Patent ID: 11876809
Assignee: SPLUNK INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 0:
1. A method comprising, by a computing device:
accessing a security model definition, wherein the security model definition maps transaction phases of a multi-phase cyber-attack to categories of detection sources that are within an information technology (IT) environment and that are capable of detecting a security threat;
determining, for each event in a set of events generated from raw machine data produced by assets in the IT environment, zero or more transaction phases associated with the event, wherein the event is associated with a data source in the IT environment that produced the event, and wherein the zero or more transaction phases are determined by comparing the data source associated with the event to the categories of detection sources mapped by the security model definition to the transaction phases;
filtering the set of events to determine a subset of the events, wherein each event in the subset includes a field value identifying a particular asset in the IT environment;
determining, using the zero or more transaction phases determined for each event in the set of events, that a plurality of events in the subset of the events involving the particular asset are associated with a plurality of the transaction phases defined by the security model definition;
determining that the plurality of the transaction phases of the multi-phase cyber-attack have impacted the particular asset based on: updating a record of an asset table to include the plurality of the transaction phases in a set of completed transaction phases for the particular asset and searching the asset table to determine that the set of completed transaction phases in the record satisfies a designated condition; and
performing, in response to determining that the multi-phase cyber-attack has impacted the particular asset, a predetermined automated response.