Snapshot of a forensic investigation for enterprise threat detection

US10673879B2 · kind B2 · utility

Assignee

• SAP SE · DE

Inventors

• Florian Chrosziel · St. Leon-Rot, DE
• Jona Hassforther · Heidelberg, DE
• Thomas Kunz · Neckargemünd, DE
• Harish Mehta · Wiesenbach, DE
• Rita Merkel · Ilvesheim, DE
• Kathrin Nos · Nümbrecht, DE
• Wei-Guo Peng · Dallau, DE
• Eugen Pritzkau · Wiesloch, DE
• Marco Rodeck · Maikammer, DE
• Hartwig Seifert · Elchesheim-Illingen, DE
• Nan Zhang · San Diego, US
• Thorsten Menke · Bad Iburg, DE
• Hristina Dinkova · Schallstadt, DE
• Lin Luo · Sugar Land, US

Key dates

• Filing date: Sep 23, 2016
• Grant date: Jun 2, 2020
• Expiry date: Sep 23, 2036

Classification

• Technology area (CPC G): Physics
• CPC primary: G06F2201/865
• WIPO field: Computer technology
• WIPO sector: Electrical engineering

Abstract

An enterprise threat detection (ETD) forensic workspace is established according to a particular timeframe and permitting defining a selection of data types from available log data for an evaluation of events associated with one or more entities. A chart is defined illustrating a graphical distribution of a particular data type in the forensic workspace. A snapshot associated with the chart is generated, the snapshot saving a copy of all data necessary to re-create the chart into an associated snapshot object. The snapshot is associated with a snapshot page for containing the snapshot and the snapshot page is saved within the ETD forensic workspace.