Devices, systems, and methods for standardizing and streamlining deployment of security information and event management artifacts for multiple tenants

Abstract

To provide devices, systems, and methods for standardizing and streamlining deployment of security information and event management artifacts for multiple tenants.SOLUTION: The method can include: providing a Security Information, and an Event Management (SIEM) management application configured to be hosted by a SIEM provider server communicably coupled to a tenant server; coupling, via a data connector, the SIEM management application to a log source hosted by the tenant server, wherein the data connector is configured to control a flow of data to and from the log source; generating a JavaScript Object Notation (JSON) based solution bundle for the log source; visually displaying, via a user interface, a SIEM protocol for the tenant server based, at least in part, on the JSON-based solution bundle; and deploying the protocol from the SIEM provider server to the tenant server.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS This application claims the benefit of priority under 35 U.S.C. § 119(e) to U.S. Provisional Patent Application No. 63 / 196,991, filed June 4, 2021, entitled “DEVICES, SYSTEMS, AND METHODS FOR STANDARDIZING & STREAMLINING THE DEPLOYMENT OF SECURITY INFORMATION & EVENT MANAGEMENT ARTIFACTS FOR MULTIPLE TENANTS,” the entire disclosure of which is incorporated herein by reference.

[0002] The present disclosure relates generally to network security, and more particularly, to improved devices, systems, and methods for issuing security information and event management (SIEM) client updates. Summary of the Invention

[0003] The following summary is provided to facilitate understanding of some of the innovative features unique to the aspects disclosed herein and is not intended to be a complete description, A complete understanding of the various aspects can be obtained by taking the specification, claims, and abstract in their entirety.

[0004] In various aspects, a method for enhancing network security across multiple tenants configured to host multiple client applications is disclosed, the method including providing a SIEM management application configured to be hosted by a security information and event management (SIEM) provider server communicatively coupled to a tenant server, coupling the SIEM management application to log sources hosted by the tenant server via data connectors, the data connectors configured to control a flow of data to and from the log sources, generating a JavaScript Object Notation (JSON) based solution bundle for the log source via the SIEM management application, visually displaying a proposed SIEM protocol for the tenant server based, at least in part, on the JSON based solution bundle via a user interface of the SIEM management application, and deploying the proposed SIEM protocol from the SIEM provider server to the tenant server via the SIEM management application.

[0005] In various aspects, a system for enhancing network security is disclosed. The system can include a tenant server configured to host a data connector and a log source configured to control a flow of data between a display and the log source, and a security information and event management (SIEM) provider server communicatively coupled to the tenant server and the display, the SIEM provider server configured to store and execute a SIEM management application configured to couple the SIEM provider server to the data connector, generate a JavaScript Object Notation (JSON) based solution bundle for the log source, cause the display to visualize a user interface of the SIEM management application including a proposed SIEM protocol for the tenant server, where the SIEM protocol is based at least in part on the JSON based solution bundle, and deploy the proposed SIEM protocol from the SIEM provider server to the tenant server.

[0006] In various aspects, disclosed is a security information and event management (SIEM) provider server communicatively coupled to a tenant server and a display configured to store and execute a SIEM application configured to cause the SIEM provider server to couple the SIEM provider server to data connectors, generate JavaScript Object Notation (JSON) based solution bundles for log sources hosted by the tenant server, cause the display to visualize a user interface of a SIEM management application including a proposed SIEM protocol for the tenant server, where the SIEM protocol is based, at least in part, on the JSON based solution bundle, and deploy the proposed SIEM protocol from the SIEM provider server to the tenant server.

[0007] These and other objects, features, and characteristics of the invention as well as the method of operation, function of the associated structural elements, combination of parts, and economies of manufacture will become more apparent from a consideration of the following description and appended claims which refer to the accompanying drawings, all of which form a part hereof, and in which like reference characters indicate corresponding parts in the various views, It is to be expressly understood, however, that the drawings are for the purpose of illustration and description only and are not intended as a definition of the limits of the invention. [Brief description of the drawings]

[0008] Various features of the aspects described herein are set forth with particularity in the appended claims, however the various aspects, both as to organization and method of operation, and their advantages may be understood from the following description taken in conjunction with the accompanying drawings, as follows:

[0009] [Figure 1]FIG. 1 illustrates a diagram of a system configured to standardize and streamline the deployment of security information and event management (SIEM) artifacts for multiple tenants in accordance with at least one non-limiting aspect of the present disclosure.

[0010] [Diagram 2] FIG. 2 illustrates an implementation diagram of the system of FIG. 1 including a SIEM management application in accordance with at least one non-limiting embodiment of the present disclosure. [Figure 6] Continued from Figure 2.

[0011] [Diagram 3] FIG. 3 illustrates a bundle file generated by the system of FIG. 1 in accordance with at least one non-limiting embodiment of the present disclosure.

[0012] [Figure 4] FIG. 4 illustrates a graphical user interface of the SIEM management application of FIG. 2 for the deployment of the bundle file of FIG. 3 in accordance with certain non-limiting aspects of the present disclosure.

