Patent ID: 9715675
Date: 2017-07-25
CPC Classifications: G06Q

Claim:
1. A method for event-driven incident customizable automated workflows for incident remediation, comprising: monitoring activity in a network with an activity monitor implemented on a processor coupled to the network; collecting a plurality of events with the activity monitor, the plurality of events based on a violation of a security policy; filtering the collected plurality of events with the activity monitor based on pre-determined patterns defining events of interest to select filtered events, wherein the filtered events comprise single events of interest or running windows of events; analyzing the filtered events with a correlation analysis engine implemented on the processor; correlating two or more of the filtered events based on a set of correlation rules defining characteristics of one or more events that comprise an incident; detecting, with the correlation analysis engine, one or more incidents associated with the monitored activity based on the correlated two or more of the filtered events to identify one or more detected incidents; responsive to the detecting of the one or more incidents: receiving a set of one or more communications from the one or more devices consequent to the one or more alert work-items causing the one or more devices to generate alerts, where the set of one or more communications indicate a current status associated with the one or more system work-items, and, based on processing the set of one or more communications received, outputting for display information to graphically represent the current status associated with the one or more system work-items based on the workflow process instance of the incident object instance to track progress along a sequence in the workflow process instance to coordinate remediating the one or more incidents.