Abstract: Techniques for detecting advanced security threats may be realized as a method for detecting a security threat including generating a resource at a client, implementing the resource on the client, monitoring system behavior of the client having the resource implemented thereon, determining whether a security event involving the implemented resource has occurred based on the monitored system behavior, and generating a report when it has been determined that the security event has occurred.

Abstract: A method, system, computer system, and computer program product to provide an infrastructure for replicating data across multiple nodes in a network. Changes to data are written to each of a set of mirrored copies of a log on one node. When a storage area containing a portion of one of the mirrored copies of the log becomes full, the storage area is disassociated from the set of mirrored copies. After detaching the storage area, changes are no longer written to the storage area, thereby providing a stable image of that portion of the log data. Log data stored in the storage area are replicated from the storage area to another node. By replicating from a separate detached storage area, log data are replicated without disturbing the disk heads writing changes to each of the set of mirrored copies of the log.

Abstract: A method, system, and language to express storage requirements. The language provides keywords and rules corresponding to commands for configuring a set of storage devices to provide requested capabilities of a logical volume. The language also has keywords and constructs for defining capabilities. The language supports direct inheritance of a capability, where a template specifies another template that contains rules to be used to provide a given capability. The language also supports indirect inheritance of a capability, where a template requires a capability but does not provide an implementation of the capability. In addition, the language is processed to “merge” rules by selecting a single storage device that conforms to more than one rule when possible. Merging rules enables a minimum number of storage devices to be used to meet a given logical volume configuration and set of capabilities.

Abstract: A method, system, and computer program product for adaptively implementing capabilities of a logical volume. If a particular capability is an inherent attribute of an existing storage device, the existing storage device is chosen to implement the volume. If the particular capability is not an inherent attribute of an existing storage device, one or more storage devices are selected and configured to provide the capability. If a capacity is requested for the logical volume and a storage device provides only a portion of the capacity, multiple storage devices having the capability are combined to provide the requested capability and capacity.

Abstract: A method, system, language, and computer program product to enable a user to provide a high-level specification of storage requirements without having detailed knowledge of the underlying vendor-specific APIs and command line utilities for each possible storage device used to meet the storage requirements. The user does not specify how to implement the storage requirements. The system implements the high-level specification in hardware and/or software without further direction from the user.

Abstract: A method, system, and computer program product for preserving the intent of a logical volume creator with the logical volume. The creator of a logical volume defines certain characteristics of that logical volume. In response to the user's requirements, the system explores the possibilities for providing the characteristics in the existing storage environment. The system then implements the logical volume and stores the intent, along with a corresponding set of rules for configuring the logical volume, with the logical volume. As a result, volume management operations like resizing the volume and evacuating data from the volume use the rules to preserve the intent of the creator. By ensuring that the logical volume consistently conforms to rules fulfilling the original intent, a consistent level of availability of the logical volume can be achieved to fulfill contractual availability requirements for storage service level agreements.

Abstract: A method, system, and computer program product to enable a user to specify an intended use for a logical volume. The logical volume is configured using an application-specific template (also referred to as a user template) for an application, where the application-specific template satisfies the intended use. Rules from the application-specific template are stored with the logical volume in addition to or as part of the intent.

Abstract: A method, system, and computer program product for preserving the intent of a logical volume creator with the logical volume. The creator of a logical volume defines certain characteristics of that logical volume. In response to the user's requirements, the system explores the possibilities for providing the characteristics in the existing storage environment. The system then implements the logical volume and stores the intent, along with a corresponding set of rules for configuring the logical volume, with the logical volume. As a result, volume management operations like resizing the volume and evacuating data from the volume use the rules to preserve the intent of the creator. By ensuring that the logical volume consistently conforms to rules fulfilling the original intent, a consistent level of availability of the logical volume can be achieved to fulfill contractual availability requirements for storage service level agreements.

Abstract: A method, system, and language to express storage requirements. The language provides keywords and rules corresponding to commands for configuring a set of storage devices to provide requested capabilities of a logical volume. The language also has keywords and constructs for defining capabilities. The language supports direct inheritance of a capability, where a template specifies another template that contains rules to be used to provide a given capability. The language also supports indirect inheritance of a capability, where a template requires a capability but does not provide an implementation of the capability. In addition, the language is processed to “merge” rules by selecting a single storage device that conforms to more than one rule when possible. Merging rules enables a minimum number of storage devices to be used to meet a given logical volume configuration and set of capabilities.

Abstract: A method, system, and computer program product to enable a user to specify an intended use for a logical volume. The logical volume is configured using an application-specific template (also referred to as a user template) for an application, where the application-specific template satisfies the intended use. Rules from the application-specific template are stored with the logical volume in addition to or as part of the intent.

Abstract: A method, system, language, and computer program product to enable a user to provide a high-level specification of storage requirements without having detailed knowledge of the underlying vendor-specific APIs and command line utilities for each possible storage device used to meet the storage requirements. The user does not specify how to implement the storage requirements. The system implements the high-level specification in hardware and/or software without further direction from the user.

Abstract: A method, system, and computer program product for adaptively implementing capabilities of a logical volume. If a particular capability is an inherent attribute of an existing storage device, the existing storage device is chosen to implement the volume. If the particular capability is not an inherent attribute of an existing storage device, one or more storage devices are selected and configured to provide the capability. If a capacity is requested for the logical volume and a storage device provides only a portion of the capacity, multiple storage devices having the capability are combined to provide the requested capability and capacity.