Event evaluation pipeline for alert engine

1. A method for filtering events related to an electronic device prior to evaluation of a group of multiple events thereof, the method comprising:

storing a set of rules, each rule labeled with a rule type;

receiving a stream of events, each event labeled with an event type;

determining that the event type of one of the events matches the rule type of one of the rules;

determining that a condition of said one rule is satisfied by said one event;

creating a document;

writing, in the document, said one event, said one rule, an indication that the condition is satisfied and an expiry time that is measured from said one event, wherein said one rule requires (a) the event type of another of the events to match the rule type of said one rule type, (b) the other event occur within the expiry time and (c) the other event to satisfy another condition of said one rule;

storing the document in a non-volatile storage;

determining that the event type of a second one of the events matches the rule type of said one rule;

determining that the expiry time has not passed;

determining that a second condition of said one rule is satisfied by said second event;

writing said second event and an indication that the second condition is satisfied in the document; and

taking a security action related to the electronic device.

2. The method of claim 1 comprising:

determining that the event type of a third one of the events matches the rule type of a second rule;

determining that a condition of said second rule is satisfied by said third event;

creating a second document;

writing, in the second document, said third event, said second rule, an indication that the condition of said second rule is satisfied and a second expiry time that is measured from said third event, wherein said second rule requires (a) the event type of a further one of the events to match the rule type of said second rule, (b) said further event to occur within the second expiry time, and (c) said further event to satisfy another condition of said second rule;

storing the second document in the non-volatile storage;

determining that the second expiry time has passed without said further event occurring; and

deleting the second document.

3. The method of claim 1 , comprising:

determining that the event type of a third one of the events matches the rule type of a second rule;

determining that a condition of said second rule is satisfied by said third event;

creating a second document;

writing, in the second document, said third event, said second rule, an indication that the condition of said second rule is satisfied and a second expiry time measured from said third event, wherein said second rule requires (a) the event type of a further one of the events to match the rule type of said second rule (b) said further event to occur within the second expiry time, and (c) said further event to satisfy another condition of said second rule;

storing the second document in the non-volatile storage;

determining that the event type of a fourth one of the events is identical to the event type of said third event;

determining that the condition of said second rule is satisfied by said fourth event; and

updating the expiry time in the second document to be measured from said fourth event.

4. The method of claim 1 , comprising detecting a state of the electronic device, wherein the taking of the security action occurs depending on the state of the electronic device.

5. The method of claim 1 comprising deleting the document, after determining that all conditions of said one rule are satisfied.

6. The method of claim 1 , wherein multiple different event types match against a same one of the rule types.

7. The method of claim 1 , comprising discarding the events that are determined to not satisfy the condition.

8. The method of claim 1 , wherein the document is an Extended Markup Language document.

9. The method of claim 1 , wherein the security action comprises locking the electronic device device, reducing functionality of the electronic device or rebooting the electronic device.

10. The method of claim 1 , wherein the security action comprises tracking the electronic device, monitoring use of the electronic device, capturing keyboard entries to the electronic device, capturing screenshots from the electronic device, taking photos or videos with a camera of the electronic device, sounding an alarm on the electronic device, or displaying a message on the electronic device.

11. The method of claim 1 , wherein the security action comprises deleting data on the electronic device, encrypting data on the electronic device, deleting decryption keys on the electronic device, or transferring data from the electronic device.

12. The method of claim 1 , wherein the security action comprises notifying other electronic devices in the vicinity of the electronic device, or sending email notifications to IT administration, security personnel or law enforcement.

13. The method of claim 1 , wherein the steps after storing the set of rules are performed in real time.

14. A system for filtering events related to an electronic device prior to evaluation of a group of multiple events thereof, the system comprising a server and non-transitory computer readable memory in the server storing computer-readable instructions, which, when executed by one or more processors in the server cause the server to:

store a set of rules, each rule labeled with a rule type;

receive a stream of events, each event labeled with an event type;

determine that the event type of one of the events matches the rule type of one of the rules;

determine that a condition of said one rule is satisfied by said one event;

create a document;

write, in the document, said one event, said one rule, an indication that the condition is satisfied and an expiry time that is measured from said one event, wherein said one rule requires (a) the event type of another of the events to match the rule type of said one rule type, (b) the other event occur within the expiry time and (c) the other event to satisfy another condition of said one rule;

store the document in a non-volatile storage;

determine that the event type of a second one of the events matches the rule type of said one rule;

determine that the expiry time has not passed;

determine that a second condition of said one rule is satisfied by said second event;

write said second event and an indication that the second condition is satisfied in the document; and

take a security action related to the electronic device.

15. The system of claim 14 wherein the server is further caused to:

determine that the event type of a third one of the events matches the rule type of a second rule;

determine that a condition of said second rule is satisfied by said third event;

create a second document;

write, in the second document, said third event, said second rule, an indication that the condition of said second rule is satisfied and a second expiry time that is measured from said third event, wherein said second rule requires (a) the event type of a further one of the events to match the rule type of said second rule, (b) said further event to occur within the second expiry time, and (c) said further event to satisfy another condition of said second rule;

store the second document in the non-volatile storage;

determine that the second expiry time has passed without said further event occurring; and

delete the second document.

16. The system of claim 14 , wherein the server is further caused to:

determine that the event type of a third one of the events matches the rule type of a second rule;

determine that a condition of said second rule is satisfied by said third event;

create a second document;

write, in the second document, said third event, said second rule, an indication that the condition of said second rule is satisfied and a second expiry time measured from said third event, wherein said second rule requires (a) the event type of a further one of the events to match the rule type of said second rule (b) said further event to occur within the second expiry time, and (c) said further event to satisfy another condition of said second rule;

store the second document in the non-volatile storage;

determine that the event type of a fourth one of the events is identical to the event type of said third event;

determine that the condition of said second rule is satisfied by said fourth event; and

update the expiry time in the second document to be measured from said fourth event.

17. The system of claim 14 , wherein:

the server is further caused to detect a state of the electronic device; and

the security action is taken dependent on the state of the electronic device.

18. The system of claim 14 , wherein the server is further caused to:

delete the document after determining that all conditions of said one rule are satisfied; and

discard the events that do not satisfy the condition.

19. The system of claim 14 , wherein the security action comprises locking the electronic device, reducing functionality of the electronic device, rebooting the electronic device, tracking the electronic device, monitoring use of the electronic device, capturing keyboard entries to the electronic device, capturing screenshots from the electronic device, taking photos or videos with a camera of the electronic device, sounding an alarm on the electronic device, displaying a message on the electronic device, deleting data on the electronic device, encrypting data on the electronic device, deleting decryption keys on the electronic device, transferring data from the electronic device, notifying other electronic devices in the vicinity of the electronic device, or sending email notifications to IT administration, security personnel or law enforcement.