Patent ID: 9183385
Filing Date: 2015-11-10
Classification: G06F,H04L

Abstract:
1. A method for providing feedback on a proposed security rule, the method comprising the steps of: receiving, by a computer, entry of a proposed security rule during a security-rule creation session; during the proposed security-rule creation session, testing, by the computer, the proposed security-rule by applying the proposed security rule to historical logged event data; determining, by the computer, a number of matches returned by the proposed security rule that result from application of the proposed security-rule to the historical logged event data, wherein the number of matches indicate a predicted performance of the proposed security rule as part of a network security system; notifying, by the computer, a user as to the number of matches during the security-rule creation session; and sending, by the computer, a message to the user during the proposed security-rule creation session, wherein the message includes a recommended change for one or more portions of the proposed security based, at least in part, on the number of matches and a threshold number of matches.