Patent ID: 11902306
Assignee: SPLUNK INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 14:
15. A system comprising:
a first electronic device to implement a data intake and query system, the data intake and query system including instructions that upon execution cause the data intake and query system to:
execute a first query against timestamped event data stored in a data store to identify a first set of events, wherein the timestamped event data is generated by the data intake and query system based on raw machine data obtained from one or more components of an information technology (IT) environment, wherein the first query identifies events associated with a type of security incident, wherein events in the first set of events are assigned a first severity level by an IT and security operations application, wherein a second set of events stored in the data store do not satisfy the first query, and wherein events in the second set of events are assigned a second severity level that is less than the first severity level, and
execute a second query against the second set of events that do not satisfy the first query to identify a third set of events, and wherein events in the third set of events do not individually indicate a security incident triggering an automated set of actions; and

a second one or more electronic devices to implement the IT and security operations application in a cloud provider network, the IT and security operations application including instructions that upon execution cause the IT and security operations application to:
identify, based on execution of the second query against the second set of events, a security event associated with an automated set of actions to be implemented by the IT and security operations application, and
implement the automated set of actions.