Abstract: Examples disclosed herein relate to playbook-based security investigations using a card system framework. Some of the examples enable receiving an indication that a playbook is selected for investigating a security alert object, the playbook comprising a plurality of cards, wherein a first object definition associated with the security alert object comprises a parameter, and wherein the playbook inherits a value of the parameter from the first object definition; causing a first card from the playbook to be displayed on a user interface, the first card comprising a first content tile that describes the security alert object; and causing a second card from the playbook to be displayed on the user interface, the second card comprising a second content tile that describes a second object, wherein a second object definition associated with the second object comprises the parameter inherited from the first object definition.

Abstract: A network sensor that features a data store and a packet processing engine. In communication with the data store, the packet processing engine comprises (1) a cache management logic and (2) deduplication logic. The cache management logic is configured to analyze packets to determine whether (a) a packet under analysis include duplicated data and (b) content of the packet is targeted for storage in a same continuous logical storage area as the duplicated data. The deduplication logic, when activated by the cache management logic, is configured to generate a deduplication reference for insertion into the packet prior to storage.

Abstract: Examples disclosed herein relate to using a card system framework. Some of the examples enable receiving, via a user interface, an indication that a first content item is requested about a first object; in response to the indication that the first content item is requested about the first object, presenting a first card on the user interface, the first card comprising a first content tile that describes a second object that is associated with the first content item; receiving, via the user interface, an indication that a second content item is requested about the second object; and in response to the indication that the second content item is requested about the second object, presenting a second card on the user interface, the second card comprising a second content tile that describes a third object that is associated with the second content item.

Abstract: Examples disclosed herein relate to security investigations using a card system framework. Some of the examples enable presenting a first card on a user interface, the first card comprising a first content tile that describes a first security alert object that is associated with a first plurality of content items, the first plurality of content items comprising at least one of: a source host identifier, an Internet Protocol (IP) address, a severity level, a confidence level, an alert status, a user identifier, an alert type, an attack stage, a port, a protocol, and a geographical location; and in response to an indication that a first content item among the first plurality of content item is requested about the first security alert object, presenting a second card on the user interface, the second card comprising a second content tile that describes a second entity object that is associated with a second plurality of content items.

Abstract: Examples disclosed herein relate to using a card system framework. Some of the examples enable receiving, via a user interface, an indication that a first content item is requested about a first object; in response to the indication that the first content item is requested about the first object, presenting a first card on the user interface, the first card comprising a first content tile that describes a second object that is associated with the first content item; receiving, via the user interface, an indication that a second content item is requested about the second object; and in response to the indication that the second content item is requested about the second object, presenting a second card on the user interface, the second card comprising a second content tile that describes a third object that is associated with the second content item.

Abstract: Examples disclosed herein relate to playbook-based security investigations using a card system framework. Some of the examples enable receiving an indication that a playbook is selected for investigating a security alert object, the playbook comprising a plurality of cards, wherein a first object definition associated with the security alert object comprises a parameter, and wherein the playbook inherits a value of the parameter from the first object definition; causing a first card from the playbook to be displayed on a user interface, the first card comprising a first content tile that describes the security alert object; and causing a second card from the playbook to be displayed on the user interface, the second card comprising a second content tile that describes a second object, wherein a second object definition associated with the second object comprises the parameter inherited from the first object definition.

Abstract: Examples disclosed herein relate to security investigations using a card system framework. Some of the examples enable presenting a first card on a user interface, the first card comprising a first content tile that describes a first security alert object that is associated with a first plurality of content items, the first plurality of content items comprising at least one of: a source host identifier, an Internet Protocol (IP) address, a severity level, a confidence level, an alert status, a user identifier, an alert type, an attack stage, a port, a protocol, and a geographical location; and in response to an indication that a first content item among the first plurality of content item is requested about the first security alert object, presenting a second card on the user interface, the second card comprising a second content tile that describes a second entity object that is associated with a second plurality of content items.

Abstract: A network sensor that features a data store and a packet processing engine. In communication with the data store, the packet processing engine comprises (1) a cache management logic and (2) deduplication logic. The cache management logic is configured to analyze packets to determine whether (a) a packet under analysis include duplicated data and (b) content of the packet is targeted for storage in a same continuous logical storage area as the duplicated data. The deduplication logic, when activated by the cache management logic, is configured to generate a deduplication reference for insertion into the packet prior to storage.

Abstract: A pipelined out-of-order process and system for handling data packets in a network device. The process and system are scalable to support throughput in excess of 10 Gbps. The system includes a set of processing cores that offload the table look up operations and similar operations from the central processing unit. The central processing unit receives the requisite data needed for performing forwarding, routing, NAT, firewall maintenance and similar operation on data packets from the set of processing cores.

Abstract: A pipelined out-of-order process and system for handling data packets in a network device. The process and system are scalable to support throughput in excess of 10 Gbps. The system includes a set of processing cores that offload the table look up operations and similar operations from the central processing unit. The central processing unit receives the requisite data needed for performing forwarding, routing, NAT, firewall maintenance and similar operation on data packets from the set of processing cores.

Abstract: A method and a search engine are described. A unique key is received. A hash is searched for a match to the unique key. Concurrently with searching the hash, a cache is searched for the match to the unique key. And information regarding the unique key is obtained.

Abstract: An internet service node (ISN) enabling the provision of desired service policies to each subscriber. The ISN may contain multiple processor groups, with each subscriber being assigned to a processor group. The assigned processor group may be configured with the processing rules, which provide the service policies desired, by a subscriber. A port may determine the specific processor group to which received data is to be forwarded. A content addressable memory with masks for individual locations may be implemented to quickly determines the processor group to which received data is to be assigned to. Due to the features of the present invention, an ISN may be able to serve a large number of subscribers efficiently. The ISN may be used at the edge of an access network.

Abstract: A device for use in a computer system, particularly a personal computer (PC) which provides compatibility for a proposed ISA plug and play (PNP) standard. The device of the present invention is also backward compatible with non-PNP (legacy) PCs. Upon power-up, a device may initialize using default traditional or specification (ISA) values for I/O address, IRQ and DMA channels. If PNP activity by the host PC is detected by the device, the device is disabled, and awaits activation and I/O address, IRQ and DMA channel assignments from a host PC. If no PNP activity by a host PC is detected, the device continues to operate using default traditional or specification (ISA) I/O address, IRQ and DMA channels. The device of the present invention may be installed in PNP or legacy type PCs without reconfiguring hardware (e.g., DIP switches, jumpers or the like) in the device or installing new firmware, operating system, or applications software in a host PC.