Patent ID: 8973141
Filing Date: 2015-03-03
Classification: G06F,G06T,H04L

Abstract:
1. A network security system comprising: non-transitory memory storing: plural use cases operable to identify predetermined conditions in data from plural sources, the predetermined conditions including indications of unauthorized network accesses; a streaming data source having network telemetry from plural sensors, at least some of the network telemetry including one or more events and one or more actors, the network telemetry associated with authorized and unauthorized network accesses, the streaming data source storing the network telemetry in one of three entity tables including an IP address entity table, an IP address/hostname table, and an IP address/hostname and user name table; a precorrelation core interfaced with the data source and operable to associate events and actors, each event defined as a type selected from the group of flow, authenticate, access, security and policy event types, the precorrelation core associating entities of the entity tables as plural nodes in a node table, each node having a merged group of entities linked to each other with events in a links table to relate entities from different entity tables as the same actor; and a fan out graphical user interface depicting events associated by actor.