[0013] [Diagram 5] FIG. 5 illustrates a method for standardizing and streamlining the deployment of SIEM artifacts for multiple tenants in accordance with some non-limiting aspects of the present disclosure.

[0014] Corresponding reference characters indicate corresponding parts throughout the several views. The embodiments described herein are illustrative of various aspects of the present invention in one form only, and such embodiments should not be construed as limiting the scope of the present invention in any manner. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0015] The applicant of this application owns the following US provisional patent applications, the disclosures of each of which are incorporated herein by reference in their entirety: -U.S. Provisional Patent Application No. 63 / 294,570, filed December 29, 2021, entitled DEVICES, SYSTEMS, AND METHODS FOR PROVISIONING AND UPDATING SECURITY INFORMATION & EVENT MANAGEMENT ARTIFACTS FOR MULTIPLE TENANTS; -U.S. Provisional Patent Application No. 63 / 295,150, filed December 30, 2021, entitled DEVICES, SYSTEMS, AND METHODS FOR STREAMLINING AND STANDARDIZING THE INGEST OF SECURITY DATA ACROSS MULTIPLE TENANTS; -U.S. Provisional Patent Application No. 63 / 302,828, filed on January 25, 2022, entitled DEVICES, SYSTEMS, AND METHODS FOR REMOTELY MANAGING ANOTHER ORGANIZATION'S SECURITY ORCHESTRATION, AUTOMATION, AND RESPONSE; -U.S. Provisional Patent Application No. 63 / 313,422, filed on February 24, 2022, entitled DEVICES, SYSTEMS, AND METHODS FOR IDENTIFYING CYBER ASSETS AND GENERATING CYBER RISK MITIGATION ACTION BASED ON DOMAIN REDIRECTS; -U.S. Provisional Patent Application No. 63 / 341,264, filed May 12, 2022, entitled DEVICES, SYSTEMS, AND METHODS FOR SUMMARIZING ANALYTIC OBSERVATIONS; -U.S. Provisional Patent Application No. 63 / 344,305, filed May 20, 2022, entitled DEVICES, SYSTEMS, AND METHODS FOR INGESTING & ENRICHING SECURITY INFORMATION TO AUTONOMOUSLY SECURE A PLURALITY OF TENANT NETWORKS; -U.S. Provisional Patent Application No. 63 / 345,679, filed May 25, 2022, entitled DEVICES, SYSTEMS, AND METHODS FOR IDENTIFYING CYBER ASSETS AND GENERATING CYBER RISK MITIGATION ACTIONS BASED ON A DEMOCRATIC MATCHING ALGORITHM; -International Patent Application No. PCT / 2022 / 072739, entitled DEVICES, SYSTEMS, AND METHODS FOR ENHANCING SECURITY INFORMATION & EVENT MANAGEMENT UPDATES FOR MULTIPLE TENANTS BASED ON CORRELATED, AND SYNERGISTIC DEPLOYMENT NEEDS, filed on June 3, 2022, the disclosure of which is incorporated herein by reference in its entirety.

[0016] Numerous specific details are described in this disclosure to provide a thorough understanding of the overall structure, function, manufacture, and use of the embodiments described in the accompanying drawings. Well-known operations, components, and elements have not been described in detail so as not to obscure the embodiments described herein. The reader will understand that the embodiments described and illustrated herein are non-limiting embodiments. It will therefore be understood that the specific structural and functional details disclosed herein may be representative and illustrative. Changes and modifications can be made without departing from the scope of the claims. Furthermore, it should be understood that such terms as "front", "back", "left", "right", "upper", "lower", and similar terms are terms of convenience and should not be construed as limiting terms.

[0017] In the following description, like reference numerals indicate like or corresponding parts throughout the several views of the drawings, and it should be understood that in the following description, such terms as "front," "rear," "left," "right," "upper," "lower," etc. are terms of convenience and should not be construed as terms of limitation.

[0018] Before describing in detail the various aspects and methods of the system disclosed herein, it should be noted that the exemplary aspects are not limited in application or use to the details disclosed in the accompanying drawings and description. It should be understood that the exemplary aspects may be implemented or incorporated in other aspects, variations, and modifications, and may be practiced or carried out in various ways. Furthermore, unless otherwise indicated, the terms and expressions used herein have been selected for the purpose of describing the exemplary aspects for the convenience of the reader, and are not intended to be limiting thereof. For example, it will be understood that any reference to a particular manufacturer, software suite, application, or development platform disclosed herein is merely intended to illustrate some of the many aspects of the disclosure. This includes any reference to trademarks. Thus, it should be understood that the devices, systems, and methods disclosed herein can be implemented to enhance any software update according to any intended use and / or user preference.

[0019] As used herein, the term "server" may refer to or include one or more computing devices that operate through or facilitate communication and processing for multiple parties in a network environment, such as the Internet or any public or private network. As used herein, references to a "server" or "processor" may refer to the previously enumerated servers and / or processors that are enumerated as performing the previous steps or functions, different servers and / or processors and / or combinations of servers and / or processors.

