Abstract: Search results are received from an initiated free text search of log data from one or more logs, where the free text is performed using search terms entered into a free text search graphical user interface. A set of at least one search result is selected from the search results containing an event desired to be identified in a completed enterprise threat detection (ETD) pattern. A forensic lab application is rendered to complete an ETD pattern. An event filter is added for an event type based on normalized log data to a path. A relative ETD pattern time range is set and an ETD pattern is completed based on the added event filter.

Abstract: Published enterprise threat detection (ETD) security notes are accessed in a computer data store. Applicability of the published ETD security notes are determined for an information technology computing (IT) landscape. A determination is made that a particular applicable ETD security note has not yet been implemented in the IT computing landscape. Aggregated impact of compromise (IoC) and state of compromise (SoC) values associated with the published ETD security note are analyzed and a computing system patching action is performed based on the aggregated IoC and SoC values.

Abstract: An enterprise threat detection (ETD) forensic workspace is established according to a particular timeframe and permitting defining a selection of data types from available log data for an evaluation of events associated with one or more entities. A chart is defined illustrating a graphical distribution of a particular data type in the forensic workspace. A snapshot associated with the chart is generated, the snapshot saving a copy of all data necessary to re-create the chart into an associated snapshot object. The snapshot is associated with a snapshot page for containing the snapshot and the snapshot page is saved within the ETD forensic workspace.

Abstract: Subnet information and location information is received from a database by a smart data streaming engine (SDS). A particular subnet of the subnet information is associated with a particular location of the location information by a globally unique location ID value. Log event data received in the SDS is normalized as normalized log event data. The normalized log event data is enriched with subnet and location information as enriched log event data and written into a log event persistence in the database. A subnet ID value retrieved from an enriched log event of the enriched log event data is used by an enterprise threat detection (ETD) system to determine a location associated with the enriched log event using a location ID value associated with the subnet ID.

Abstract: A path associated with a set of selected log data is defined. An indication is received on a graphical user interface (GUI) to generate a bubblegram associated with the path, wherein the bubblegram comprises one or more bubbles, each bubble representing a particular dimension associated with the selected path. The one or more bubbles are rendered on the GUI according to a performed ranking of the one or more bubbles. A bubble is selected to generate a filter for the path based on the dimension associated with the bubble. A subsequent bubblegram is rendered based on a narrowed set of the selected log data.

Abstract: A selection of data types is defined from available log data for an evaluation of events associated with an entity. One or more evaluations are defined that are associated with the entity. Reference data is generated from the selection of data types based on the one or more defined evaluations. The one or more evaluations are grouped into a pattern. A visualization is initiated for display in a graphical user interface of a normalized score for the entity for each evaluation associated with the pattern against a determined anomaly threshold.

Abstract: A computer-implemented method generates a trigger registration for a selected triggering type. The generated trigger registration is stored in a triggering persistency. A received event from an event persistency is analyzed and data associated with the analyzed event is compared with the triggering persistency. Based on the comparison and using a pattern execution framework, an enterprise threat detection (ETD) pattern is processed to perform actions responsive to the received event.

Abstract: Techniques for mapping of messages includes receiving, from a first web service, a message comprising one or more operations in a first format; identifying a mapping interface that is based on the first web service, the mapping interface comprising one or more mappings for each of the operations of the message; identifying a second web service that is associated with the identified mapping interface; mapping the message to the second web service such that the one or more operations are in a second format associated with the second web service; and assigning a logical port connection to the second web service.

Abstract: Techniques for mapping of messages includes receiving, from a first web service, a message comprising one or more operations in a first format; identifying a mapping interface that is based on the first web service, the mapping interface comprising one or more mappings for each of the operations of the message; identifying a second web service that is associated with the identified mapping interface; mapping the message to the second web service such that the one or more operations are in a second format associated with the second web service; and assigning a logical port connection to the second web service.

Abstract: Systems, methods, and apparatus, including computer program products, are provided for communications between a client and server, both of which support a markup language, such as the Wireless Markup Language (WML). In one exemplary embodiment, the system, method, and apparatus may include generating, at a server, a WML deck, the WML deck including one or more first cards, the first cards having one or more first parameters; and generating, at a server, one or more second cards, the second cards having one or more second parameters, the second parameters determined to include a single instance of the first parameters to limit any duplicate first parameters.

Abstract: Systems, methods, and apparatus, including computer program products, are provided for communications between a client and server, both of which support a markup language, such as the Wireless Markup Language (WML). In one exemplary embodiment, the system, method, and apparatus may include generating, at a server, a WML deck, the WML deck including one or more first cards, the first cards having one or more first parameters; and generating, at a server, one or more second cards, the second cards having one or more second parameters, the second parameters determined to include a single instance of the first parameters to limit any duplicate first parameters.