Patent ID: 9621572
Date: 2017-04-11
CPC Classifications: G06F,H04L

Claim:
1. A workflow system for executing a query on network traffic data in connection with incident response, the system comprising: agent software for execution at an endpoint, the software configurable for executing computer instructions for: a processor configured at the agent service for managing multiple instances of the agent software executing at multiple endpoints and for receiving forensic file containers; a processor configured for acquiring network traffic data; a data store device for storing the network traffic data in a first packet capture file; a processor configured for network traffic indexing by: a processor configured for executing a query by: a processor configured for executing a query on the index for corresponding data in the first packet capture file, where the query parameter for the index file is based on the one or more parameters relating to network traffic data in the forensic file container; and a processor configured for providing results responsive to a query on the acquired network traffic data through a secured web interface accessible only to clients with a current credential, an associated user certificate, or a secure token.