[0020] As used herein, the term "constant" may refer to one or more SIEM functions that do not change during the issuance of an alert. For example, the constants may include Azure Sentinel Log Analytics functions, among others. According to some non-limiting aspects, the constants may be specifically configured according to the preferences and / or requirements of an individual client. For example, as described herein, the alert rules may be the same for all client deployments. However, the apparatus uses, systems, and methods disclosed herein may use client-specific constants to "fine-tune" how alerts are managed for each particular client. In other words, each constant may include a whitelist of specific protocols, accounts, etc., where the alert rule manages those constants separately (e.g., skips them).

[0021] As used herein, the term "platform" is intended to include an ecosystem of software and / or physical resources necessary to enable the technical benefits provided by the software. For example, a platform may include either a standalone software product or a software product configured to integrate with other software or physical resources in the ecosystem necessary for the software to provide its technical benefits. According to some non-limiting aspects, the technical benefits provided by the software are provided to the physical resources of the ecosystem or to other software employed by the physical resources in the ecosystem (e.g., APIs, services, etc.). According to other non-limiting aspects, a platform may include a framework of several software applications that are intended and designed to function together.

[0022] As used herein, the term "network" is intended to include the entire enterprise information technology (IT) system deployed by a tenant. For example, a network may include a group of two or more nodes (e.g., devices) connected by any physical and / or wireless connection and configured to communicate and share information with one or more other nodes. However, the term network is not limited to any particular node or any particular means of connecting the nodes. A network may include any combination of devices (e.g., servers, desktop computers, laptop computers, personal digital assistants, mobile phones, wearables, smart appliances, etc.) connected to an Ethernet, intranet, and / or extranet and configured to communicate with each other via ad-hoc connections (e.g., Bluetooth, Near Field Communication (NFC), etc.), local area connections (LANs), wireless local area networks (WLANs), and / or virtual private networks (VPNs), regardless of the physical location of each device. A network may further include any tools, applications, and / or services deployed by the devices or otherwise utilized by enterprise IT systems, such as firewalls, email clients, document management systems, office systems, etc. In some non-limiting aspects, the "network" may include third-party devices, applications, and / or services that are owned and controlled by a third party, but that a tenant is authorized to access corporate IT systems.

[0023] Security information and event management (SIEM) includes software configured to aggregate and analyze activity from many different resources across an information technology (IT) infrastructure. For example, a SIEM may be implemented to aggregate data from multiple systems and analyze the data to catch anomalous behavior or potential cyber attacks. For example, a SIEM may collect security data from network devices, servers, domain controllers, etc. A SIEM may be implemented to store, normalize, aggregate, and apply analytics to that data to detect trends, detect threats, and enable an organization to investigate any alerts. While known SIEM tools offer great functionality, such as monitoring events, collecting data, and issuing security alerts across a network, such tools are typically customized to the implementing organization, i.e., more specifically, to a particular network architecture, which can often be complex. Thus, SIEM can be expensive, resource intensive, and often difficult to resolve issues with SIEM data.

[0024] Examples of commonly implemented SIEMs include Azure Sentinel and Salesforce Cloud, Devo, LogRhythm, IBM's QRadar, Securonix, McAfee Enterprise Security Manager, LogPoint, Elastic Stack, ArcCyto Enterprise Security Manager, and InsightIDR. Deploying Azure Sentinel as a cloud-based tool has gained widespread acceptance among Managed Security Service Providers (MSSPs), and as such, Azure Sentinel is described as a non-limiting example. However, of course, other SIEMs are contemplated by this disclosure. Like most SIEMs, deploying Azure Sentinel can be highly skilled, time-consuming, and error-prone. Each organization needing a security solution has specific needs regarding ingest log sources, detection / alert rules, response automation, monitoring such as reporting, and alerts. Microsoft (MSFT) is often used by MSSPs to manage multiple clients, but the complexity of initial configuration, deployment, and ongoing maintenance of artifacts (e.g., resource groups, log analysis workspaces, alert rules, workbooks, playbooks, etc.) increases significantly. This can result in high costs for both MSSPs, who have to hire more expensive specialists, and for their clients, who often bear at least part of the increasing expenses. However, there is often an overlap between some deployment needs of different clients. For example, many organizations may need similar firewall monitoring solutions. In these cases, reusing and redeploying (and updating) assets can lead to significant cost savings and operational simplification. Unfortunately, known SIEM tools are not technically capable of taking advantage of these synergies.As a result, from initial provisioning to automating incident response, MSSPs have limited opportunities for reuse to capture efficiencies across multiple clients. Hence the need for improved devices, systems, and implementation methods, as well as the issuance of SIEM client updates. These enhancements can improve the technical performance and cost efficiency of the SIEM, including the deployment of detection rules, visualizations, investigation workbooks, and ongoing maintenance.

