公开(公告)号：US20230164152A1

公开(公告)日：2023-05-25

申请号：US18094580

申请日：2023-01-09

Applicant: CrowdStrike, Inc.

Inventor： Daniel W. Brown ,  Thomas R. Hobson ,  Hyacinth D. Diehl ,  Alexander J. Graul

IPC: H04L9/40

CPC classification number: H04L63/1416 ,  H04L63/1425 ,  H04L63/1441

Abstract: Techniques to provide visualizations of possible malicious incidents associated with an event on a host device may include causing presentation of graphics of a process or thread in a user interface. Information about detected events may be transmitted to a computing device that generates the visualizations for presentation to an analyst to verify the malicious incidents. Based on patterns and information conveyed in the visualizations, the computer device or host device may take action to protect operation of the host device caused by the event.

公开(公告)号：US11516237B2

公开(公告)日：2022-11-29

申请号：US16943755

申请日：2020-07-30

Applicant: CrowdStrike, Inc.

Inventor： Alexander J. Graul

IPC: H04L9/40 ,  H04L41/14 ,  H04L41/22

Abstract: Methods and systems for visualization of data associated with events detected on a monitored server host, and control of the host, are provided. A system may detect an incident on a remote server host. The system may present scores and activity graphs on a user interface for a human operator to review. The user interface may include animated activity graphs to show the progress of a past malicious event. The user interface may emphasize, de-emphasize, and/or hide subgraphs. The user interface may include quick-action buttons and wizards to permit users to immediately kill processes or isolate a computer from the network. The user interface may include controls to bulk-tag detected events associated with a subgraph. The user interface may present notifications/dashboards of significant malicious events in progress and update same when a new event rises in incident score into the top 10.

公开(公告)号：US20210037027A1

公开(公告)日：2021-02-04

申请号：US16943949

申请日：2020-07-30

Applicant: CrowdStrike, Inc.

Inventor： Daniel W. Brown ,  Thomas R. Hobson ,  Hyacinth D. Diehl ,  Alexander J. Graul

IPC: H04L29/06

Abstract: Techniques to provide visualizations of possible malicious incidents associated with an event on a host device may include causing presentation of graphics of a process or thread in a user interface. Information about detected events may be transmitted to a computing device that generates the visualizations for presentation to an analyst to verify the malicious incidents. Based on patterns and information conveyed in the visualizations, the computer device or host device may take action to protect operation of the host device caused by the event.

公开(公告)号：US11588832B2

公开(公告)日：2023-02-21

申请号：US16943949

申请日：2020-07-30

Applicant: CrowdStrike, Inc.

Inventor： Daniel W. Brown ,  Thomas R. Hobson ,  Hyacinth D. Diehl ,  Alexander J. Graul

IPC: H04L29/06 ,  H04L9/40

Abstract: Techniques to provide visualizations of possible malicious incidents associated with an event on a host device may include causing presentation of graphics of a process or thread in a user interface. Information about detected events may be transmitted to a computing device that generates the visualizations for presentation to an analyst to verify the malicious incidents. Based on patterns and information conveyed in the visualizations, the computer device or host device may take action to protect operation of the host device caused by the event.

公开(公告)号：US20210037035A1

公开(公告)日：2021-02-04

申请号：US16943755

申请日：2020-07-30

Applicant: CrowdStrike, Inc.

Inventor： Alexander J. Graul

IPC: H04L29/06 ,  H04L12/24

Abstract: Methods and systems for visualization of data associated with events detected on a monitored server host, and control of the host, are provided. A system may detect an incident on a remote server host. The system may present scores and activity graphs on a user interface for a human operator to review. The user interface may include animated activity graphs to show the progress of a past malicious event. The user interface may emphasize, de-emphasize, and/or hide subgraphs. The user interface may include quick-action buttons and wizards to permit users to immediately kill processes or isolate a computer from the network. The user interface may include controls to bulk-tag detected events associated with a subgraph. The user interface may present notifications/dashboards of significant malicious events in progress and update same when a new event rises in incident score into the top 10.