Abstract: A parallel and distributed query engine for federated searching is disclosed herein. As contemplated by the present disclosure, the system may provide a single application programming interface that allows a user to access and analyze multiple enterprise data storage locations remotely and simultaneously while presenting and reporting information from the multiple sources in a single, uniform display. Such a solution may allow a user to analyze and cross-reference data stored in multiple locations by using multiple queries in real time without requiring the actual data files to be displaced or combined. The system may further implement interactive artificial intelligence assistant, natural language processing, and workflow-based operations for improved user access and functionality.

Abstract: A virtual data lake system created with browser-based decentralized data access and analysis is disclosed herein. As contemplated by the present disclosure, the system provides a single interface that allows a user to access and analyze multiple enterprise data storage locations remotely and simultaneously while presenting and reporting information from the multiple sources in a single, uniform display. Such a solution allows a user to analyze and cross-reference data stored in multiple locations in real time without requiring the actual data files to be displaced or combined. The system further implements interactive artificial intelligence, natural language processing, and workflow-based operations for improved user access and functionality.

Abstract: A virtual data lake system created with browser-based decentralized data access and analysis is disclosed herein. As contemplated by the present disclosure, the system provides a single interface that allows a user to access and analyze multiple enterprise data storage locations remotely and simultaneously while presenting and reporting information from the multiple sources in a single, uniform display. Such a solution allows a user to analyze and cross-reference data stored in multiple locations in real time without requiring the actual data files to be displaced or combined. The system further implements interactive artificial intelligence, natural language processing, and workflow-based operations for improved user access and functionality.

Abstract: The artificial intelligence-assisted information technology data management and natural language playbook system disclosed herein is designed to support current enterprise information technology security personnel by providing a faster and easier method for finding information or anomalies in current system data and logs. Enterprise security divisions often use multiple security information and event management (SIEM) software platforms to monitor their personnel data and logs, though even the use of such platforms requires advanced knowledge and skill on behalf of the user. The current system allows security users of all skill levels to interact using natural language processing with the system and effectively investigate such data and logs. The system assists such users by interacting with these SIEM platforms on their behalf and providing the users with access to pre-programmed natural language inquiry sequences, called “playbooks,” and easily customizable output displays.

Abstract: The artificial intelligence-assisted information technology data management and natural language playbook system disclosed herein is designed to support current enterprise information technology security personnel by providing a faster and easier method for finding information or anomalies in current system data and logs. Enterprise security divisions often use multiple security information and event management (SIEM) software platforms to monitor their personnel data and logs, though even the use of such platforms requires advanced knowledge and skill on behalf of the user. The current system allows security users of all skill levels to interact using natural language processing with the system and effectively investigate such data and logs. The system assists such users by interacting with these SIEM platforms on their behalf and providing the users with access to pre-programmed natural language inquiry sequences, called “playbooks,” and easily customizable output displays.

Abstract: Methods and systems for attributing monitored network activity to a user are provided. In one aspect, a method includes receiving profile data associated with a user and monitored network activity data. The method includes attributing at least one network activity associated with at least one client device to the user. The method also includes generating a timeline comprising an event at a particular time point on the timeline corresponding to the at least one network activity associated with the at least one client device that is attributed to the user; updating the timeline to include subsequent network activities of the monitored network activity data that are attributed to the user; and monitoring the timeline to detect at least one security anomaly based on the updated timeline.

Abstract: An asset model import connector includes an interface to receive asset data from a data source and a normalize module. The normalize module determines an operation to be performed at a system based on the received asset data and determines code to perform the determined operation. The schema may be populated with attributes from the asset data, and sent to the system.

Abstract: A network asset information management system (101) may include an asset determination and event prioritization module (105) to generate real-time asset information based on network activity involving an asset (102). A rules module (109) may include a set of rules for monitoring the network activity involving the asset. An information analysis module (110) may evaluate the real-time asset information and the rules to generate a notification (111) related to the asset. The rules may include rules for determining vulnerabilities and risks associated with the asset based on comparison of a level of traffic identified to or from an IP address related to the asset to a predetermined threshold. The notification may include a level of risk associated with the asset.

Abstract: A network asset information management system (101) may include an asset determination and event prioritization module (105) to generate real-time asset information based on network activity involving an asset (102). A rules module (109) may include a set of rules for monitoring the network activity involving the asset. An information analysis module (110) may evaluate the real-time asset information and the rules to generate a notification (111) related to the asset. The rules may include rules for determining vulnerabilities and risks associated with the asset based on comparison of a level of traffic identified to or from an IP address related to the asset to a predetermined threshold. The notification may include a level of risk associated with the asset.

Abstract: An asset model import connector includes an interface to receive asset data from a data source and a normalize module. The normalize module determines an operation to be performed at a system based on the received asset data and determines code to perform the determined operation. The schema may be populated with attributes from the asset data, and sent to the system.

Abstract: A network asset information management system (101) may include an asset determination and event prioritization module (105) to generate real-time asset information based on network activity involving an asset (102). A rules module (109) may include a set of rules for monitoring the network activity involving the asset. An information analysis module (110) may evaluate the real-time asset information and the rules to generate a notification (111) related to the asset. The rules may include rules for determining vulnerabilities and risks associated with the asset based on comparison of a level of traffic identified to or from an IP address related to the asset to a predetermined threshold. The notification may include a level of risk associated with the asset.

Abstract: A system for extending event processing through services includes an event process module to process event data according to event processing rules and services. A build-time system provides an interface for adding or modifying services. A service request gateway receives service requests from service consumers and receives event data from event data providers and provides the service requests to a service container module and provides the event data to the event process module. The service container modules invokes services for the service requests.

Abstract: A data storage system includes a query manager to identify storage engines to execute a query. A first storage engine may execute a portion of the query on a row-oriented table and a second storage engine may execute a second portion of the query on a column-oriented table.

Abstract: Mapping event data to a domain schema includes receiving (301) event data for an event, wherein the event data is arranged in a source schema of a data source providing the event data. A best fit domain schema is determined (302) from a plurality of domain schemas, wherein the domain schemas include different fields from the source schema. The event data in the source schema is mapped (303) to the best fit domain schema.

Abstract: A system for extending event processing through services includes an event process module to process event data according to event processing rules and services. A build-time system provides an interface for adding or modifying services. A service request gateway receives service requests from service consumers and receives event data from event data providers and provides the service requests to a service container module and provides the event data to the event process module. The service container modules invokes services for the service requests.

Abstract: A system for extending event processing in an information and event management system includes an event stream application engine. The event stream application engine manages event stream applications, which includes installing the event stream applications in the information and event management system. The installed event stream applications are available to be deployed in an event data processing run-time environment to process event data received at the information and event management system. The system includes an event process extender to the event stream applications in an event stream processing workflow. Each event stream application in the workflow is to process the event data if the event stream application determines the event data to be relevant to processing performed by the event stream application..