[0025] Thus, there is a need for devices, systems, and methods that employ an automated "as a service" approach to generate and deploy a reusable pre-packaged solution that can be executed in a single step while providing a complete end-to-end SIEM solution. Such devices, systems, and methods can deploy a Sentinel implementation with a single click of a button with minimal understanding of SIEM (e.g., Sentinel, Azure, etc.). Thus, such devices, systems, and methods can be used to extend cloud-based SIEM implementations in a consistent and repeatable manner. Users only need to provide the location where the entire deployment is to take place and / or login credentials for the respective client.

[0026] This disclosure presents such devices, systems, and methods, all of which provide numerous technical benefits and enable MSSPs to deploy cloud-based SIEM implementations, such as an Azure Sentinel implementation, at scale, repeatedly, and consistently. For example, the devices, systems, and methods disclosed herein may include (1) a means for dynamically plugging in JavaScript Object Notation (“JSON”) based solution bundle descriptions of various Sentinel artifacts (e.g., resource groups, log analytics workspaces, data connectors, alert rules, playbooks, workbooks, etc.), referred to herein as “SIEM-in-a-Box,” (2) a visual interface for authorized users to select the desired SIEM-in-a-box bundle; (3) an action button to “deploy” the selected bundle to the user’s desired SIEM subscription, which essentially creates all the necessary artifacts (e.g., resource groups, log analytics workspaces, etc.), configures the appropriate data connectors (specific to the selected bundle), and creates the analysis / alert rules, and playbooks, workbooks, queries required for the solution as required by the specific bundled configuration; (4) configuring a back-end Service Operating Center (SOC) to onboard new clients with well-defined automation rules in response to events triggered by alerts / detections configured for a specific bundle; and (5) a service provider (e.g., Azure An MSSP / CSP model can be offered where the bundle provider (via Lighthouse, etc.) can deploy the bundle on the client's behalf into each of the client's workspaces. Thus, the bundle provider only manages the relationship with the MSSP / CSP, with sufficient filtering by client workspace that responds to a specific alert / incident. This can be important for efficient billing, support, and avoiding unnecessary client interactions.

[0027] Conventional MSSP devices, systems, and methods are not only technically incapable of automation, but also highly impractical, if not impossible, for an MSSP to continually manually monitor hundreds (if not thousands) of tenant networks in real time. The devices, systems, and methods disclosed herein are also technically configured to be adaptable. This adaptability, combined with high scalability, allows an MSSP to track changes across a large number of tenant deployments, monitor responses to those changes, and autonomously implement for any suitable tenant deployment that can similarly benefit. In other words, conventional MSSP devices, systems, and methods are inherently susceptible to security events and are therefore technically less secure than the devices, systems, and methods disclosed herein.

[0028] Referring now to FIG. 1, a diagram of a system 1000 configured to enforce SIEM updates is shown in accordance with at least one non-limiting embodiment of the present disclosure. According to the non-limiting embodiment of FIG. 1, the system 1000 may include a SIEM provider server 1002 having a memory 1006 configured to store a SIEM management application 102 and a processor 1004 configured to execute the stored SIEM management application 102, as further discussed with reference to FIG. 2. For example, the SIEM provider server 1002 may be a computing resource owned or leased by an MSSP. The SIEM provider server 1002 may be communicatively coupled to a plurality of tenants 1010a, 1010b-1010n via a network 1008. Each of the plurality of tenants 10101, 10102-1010 may include a processor 1004 configured to execute the stored SIEM management application 102. nmay represent customers (e.g., organizations) that have contracted with the MSSP. According to non-limiting aspects of Figure 1, network 1008 may include any of a variety of wired, long-range wireless, and / or short-range wireless networks. For example, network 1008 may include an internal intranet, a local area network (LAN), WiFi, a cellular network, a near field communication (NFC), etc.

[0029] Further referring to FIG. 1, each of a plurality of tenants 10101, 10102 to 1010 n Each of the tenants 10101 and 10102 may host one or more instances of one or more clients 1012, 1014, 1016. For example, a first tenant 10101 may include one or more machines implementing one or more client applications 10121, 10122-1012n, and a second tenant 10102 may include one or more machines implementing one or more client applications 10141, 10142-1014n. n and / or a third tenant 1010. n One or more client applications 10161, 10162 to 1016 n Each of the tenants 10101, 10102, and 1010 n For example, each tenant 10101, 10102, and 1010 n The SIEM provider server 1002 may include an intranet in which each machine implements a client application, each of which may represent a customer, such as an organization that contracts with the MSSP for security services. n 10101, 10102, and 10103, and is therefore responsible for monitoring and managing each client application 1012, 1014, and 1016 against threats. nDifferences and complexities in architectures can make this complicated and inefficient for MSSPs. Therefore, known SIEM tools only manage tenants 10101, 10102, and 1010. n In accordance with non-limiting aspects of the present disclosure, the SIEM provider server 1002 may implement a SIEM management application 102 that addresses these deficiencies technically and practically by enhancing the SIEM provider server's 1002 management and alert sending capabilities, and client application update capabilities, for multiple tenants based on correlation and synergistic development needs.

