of events, wherein the subset group of events is determined using the extracted values corresponding to the one or more fields;
presenting a graphical interface including a summary of the subset group of events, one or more other summaries of events, and a remove element, wherein the remove element is associated with the summary of the subset group of events;
receiving input corresponding to an interaction with the remove element, wherein interacting with the remove element causes the summary of the subset group of events to be removed from the graphical interface that displays the one or more other summaries of events; and
in response to an interaction with the remove element, updating the graphical interface to remove the summary of the subset group of events from the graphical interface that displays the one or more other summaries of events.
16. The system of claim 15 , wherein the raw data includes unstructured data or machine data.
17. The system of claim 15 , wherein the information relating to computer security or network security includes a http agent string, a network traffic size, a length of a uniform resource locator string, a byte count per request, a domain name, or a source address.
18. The system of claim 15 , wherein the operations include:
receiving an input corresponding to a selection of the summary of the subset group of events; and
updating the graphical interface to display information related to at least one event in the subset group of events.
19. The system of claim 15 , wherein the schema is used at query time to extract the values for the fields in the one or more events.
20. The system of claim 15 , wherein the graphical interface includes a modify element associated with the summary of the subset group of events, and wherein interaction with the modify element causes the summary of the subset group of events to be visually modified in the graphical interface.
21. The system of claim 15 , wherein the operations include:
generating a display that includes an add element and one or more summaries that have been removed from the graphical interface, wherein the one or more summaries include the summary of the subset group of events, and wherein interacting with add element causes the summary of the subset group of events to be added back to the graphical interface; and
in response to an interaction with the add element, updating the graphical interface to add the summary of the subset group of events back to the graphical interface.
22. The system of claim 15 , wherein the searchable data store includes a time-series data store, and wherein an event is locatable in the searchable data store using a time stamp of the event.
23. A computer-program product tangibly embodied in a non-transitory machine-readable storage medium, including instructions configured to cause one or more data processors to:
receive, on a computing device, raw data;
identify one or more events in index the raw data, wherein each of the one or more events includes information relating to computer security or network security;
store the one or more events in a searchable data store, wherein an event includes one or more fields, and wherein a field has a corresponding value;
using a schema to extract values for fields in the one or more events;
determine a subset group of events, wherein the subset group of events is determined using the extracted values corresponding to the one or more fields;
present a graphical interface including a summary of the subset group of events, one or more other summaries of events, and a remove element, wherein the remove element is associated with the summary of the subset group of events;
receive input corresponding to an interaction with the remove element, wherein interacting with the remove element causes the summary of the subset group of events to be removed from the graphical interface that displays the one or more other summaries of events; and
in response to an interaction with the remove element, update the graphical interface to remove the summary of the subset group of events from the graphical interface that displays the one or more other summaries of security events.
24. The computer-program product of claim 23 , wherein the raw data includes unstructured data or machine data.
25. The computer-program product of claim 23 , wherein the instructions are further configured to cause the one or more data processors to:
receive an input corresponding to a selection of the summary of the subset group of events; and
update the graphical interface to display information related to at least one event in the subset group of events.
26. The computer-program product of claim 23 , wherein the schema is used at query time to extract the values for the fields in the one or more events.
27. The computer-program product of claim 23 , wherein the graphical interface includes a modify element associated with the summary of the subset group of events, and wherein interaction with the modify element causes the summary of the subset group of events to be visually modified in the graphical interface.
28. The computer-program product of claim 23 , wherein the instructions are further configured to cause the one or more data processors to:
generate a display that includes an add element and one or more summaries that have been removed from the graphical interface, wherein the one or more summaries include the summary of the subset group of events, and wherein interacting with the add element causes the summary of the subset group of events to be added back to the graphical interface; and
in response to an interaction with the add element, updating the graphical interface to add the summary of the subset group of events back to the graphical interface.
29. The computer-program product of claim 23 , wherein the searchable data store includes a time-series data store, and wherein an event is locatable in the searchable data store using a time stamp of the event.