Patent Document ID: 10027711
Application ID: 13413586
Patent Flag: 1

Claim One:
1. An apparatus for situational awareness and video surveillance, comprising: an integration framework in communication with and configured to gather data from one or more IT resources, one or more physical access and control systems (PACS), and one or more industrial control systems, wherein said data comprises physical access events, wherein said integration framework is further configured to gather data using connectors that support industry standard protocols and interfaces using industry standard APIs, wherein the connectors comprise pre-defined custom connectors configured to gather data from custom data feeds, and wherein said one or more physical access systems is configured to provide video surveillance; a connector framework layer configured to connect, via said connectors, to said one or more IT resources, said one or more physical access and control systems (PACS), and said one or more industrial control systems, further configured to extract the corresponding data, wherein the connector framework layer comprises adaptors which support: a real-time data bus for a high speed connection pool for capturing real-time or near real-time data streams, including PI and SCADA; an enterprise information bus for a connection for capturing the data communication of enterprise data such as business data from enterprise systems and native databases; and offline and real time data extraction; and said connector framework layer further configured to normalize said gathered data and to comprise a persistent store configured to store said normalized data; a processor configured for mapping said one or more physical access control systems and said one or more industrial control systems to particular risks and vulnerabilities to help in risk mitigation; an alert and event management processor configured for managing said physical access events and correlating said physical access events with each other, said alert and event management processor further configured for registering events and corresponding user defined filters and further configured for automatically processing and analyzing a user defined event and the correlation of such event with said physical access events, when said user defined event is triggered; an alert action subsystem configured for providing geo-spatial monitoring and remediation of cross enterprise threats, by: providing a summary listing of active alerts; providing a line level item detail view of tasks associated with a particular alert of said active alerts, each task having a task owner and each task group having a task group owner, causing the task owner and the task group owner to act at different remediation tasks of a remediation task group; automatically indicating on a geo-spatial map a location of a detected incident by using an interactive icon on a dashboard on a network, wherein when activated, the interactive icon presents further detailed information via drill-down capability; automatically identifying a physical intrusion incident occurring at a physical substation that is defined as a critical asset in a utility network by overlaying a GUI element on a web mapping service to indicate the location of the intrusion; and generating, storing, and executing remediation scripts associated with the alerts, said remediation scripts being configured to execute at a specified time or in response to a trigger based on a particular event; a workflow processor configured for providing visualization and automated remedial action scripts using said mapping of said one or more PACS and said one or more industrial control systems to the particular risks and vulnerabilities to help remediate the threats immediately; and a risk engine configured for promoting alignment between said IT resources, said one or more PACS, and said one or more industrial control systems, including information technology (IT) functions, by aggregating threats from each of said IT resources, said one or more PACS, and said one or more industrial control systems and by accepting and using external feeds in said mapping to said particular risks and vulnerabilities, said external feeds comprising government repository of standards based vulnerability management data; said risk engine further configured to receive events generated from a user access session and determine in real-time a level of risk for each received event using user roles and user profiles extracted from said IT resources, said one or more PACS, and said one or more industrial control systems; said risk engine further configured to, based on said determined level of risk for each event, automatically enforce a policy by, via particular connectors of said connectors to physical access control, building controls and sensor networks: actively controlling access to the building based on said level of risk using imaging sensors and a building control and card access system; provisioning or de-provisioning according to said level of risk, using an access card provisioning and de provisioning system; providing visual scene representation based on said level of risk using video surveillance using biometrics coupled with providing capability to initiate a lockdown of a zone to isolate an incident; and using proximity sensors and control systems with radio frequency identification (RFID) technology.