[0030]

[0023] Referring now to Figure 2, a deployment diagram 100 of the system 1000 of Figure 1 is shown, including a SIEM management application 102, i.e., a visualization tool, in accordance with at least one non-limiting aspect of the present disclosure. The deployment diagram of Figure 2 includes visual widgets that correspond to various structural and / or functional elements of the system 1000 (see Figure 1). According to some non-limiting aspects, the system 100 of Figure 2 can provide an integrated visual environment that can enable management of a customer's deployments, including: (1) a catalog of various artifacts (e.g., alert rules, playbooks, workbooks, etc.); (2) the ability to select a desired artifact and deploy the selected artifact to a specific target Sentinel environment for the customer with a single click; (3) the ability to visualize all client deployments, including current and outdated deployments (e.g., via alert rules that indicate that some deployments have newer versions that need to be deployed); and (4) the ability to visualize deployment status (e.g., color-coded) and quickly deploy updates with the click of a button.

[0031] 2, system 100 may be configured to provide SIEM services, security information management, and security event management for multiple tenants simultaneously while providing real-time analysis of security alerts generated by applications and network hardware. For example, system 100 may include one or more tenant servers 10101, 10102, 10103, 10104, 10105, 10106, 10107, 10108, 10109, 10200, 10201, 10202, 10203, 10204, 10205, 10206, 10207, 10208, 10209, 10300, 10301, 10302, 10303, 10304, 10305, 10306, 10307, ​​10308, 10309, 10400, 10401, 10401, 10401, 10401, 10402, 10403, 10404, 10405, 10406, 10407, 10408, 10409, 10500, 10501, 10501, 10502, 10503, 10504, 10505, 10506, 10507, 10508, 10509, 10600, 10601, 10601, 10602, 10603, 10604, 10605, 10606, 10607, 10608, 10609, n (see FIG. 1 ) to execute the SIEM management application 102 executing on the SIEM provider server 1002 (see FIG. 1 ). For example, according to one non-limiting embodiment, the client application 104 can include management for viewing and deploying the software configuration of the SIEM application 110, a number of alert rules, and constants 112 associated with one or more automation playbooks 116, deployment, monitoring, and updating workbooks 114 for dashboards, management of fine-tuning of alerts via constants, and incidents 118. Additionally, the system 1000 of FIG. 1 can include mechanisms for detecting differences, visualizing, and updating out-of-date alert rules 112 across deployments of one or more SIEM applications 110, including SIEM applications 110 provided by other vendors. The SIEM management application 102 can be monitored by a security engineer / analyst 106. For example, according to one non-limiting embodiment, the SIEM management application 102 can be implemented to monitor and manage SIEM applications 110, such as Azure Sentinel. However, it should be appreciated that the SIEM management application 102 may be implemented to monitor and manage any number of SIEM applications 110 independent of Azure Sentinel.

[0032] With further reference to FIG. 2, the system 1000 (see FIG. 1) may further include one or more client application interfaces 104, including various clouds 128, firewalls 130, servers 132, via data connectors 120 configured to couple, for example, the SIEM provider server 1002 (see FIG. 1) to one or more tenant servers 1010 (see FIG. 1). For example, the data connectors 120 may connect the SIEM management application 102, or more generally, the SIEM provider server 1000 (see FIG. 1), to various log (data) sources (e.g., Outlook, etc.) associated with the tenant server 1010 (see FIG. 1). Thus, one or more users 138 (e.g., security engineers, analysts, content engineers, etc.) may interface with the client application interfaces 104 to create and / or edit artifacts. Each artifact may be pushed to the tenant server 1010 (see FIG. 1) via the data connectors 120. As discussed herein, in some non-limiting aspects, one or more artifacts can be bundled and sent in bulk to a tenant server 1010 (see FIG. 1 ) in a similar architecture. Additionally and / or alternatively, the SIEM management application 102 can be configured to integrate with a third party application server (not shown), such as a content repository 140 (e.g., GitHub / GitLab, etc.) that includes deployable artifact templates. Those skilled in the art will appreciate that GitHub can be used as a basic code repository, issue tracking, documentation, and wiki. Similar to GitHub, GitLab is a repository manager that allows teams to collaborate on code and can provide similar functionality to GitHub for issue tracking and project management.

