Managing alert profiles
Systems and techniques for managing alert profiles, including creating the alert profiles and deactivating the alert profiles, are described. Auditing software executing on a central server may receive an event log from a software agent. The event log may identify activities associated with a network element in a computer system. The auditing software may include a classifier trained using machine learning. The auditing software may determine that the event log is indicative of an interesting activity, such as malicious activity. The auditing software may create an alert profile. The auditing software may assign a severity to the alert profile. The auditing software may determine whether the alert profile is relevant. The auditing software may deactivate the alert profile based on determining that the alert profile is not relevant.
1. A computer-implemented method, comprising:
receiving, from a software agent, an event log identifying one or more activities associated with a network element;
determining, by a classifier trained using machine learning, that the event log is indicative of an interesting activity;
creating, by the classifier, an alert profile based at least partly on the event log;
determining, by the classifier, a severity of the alert profile based at least partly on the event log;
determining, by the classifier, a time interval associated with the alert profile;
determining a time period by multiplying the time interval by the severity of the alert profile;
associating, by the classifier, the time period with the alert profile; and
deactivating, by the classifier, the alert profile after the time period has expired.
2. The computer-implemented method of claim 1 , wherein the network element comprises at least one of:
a database hosting device;
a user computing device; or
a server device.
3. The computer-implemented method of claim 1 , further comprising:
determining that one or more conditions associated with the alert profile are satisfied; and
performing one or more actions associated with the alert profile.
4. The computer-implemented method of claim 3 , wherein the one or more actions include alerting a system administrator.
5. The computer-implemented method of claim 3 , wherein the one or more actions include preventing the network element from performing additional activities or preventing access to the network element.
6. The computer-implemented method of claim 1 , wherein deactivating, by the classifier, the alert profile after the time period has expired comprises:
determining, after the time period has expired, that the alert profile is not relevant based on one or more additional event logs; and
deactivating the alert profile based at least in part on determining that the alert profile is not relevant.
7. The computer-implemented method of claim 1 , wherein determining, by a classifier trained using machine learning, that the event log is indicative of an interesting activity comprises determining that the event log is indicative of at least one of:
a malicious activity; or
a utilization of a network resource satisfying a predetermined threshold.
8. One or more non-transitory computer-readable media storing instructions that include a classifier algorithm, the instructions executable by one or more processors to perform operations comprising:
receiving, from a software agent, an event log associated with a network element;
determining that the event log is indicative of an interesting activity;
creating an alert profile based at least partly on the event log;
determining a severity of the alert profile based at least partly on the event log;
determining a time interval associated with the alert profile;
determining a time period by multiplying the time interval by the severity of the alert profile;
associating the time period with the alert profile;
and
deactivating the alert profile based on determining that the time period has expired.
9. The one or more non-transitory computer-readable media of claim 8 , wherein determining that the event log is indicative of the interesting activity comprises:
determining that the event log is indicative of malicious activity.
10. The one or more non-transitory computer-readable media of claim 8 , wherein determining that the event log is indicative of the interesting activity comprises:
determining that the event log is indicative that a utilization of a network resource is at or above a predetermined threshold.
11. The one or more non-transitory computer-readable media of claim 8 , wherein determining that the event log is indicative of the interesting activity comprises:
determining that the event log is indicative that a utilization of a network resource is below a predetermined threshold.
12. The one or more non-transitory computer-readable media of claim 8 , further comprising:
receiving one or more additional event logs; and
determining that one or more conditions associated with the alert profile are satisfied based at least partly on the one or more additional event logs.
13. The one or more non-transitory computer-readable media of claim 8 , further comprising:
determining that one or more conditions associated with the alert profile are satisfied; and
performing one or more actions associated with the alert profile.
14. A server, comprising:
one or more processors; and
one or more non-transitory computer-readable media storing instructions comprising a classifier trained using machine learning, the instructions executable by the one or more processors to perform operations comprising:
receiving, from a software agent, a first event log identifying one or more events associated with a network element;
determining, by a classifier trained using machine learning, that the first event log is indicative of an interesting activity;
creating, by the classifier, an alert profile based at least partly on the first event log;
activating the alert profile;
receiving at least a second event log;
determining, by the classifier, that one or more conditions associated with the alert profile are satisfied based on the first event log and the second event log;
determining, by the classifier, a severity of the alert profile based at least partly on the first event log and the second event log;
determining, by the classifier, a time interval associated with the alert profile;
determining, by the classifier, a time period by multiplying the time interval by the severity of the alert profile;
associating, by the classifier, the time period with the alert profile;
performing one or more actions associated with the alert profile based on determining that the one or more conditions associated with the alert profile are satisfied; and
deactivating, by the classifier, the alert profile based on determining that the time period has expired.
15. The server of claim 14 , wherein determining that the first event log is indicative of an interesting activity comprises:
determining that the first event log is indicative of malicious activity.
16. The server of claim 14 , wherein the alert profile comprises the one or more conditions and the one or more actions.
17. The server of claim 14 , wherein performing the one or more actions associated with the alert profile comprises:
alerting a system administrator; and
blocking traffic to and from the network element.
18. The server of claim 14 , the operations further comprising:
determining a time period to activate the alert profile; and
associating the time period with the alert profile.
19. The server of claim 14 , further comprising:
determining that the interesting activity has not occurred for at least a predetermined amount of time.
20. The server of claim 14 , further comprising:
determining that an additional event log indicative of the interesting activity has not been received for at least a predetermined amount of time.