Sean M Brady

US Patent:

20170316203, Nov 2, 2017

Filed:

Jul 17, 2017

Appl. No.:

15/651924

Inventors:

- Santa Clara CA, US
Andreis Seip Haugsnes - Mountain View CA, US
Jeffrey Rhines - San Antonio TX, US
Henry Geddes - Corte Madera CA, US
Volodymyr Osypov - Mountain View CA, US
Scott Lewis - Sunnyvale CA, US
Sean Brady - Bedford NH, US
Mark Manning - Redwood City CA, US

International Classification:

G06F 21/55
H04L 29/06

Abstract:

This disclosure provides techniques for pooling and searching network security events reported by multiple sources. As information representing a security event is received from one source, it is searched against a central or distributed database representing events reported from multiple, diverse sources (e.g., different client networks). Either the search or correlated results can be filtered and/or routed according at least one characteristic associated with the networks, for example, to limit correlation to events reported by what are presumed to be similarly situated networks. The disclosed techniques facilitate faster identification of high-relevancy security event information, and thereby help facilitate faster threat identification and mitigation. Various techniques can be implemented as standalone software (e.g., for use by a private network) or for a central pooling and/or query service. This disclosure also provides different examples of actions that can be taken in response to search results.

US Patent:

20150207813, Jul 23, 2015

Filed:

Feb 5, 2015

Appl. No.:

14/615202

Inventors:

- San Mateo CA, US
Andreas Seip Haugsnes - Mountain View CA, US
Jeffrey Rhines - San Antonio TX, US
Henry Geddes - Corte Madera CA, US
Volodymyr Osypov - Mountain View CA, US
Scott Lewis - Sunnyvale CA, US
Sean Brady - Bedford NH, US
Mark Manning - Redwood City CA, US

International Classification:

H04L 29/06

Abstract:

This disclosure provides techniques for pooling and searching network security events reported by multiple sources. As information representing a security event is received from one source, it is searched against a central or distributed database representing events reported from multiple, diverse sources (e.g., different client networks). Either the search or correlated results can be filtered and/or routed according at least one characteristic associated with the networks, for example, to limit correlation to events reported by what are presumed to be similarly situated networks. The disclosed techniques facilitate faster identification of high-relevancy security event information, and thereby help facilitate faster threat identification and mitigation. Various techniques can be implemented as standalone software (e.g., for use by a private network) or for a central pooling and/or query service. This disclosure also provides different examples of actions that can be taken in response to search results.