[0033] According to one non-limiting aspect, the content repository 140 may include a JSON file that is specifically configured to define alert rules, workbooks, playbooks, etc. for a particular tenant server 1010 (see FIG. 1 ), and more specifically, for a particular tenant architecture. An example of such a JSON file 300 is discussed with further reference to FIG. 3 . Thus, the SIEM management application 102 may identify and / or collaborate with the content repository 140 to define alert rules, workbooks, playbooks, etc. for multiple tenant servers 10101, 10102-1010 of similar architecture. n (see FIG. 1 ). As discussed further with reference to FIG. 4 , the SIEM management application 102 can then be configured to generate a bundled JSON file 300 (see FIG. 3 ) that defines alert rules, workbooks, playbooks, etc. for multiple tenant servers 10101, 10102, 10103, 10104, 10105, 10106, 10107, 10108, 10109, 10200, 10201, 10202, 10203, 10204, 10205, 10206, 10207, 10208, 10209, 10300, 10301, 10301, 10302, 10303, 10304, 10305, 10306, 10307, ​​10308, 10309, 10400, 10401, 10401, 10401, 10401, 10401, 10402, 10403, 10404, 10405, 10406, 10407, 10408, 10409, 10500, 150 ... n (See FIG. 1)

[0034] 2, as new content is added or updated in the JSON file, the changes can be automatically pushed to the SIEM management application 102. In one aspect, the SIEM management application 102 may be configured as, for example, Azure Sentinel Automation Portal (ASAP). In one aspect, the ASAP portal runtime software code can include server middleware responsible for processing content from the content repository 140, connecting to the SIEM application 110, and other services, as well as servicing requests to the client application 104 for deploying, updating, and reading content to and from the SIEM application 110. In one aspect, the client application 104 provides a unified, simplified view of all client deployments and the ability to work with one or multiple clients 104 at the same time.

[0035] 2 allows a security analyst 106 to not only see everything that is being deployed, but also update a single artifact in a single client 104, or multiple artifacts across multiple clients 104 with a simple interaction. Additionally, the SIEM management application 102 can identify and / or collaborate with a content repository 140 to provide a single, centralized, and centralized management solution for multiple tenant servers 10101, 10102-10104 of similar architecture. n (See FIG. 1 ), the SIEM management application 102 can reduce the complexity of the initial configuration, deployment, and ongoing maintenance of artifacts (e.g., resource groups, log analysis workspaces, alert rules, workbooks, playbooks, etc.). In other words, with the click of a button, a user can configure artifacts and distribute them across multiple tenant servers 10101, 10102-10103. n(see FIG. 1). Thus, the system 1000 (see FIG. 1) can provide an automated "as a service" approach to generate and deploy reusable pre-packaged solutions that can be executed in a single step while providing a complete end-to-end SIEM solution. This capability allows MSSPs to scale to hundreds or thousands of clients 104 with minimal staff and minimal skills required. Produced or updated content, such as new alert rules 112 that validate the presence of new malware, can be pushed to all clients 102 immediately. Moreover, in one aspect, many of these operations can be automated on a schedule.

[0036] With further reference to the non-limiting aspects of FIG. 2, the SIEM management application 102 can, for example, show all changes, deployed vs. new or updated in the content repository 140, to the SIEM application 110 of each client 104, evaluate what the changes were, and very quickly push the changes, updates, or new artifacts. Additionally, in some non-limiting aspects, the user interface commands that perform the various deployments can be captured as scripts, checked into the client's 104 repository for validation, and automatically deployed at a predefined time. According to some non-limiting aspects, the hosted cloud SIEM management application 102 can provide "one-click automation" capabilities. For example, the SIEM management application 102 can automate the creation, configuration, and implementation of the SIEM application 110, including alert rules 112, constants, parsers, data connectors 120, playbooks 116, workbooks 114, and the like. In one aspect, the SIEM management application 102 also provides management of deployments across all clients 104. The SIEM management application 102 provides visibility into all client 104 deployments, what as well as where, updating existing alerts 112, playbooks 116, etc. across any number of clients 104, and deploying newly added alert rules 112 and other assets.

[0037] The SIEM management application 102 enables one-click automation 134 of REST APIs, alerts 112, playbooks 116, and the like. Those skilled in the art will appreciate that a REST API, also known as a RESTful API, is an application programming interface (API or web API) that conforms to the constraints of the REST architectural style and enables interaction with RESTful web services. An API (Application Programming Interface) is a set of definitions and protocols for building and integrating application software. The SIEM management application 102 provides real-time data integration of the REST APIs, alerts 112, playbooks 116, and the like, into a flexible server relational cloud database 146 service, such as Azure Postgres SQL Database, for example.

[0038] The SIEM management application 102 interfaces with resource providers and normalizers 136. The resource providers and normalizers 136 interface with log analysis workspaces 142, Microsoft Graph, and Microsoft resource manager 144. The system 1000 (see FIG. 1 ) also includes Microsoft Azure, a mission-critical cloud, Azure Government 152, which provides U.S. government customers and their partners with groundbreaking innovations accessible only to U.S. federal, state, local, and tribal governments, and their partners, in screened U.S. citizen-managed operations. Microsoft Azure, and Azure Government 152, interface with Node 150. React 148 provides an interactive UI for the accounts 108. Still referring to FIG. 2 , in one aspect, the SIEM management application 102 provides a quick view across all deployments and statuses, as well as the ability to navigate directly to where a given alert is deployed and its state.

