Patent ID: 9129257
Filing Date: 2015-09-08
Classification: G06F,G06Q

Abstract:
1. A method comprising: designating, by at least one processor, a user as a high risk user candidate; placing the high risk user candidate on a watch list of high risk user candidates and designating, in the watch list, a monitoring status of the high risk user candidate as not being monitored; after said designating the user, initiating monitoring of activities of a computing device associated with identity information of the user and changing, in the watch list, the monitoring status of the high risk user collecting event data from the computing device and from one or more data sources according to one or more predetermined parameters that specify asset information; correlating the event data with one or more predetermined high risk events and by the identity information of the user for confirming that the user is a high risk user; collecting one or more events from the computing device and the one or more data sources; cross referencing the collected one or more events with specified high risk events or activities to determine whether the collected one or more events is a high risk event or activity; upon determining the collected one or more events is a high risk event or activity, comparing the collected one or more events with the watch list; and generating, based on the comparing, a high risk user event to output an alert.