Method and apparatus for integrated network security alert information retrieval
US8146146B1 · kind B1 · utility
Assignee
Inventors
Key dates
| Filing date | Dec 23, 2005 |
| Grant date | Mar 27, 2012 |
| Priority date | — |
| Expiry date | Nov 20, 2028 |
Classification
- Technology area (CPC H)Electricity
- CPC primaryH04L63/1416
- WIPO fieldDigital communication
- WIPO sectorElectrical engineering
Abstract
A method and apparatus are disclosed whereby databases containing information related to an IP address are accessed directly from within a threat management software tool. When an alert is generated, an element within that alert, such as an IP address, is linked to one or more databases internal to an organization containing information related to the location or identity of a user or computer at a particular IP address. If no matches for that element are found in internal databases, a search of a registry of IP addresses is conducted. Finally, if the searches of internal and external databases are inadequate, an active scan of the device at that particular IP address or a router associated with that IP address is conducted. In this way, information related to a security threat is easily and efficiently obtained to enable a security analyst to better isolate that threat.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.