[0039] 3, a bundle file 300 generated by the system 1000 of FIG. 1 is illustrated in accordance with at least one non-limiting aspect of the present disclosure. According to the non-limiting aspect of FIG. 3, the bundle file 300 may be presented in a JSON format and may be configured to dynamically integrate with the SIEM management application 102 of FIG. 2, including various artifacts (e.g., data connectors, alert rules, playbooks, workbooks, etc.). In other words, the bundle file 300 may define itself as a "SIEM-in-a-Box" and may be easily deployed. In other words, upon deployment, the bundle file 300 of FIG. 3 may create all of the SIEM artifacts required for the corresponding data connector 120 (see FIG. 2) (specific to the selected bundle).

[0040] According to a non-limiting embodiment of FIG. 3, the bundle file 300 may include various fields that are predetermined and / or autonomously generated by the SIEM management application 102 (see FIG. 2). For example, according to a non-limiting embodiment of FIG. 3, the bundle file 300 may include a log source identifier 302, such as "Outlook 365." In other words, the bundle file 300 of FIG. 3, when deployed, will implement and / or update one or more SIEM artifacts that manage the security of data associated with Outlook 365. The bundle file 300 of FIG. 3 may further include one or more data connector identifiers 302. a~c , for example, "Office 365," "AzureActivityLog," and "AzureActiveDirectory." Additionally, the bundle file 300 of FIG. 3 may include one or more artifact identifiers 304 a-f to manage SIEM activity and events occurring in association with the identified log sources 302, as described above. For example, according to a non-limiting embodiment of FIG. 3, one or more artifact identifiers 304 a-f may be included in the bundle file 300. a~fmay contain multiple alerts that are issued in association with a particular SIEM event.

[0041] With further reference to FIG. 3, according to another non-limiting aspect, the artifact identifier 304 a~f More generally, the bundle file 300 may be defined according to a predefined template stored in the content repository 140 (see FIG. 2). For example, according to some non-limiting aspects, the artifact identifier 304 a~f may collectively define a playbook or collection of procedures that may be executed by the SIEM management application 102 (see FIG. 2) in response to a particular alert or incident. In yet another non-limiting aspect, the artifact identifier 304 a~f can be defined according to a workbook, or a large pool of possibilities for SIEM management of the identified log sources 302. Such workbooks can range from data presentation and formatting to complex graphing and resource exploration maps. According to yet another non-limiting aspect, the artifact identifiers 304 a~f can be defined according to specific resource groups and / or log analysis workspaces.

[0042] With further reference to the non-limiting embodiment of FIG. 3, artifact identifier 304 e The bundle file 300 of FIG. 3 corresponds to a specific alert rule MS-A022 associated with the Azure Active Directory data connector and is automatically deployed. The bundle file 300 of FIG. 3 is generated when the SIEM management application 102 (see FIG. 2) and / or the content repository 140 (see FIG. 2) detects an artifact identifier 304 a~f Data Connector 304 b3 thus highlights the malleability of the bundle file 300 generated by the SIEM management application 102 (see FIG. 2) and / or the system 1000 (see FIG. 1).

[0043] It should be appreciated that the bundle file 300 of FIG. 3 may be generically deployed based on high-level architectural features for a particular tenant, such as a particular data connector 120 (see FIG. 2) and / or a particular log source. Thus, the bundle file 300 represents a technical improvement over known automation practices, which employ a "deployment as code" approach. In known processes, automation requires complex scripts and often requires tenant-specific modifications before deployment. Conversely, the bundle file 300 allows for "one-click" end-to-end deployment without the need for manual user intervention. Furthermore, the bundle file 300 of FIG. 3 allows for end-to-end deployment that can span any SIEM environment (e.g., SOC, MDR, etc.). The bundle file 300 is script-driven and simply requires the user to define the desired state, APIs, and code logic for deployment. Additionally, several deployment bundles 300 may be displayed for user selection via the SIEM management application 102 (see FIG. 2). In other words, the SIEM management application 102 (see FIG. 2) may assign the appropriate artifact identifier 304 to a particular data connector 120 (see FIG. 2), log source, and / or tenant server 1010 (see FIG. 1) based on the tenant architecture. a~f can be automatically identified, generated, ported, and / or deployed, which significantly reduces the architecture or tenant-specific work required to configure the SIEM management process.

[0044] 4, a graphical user interface 400 of the SIEM management application 102 of FIG. 2 for deployment of the bundle file 300 of FIG. 3 is illustrated in accordance with at least one non-limiting aspect of the present disclosure. According to a non-limiting aspect of FIG. 4, the graphical user interface 400 may be displayed when a user 106 (see FIG. 2) (e.g., an engineer, analyst, etc.) selects a bundle file for deployment, such as the bundle file 300 of FIG. 3. The user interface 400 may then present a SIEM protocol to the user based at least in part on the selected bundle file 300 (see FIG. 3). According to the user interface 400 of FIG. 4, the user may select and / or load pre-selected variables (e.g., defaults) associated with a desired tenant environment. In some non-limiting aspects, the variables 402, 404, 406 may collectively define a SIEM protocol solution. For example, the user interface 400 may prompt the user to review the tenant name 402, subscription type 404, resource group 404, workspace 406, one or more log sources 410, and / or the number of alert rules 412. According to some non-limiting aspects, the user interface 400 may suggest two or more SIEM protocols based at least in part on the selected bundle file 300 (see FIG. 3). In other words, the user interface 400 may present several "SIEM-in-a-Box" options for the data connector 120 (see FIG. 2). Once the user is satisfied with the variables associated with the desired tenant environment, they may then assign artifacts 304 to the selected data connector 120 associated with the log sources of the desired tenant server 1010 (see FIG. 1). a~f In one embodiment, the user may engage (e.g., click, select, etc.) an “Install Bundle” widget 414 in the user interface 400 to install the bundle file 300 (see FIG. 4), which includes all of the above.

