Patent ID: 11876821
Assignee: SPLUNK INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 10:
11. A threat indicator detection system comprising:
a real-time path including a real-time analysis engine configured to receive first event data indicative of first activity on a computer network, the real-time analysis engine configured to detect, in real time, first anomaly data by applying a first machine learning anomaly detection model to the first event data;
a non-volatile storage system to store the first anomaly data;
a batch path including a batch analysis engine configured to operate concurrently in parallel with the real-time analysis engine, the batch analysis engine further configured to retrieve, from the non-volatile storage system, the first anomaly data and second event data indicative of second activity on the computer network, the batch analysis engine further configured to detect, in a batch mode, second anomaly data by applying a second machine learning anomaly detection model to the second event data and the first anomaly data;
a rules engine to detect third anomaly data using an anomaly detection rule; and
a threat detection engine configured to process the first anomaly data, the second anomaly data, and the third anomaly data using a threat indicator model to identify a threat indicator associated with a potential security threat to the computer network.