Patent Document ID: 9953176
Application ID: 14874265

Base Claim:
1. A method for processing activity records, the method comprising: establishing, by a computing system, an anonymization dictionary based on user activity encountered by the computing system, by: obtaining, by an endpoint agent executing on the computing system, an activity record, wherein the activity record comprises metadata documenting the user activity; generating, by an activity monitoring engine of the computing system that is operatively connected to the endpoint agent, the anonymization dictionary, wherein generating the anonymization dictionary comprises: detecting, in the activity record, a plurality of target entities, wherein each of target entities is metadata related to the user activity and requires anonymization; making a determination that a resource is associated with a subset of the target entities of the plurality of target entities; after making the determination: assigning an anonymized identity to the subset of target entities; generating an anonymization identifier for each target entity in the subset of target entities to obtain a plurality of anonymization identifiers each comprising the anonymized identity; and anonymizing user activity, based on the anonymization dictionary previously generated by the computing system by: processing, by an anonymization engine executing on the computing system, the activity record using the anonymization dictionary to obtain an anonymized activity record, by: replacing, in the activity record, target entities with their corresponding anonymized identifiers, specified in the anonymization dictionary; and storing the anonymized activity record.

---

Claim 6:
6. The method of claim 1 , further comprising: receiving an additional activity record; processing the additional activity record to obtain a second plurality of target entities; making a second determination that the anonymization dictionary does not have an entry to anonymize at least one of the second plurality of target entities; based on the second determination, updating the anonymization dictionary to include at least one additional entry in order to obtain an updated anonymization dictionary; and processing the additional activity record using the updated anonymization dictionary to obtain a second anonymized activity record.