Patent ID: 6530024
Filing Date: 2003-03-04
Classification: G06F,H04L

Abstract:
A system for managing security occurrences in a networked computing environment having one or more target computing systems, comprising:means for defining security procedures in the network computing environment, wherein said security procedures include an audit policy, a collection policy, a detection policy, and a security policy; means for implementing said defined security procedures at said one or more target computing systems a target agent associated with said one or more target computing systems, said target agent being configured to monitor activities in a networked computing environment in accordance with said security procedures and to maintain records of said activities in a local event log file; a detection engine configured to collect said activities from said target agent and to determine whether a security occurrence is occurring based on said collected activities; and a response service configured to update said security procedures in response to a detected security incident; wherein said means for implementing said defined security procedures is further configured to implement said updated security procedures.