Patent ID: 7685627
Filing Date: 2010-03-23
Classification: H04L

Abstract:
1. A system for identifying events relating to a network incident, comprising: a policy store that provides network policies that include an Internet Protocol Security (IPSec) policy and a firewall policy, each policy comprising rules, each rule including a condition and an action, the network policies being stored using a common schema, the actions of the rules including an action to generate a policy enforcement event notification; a memory storing computer-executable instructions of a notification queue for storing policy enforcement event notifications, firewall event notifications, and IPSec event notifications; a monitoring tool that monitors event notifications generated by the firewall component, the IPSec component, and the policy engine and when the network incident occurs, identifies from the notification queue, firewall events, IPSec events, and policy enforcement events related to the network incident; and a processor for executing the computer-executable instructions stored in the memory.