Patent ID: 9501345
Filing Date: 2016-11-22
CPC Classification: G06F

Claim Text:
1. A system for creating enriched log data comprising: at least one processor; and at least one memory coupled to the at least one processor, the at least one memory having stored therein instructions which when executed by any set of the at least one processors, perform a process for creating enriched log data, the process for creating enriched log data including: obtaining access to first log data of a first log data source, the first log data source being a first virtual machine instance; obtaining access to distinct log data of a plurality of distinct log data sources, each of the plurality of log data sources being of different virtual machine instances distinct from virtual machine instances of each other log data source of the plurality of log data sources; defining at least two virtual machine instance trigger events, the defined at least two virtual machine instance trigger events including a first trigger event being a security requirement setting event and a second trigger event being the creation or changing of access control lists; defining, responsive to the at least two virtual machine instance trigger events being defined, trigger event log entry data associated with the defined at least two virtual machine instance trigger events; monitoring, responsive to the at least two virtual machine instance trigger event being defined, log data of each log data source of the plurality of log data sources; detecting, as a result of the monitoring, trigger event log entry data in log data of a second log data source of the plurality of log data sources; inserting, into the first log data of the first log data source, the trigger event log data of the second log data representing the trigger event of a second virtual machine instance occurring; detecting, as a result of the monitoring, trigger event log entry data in log data of a third log data source of the plurality of log data sources; and inserting, into the first log data of the first log data source, the trigger event log data of the third log data representing the trigger event of the third virtual machine instance occurring.