Jeremiah J Clark

US Patent:

20220329604, Oct 13, 2022

Filed:

Apr 13, 2022

Appl. No.:

17/720163

Inventors:

- Austin TX, US
Greg Fitzgerald - Austin TX, US
Jeremiah Clark - Austin TX, US
Dean Mekkawy - Austin TX, US
Nevins Bartolomeo - Austin TX, US
Jim LoRusso - Austin TX, US
Nick Murdock - Austin TX, US
Allen Saunders - Austin TX, US
Jacob Hackett - Austin TX, US

International Classification:

H04L 9/40
H04L 41/12
H04L 41/0893
G06F 9/455

Abstract:

A method for monitoring endpoint devices affiliated with a computer network includes: for each security technology, accessing a set of objects generated by the security technology during a time interval and representing characteristics endpoint devices configured with the security technology, partitioning object groups representing individual endpoint devices, and aggregating characteristics represented in each object group into an endpoint device container associated with the security technology and containing identifying data and status data representing one endpoint device; identifying a first subset of endpoint devices configured with first and second security technologies based on correspondence between data contained endpoint device containers associated with the first and second security technologies; and identifying a second subset of endpoint devices configured with the first security technology and excluding the second security technology based on absence of correspondence between data contained in endpoint device containers associated with the first and second security technologies.

US Patent:

20230007047, Jan 5, 2023

Filed:

Jul 8, 2022

Appl. No.:

17/861007

Inventors:

- Austin TX, US
Dean Mekkawy - Austin TX, US
Jeremiah Clark - Austin TX, US
Nevins Bartolomeo - Austin TX, US
Luis Diego Cabezas - Austin TX, US

International Classification:

H04L 9/40

Abstract:

A method includes identifying a first group of objects generated by security tools during a first time interval and containing cotemporal, analogous characteristics identifying a first endpoint device connected to a computer network; based on the first group of objects, confirming detection of the first endpoint device by a first security tool and a second security tool during the first time interval; identifying a second group of objects generated by security tools during a second time interval and containing cotemporal, analogous characteristics identifying the first endpoint device; based on the second group of objects, confirming detection of the first endpoint device by the second security tool during the second time interval; and responsive to absence of detection of the first endpoint device by the first security tool during the second time interval, generating a source remove event specifying removal of the first security tool from the first endpoint device.