Patent ID: 11902306
Assignee: SPLUNK INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 0:
1. A computer-implemented method comprising:
executing a first query against timestamped event data stored in a data store to identify a first set of events, wherein the timestamped event data is generated by a data intake and query system based on raw machine data obtained from one or more components of an information technology (IT) environment, wherein the first query identifies events associated with a type of security incident, wherein events in the first set of events are assigned a first severity level by an IT and security operations application, wherein a second set of events stored in the data store do not satisfy the first query, and wherein events in the second set of events are assigned a second severity level that is less than the first severity level;
executing a second query against the second set of events that do not satisfy the first query to identify a third set of events, and wherein events in the third set of events do not individually indicate a security incident triggering an automated set of actions;
identifying, based on execution of the second query against the second set of events, a security event associated with an automated set of actions to be implemented by the IT and security operations application; and
implementing the automated set of actions.