中科微点-全球专利检索

  1. Login
  2. Sign Up

Search Results

32 records (took 0.033 seconds)

    Using network locations obtained from multiple threat lists to evaluate network data or machine data
    12.
    发明授权
    Using network locations obtained from multiple threat lists to evaluate network data or machine data 有权

    公开(公告)号：US10367827B2

    公开(公告)日：2019-07-30

    申请号：US14135427

    申请日：2013-12-19

    Applicant: Splunk Inc.

    Inventor： Mark Seward ,  John Robert Coates

    IPC: H04L29/06 ,  G06F16/21 ,  G06F16/951

    Abstract: Systems and methods are provided for identifying network addresses and/or IDs of a deduplicated list among network data, machine data, and/or events derived from network data and/or machine data, and for identifying notable events by searching for the presence of network addresses and/or network IDs that are deduplicated across lists received from multiple external sources. One method includes receiving a plurality of lists of network locations, wherein each list is received from over a network, wherein each of the network locations includes a domain name or an IP address, and wherein at least two of the plurality of lists each include a same network location; aggregating the plurality of lists of network locations into a deduplicated list of unique network locations; and searching network data or machine data for a network location included in the deduplicated list of unique network locations.

    Designating Fields in Machine Data Using Templates
    13.
    发明申请
    Designating Fields in Machine Data Using Templates 审中-公开

    公开(公告)号：US20180157724A1

    公开(公告)日：2018-06-07

    申请号：US15885809

    申请日：2018-01-31

    Applicant: Splunk Inc.

    Inventor： Michael Kinsely ,  Alex Raitz ,  John Robert Coates ,  Shirley Wu

    IPC: G06F17/30

    CPC classification number: G06F16/254

    Abstract: A field extraction template simplifies the creation of field extraction rules by providing a user with a set of field names commonly assigned to a certain type of data, as well as guidance on how to extract values for those fields. These field extraction rules, in turn, facilitate access to certain “chunks” of the data, or to information derived from those chunks, through named fields. A field extraction template comprises at least a set of field names and ordering data for the field names. The ordering data indicates index positions that are associated with at least some of the field names. A delimiter is specified for splitting data items into arrays of chunks. The chunk of a data item that belongs to a given field name is the chunk whose position within the item's array of chunks is equivalent to the index position associated with the given field name.

    Modifying field definitions to include post-processing instructions
    17.
    发明授权
    Modifying field definitions to include post-processing instructions 有权

    公开(公告)号：US11907244B2

    公开(公告)日：2024-02-20

    申请号：US17809837

    申请日：2022-06-29

    Applicant: SPLUNK INC.

    Inventor： Michael Kinsely ,  Alex Raitz ,  John Robert Coates ,  Shirley Wu

    IPC: G06F16/00 ,  G06F7/00 ,  G06F16/25

    CPC classification number: G06F16/254

    Abstract: A field extraction template simplifies the creation of field extraction rules by providing a user with a set of field names commonly assigned to a certain type of data, as well as guidance on how to extract values for those fields. These field extraction rules, in turn, facilitate access to certain “chunks” of the data, or to information derived from those chunks, through named fields. A field extraction template comprises at least a set of field names and ordering data for the field names. The ordering data indicates index positions that are associated with at least some of the field names. A delimiter is specified for splitting data items into arrays of chunks. The chunk of a data item that belongs to a given field name is the chunk whose position within the item's array of chunks is equivalent to the index position associated with the given field name.

    EXTRACTION RULE GENERATION USING CLUSTERING
    18.
    发明申请
    EXTRACTION RULE GENERATION USING CLUSTERING 有权

    公开(公告)号：US20220083572A1

    公开(公告)日：2022-03-17

    申请号：US17539143

    申请日：2021-11-30

    Applicant: Splunk Inc.

    Inventor： Li Li ,  Gang Tao ,  Yongxin Su ,  Junqing Hao ,  Ting Wang ,  John Robert Coates ,  Elias Haddad ,  Guodong Wang

    IPC: G06F16/28 ,  G06F16/2458 ,  G06N20/00

    Abstract: Determining a set of extraction rules include clustering event segments into at least a first group of event segments, and determining, using first field data in the first group of event segments, a first set of extraction rules for extracting the first field data from each event segment of the first group of event segments. A determination is made that the first set of extraction rules fails to successfully extract all of the first field data. Responsive to the determination, the event segments are re-clustered into at least a second group of event segments and a third group of event segments until a successful set of extraction rules are identified. The successful set of extraction rules are stored in computer memory.

    Technology add-on control console
    19.
    发明授权
    Technology add-on control console 有权

    公开(公告)号：US11249710B2

    公开(公告)日：2022-02-15

    申请号：US15088106

    申请日：2016-03-31

    Applicant: Splunk Inc.

    Inventor： Li Li ,  Gang Tao ,  Yongxin Su ,  Junqing Hao ,  Ting Wang ,  John Robert Coates ,  Elias Haddad ,  Guodong Wang

    IPC: G06Q10/06 ,  G06N5/02 ,  G06F17/40 ,  G06F3/14

    Abstract: The operation of an automatic data input and query system is controlled by well-defined control data. The system exposes user interfaces enabling an administrator to interact with control data to modify the ongoing operation of the system. Certain control data determines the collection and treatment of data from various technology sources. A robust control interface is provided enabling the efficient and reliable adding on of new technology data sources. Once established, control data for a new technology data source may be packaged in a form for archiving or distribution. The system may support the export and import of such packages. Such packages may be created independently of the system.

    Identifying notable events based on execution of correlation searches
    20.
    发明授权
    Identifying notable events based on execution of correlation searches 有权

    公开(公告)号：US11196756B2

    公开(公告)日：2021-12-07

    申请号：US15421393

    申请日：2017-01-31

    Applicant: Splunk Inc.

    Inventor： Mark Seward ,  John Robert Coates

    IPC: H04L29/06 ,  G06F16/21 ,  G06F16/951

    Abstract: Systems and methods are provided for identifying network addresses and/or IDs of a deduplicated list among network data, machine data, and/or events derived from network data and/or machine data, and for identifying notable events by searching for the presence of network addresses and/or network IDs that are deduplicated across lists received from multiple external sources. One method includes receiving a plurality of lists of network locations, wherein each list is received from over a network, wherein each of the network locations includes a domain name or an IP address, and wherein at least two of the plurality of lists each include a same network location; aggregating the plurality of lists of network locations into a deduplicated list of unique network locations; and searching network data or machine data for a network location included in the deduplicated list of unique network locations.

Patent Agency Ranking