[0045] Referring now to FIG. 5, a method 500 for standardizing and streamlining the deployment of SIEM artifacts for multiple tenants is illustrated in accordance with at least one non-limiting aspect of the present disclosure. According to a non-limiting aspect of FIG. 11, the method may generate and present one or more SIEM protocol solutions based on a JSON-based solution bundle for quick and easy deployment to a tenant server 1010 (see FIG. 1). The method 500 may include providing a security information and event management (SIEM) management application configured to be hosted by a SIEM provider server, the SIEM provider server being communicatively coupled to the tenant server at step 502. The method 500 may further include coupling the SIEM management application to a log source hosted by the tenant server via a data connector at step 504, the data connector being configured to control the flow of data to and from the log source. At step 506, the method 500 may include generating a JavaScript Object Notation (JSON)-based solution bundle for the log source via the SIEM management application. Next, method 500 may include requesting, via a user interface of the SIEM management application, displaying the proposed SIEM protocol for the tenant server based, at least in part, on the JSON-based solution bundle, at step 508. Finally, at step 510, method 500 may include deploying, via the SIEM management application, the proposed SIEM protocol from the SIEM provider server to the tenant server.

[0046] Various aspects of the subject matter described herein are set forth in the following numbered sections.

[0047] Section 1 1. A method for enhancing network security across multiple tenants configured to host multiple client applications, the method comprising: providing a SIEM management application configured to be hosted by a security information and event management (SIEM) provider server, the SIEM provider server communicatively coupled to a tenant server; coupling the SIEM management application to log sources hosted by the tenant server via data connectors, the data connectors configured to control a flow of data to and from the log sources; generating, via the SIEM management application, a JavaScript Object Notation (JSON) based solution bundle for the log source; visually displaying, via a user interface of the SIEM management application, a proposed SIEM protocol for the tenant server based, at least in part, on the JSON-based solution bundle; and deploying the proposed SIEM protocol from the SIEM provider server to the tenant server via the SIEM management application.

[0048] Section 2 2. The method of claim 1, wherein the proposed bundle includes a plurality of SIEM artifacts configured to manage how data connectors control the flow of data to and from the log sources.

[0049] Section 3 3. The method of claim 1 or 2, further comprising generating at least one of the plurality of SIEM artifacts via a SIEM management application.

[0050] Section 4 4. The method of any of claims 1-3, further comprising configuring a data connector based at least in part on the generated SIEM artifacts.

[0051] Section 5 5. The method of any of claims 1 to 4, wherein configuring the data connector is performed autonomously by a SIEM provider server.

[0052] Section 6 6. The method of any one of claims 1 to 5, wherein the plurality of SIEM artifacts includes at least one of a resource group, a log analysis workspace, a playbook, and a workbook, or a combination thereof.

[0053] Section 7 7. The method of any of clauses 1-6, wherein at least one of the plurality of SIEM artifacts includes a plurality of alert rules configured to manage how the data connector controls the flow of data to and from the log source.

[0054] Section 8 The method of any of clauses 1-7, wherein the proposed SIEM protocol for the tenant server is a first proposed SIEM protocol of a plurality of proposed SIEM protocols generated based, at least in part, on the JSON-based solution bundle, and the method further includes visually displaying, via a user interface of the SIEM management application, the plurality of proposed SIEM protocols.

[0055] Section 9 9. The system of any of claims 1-8, wherein deploying the proposed SIEM protocol from the SIEM provider server to the tenant server is based at least in part on a user selection of the proposed SIEM protocol from a plurality of proposed SIEM protocols.

[0056] Section 10 The system of any of claims 1 to 9, wherein the tenant server is a first tenant server of a plurality of tenant servers communicatively coupled to the SIEM provider server, and the proposed solution bundle is common to at least a subset of the plurality of tenant servers, and the method further includes aggregating, via the SIEM management application, the plurality of tenant servers into a workspace based, at least in part, on the common solution bundle.

[0057] Section 11 11. The method of any of claims 1 to 10, wherein deploying the proposed SIEM protocol further comprises deploying the proposed SIEM protocol from the SIEM provider server to each tenant server of a subset of the plurality of tenant servers.

[0058] Section 12 1. A system for enhancing network security, the system comprising: a display; a tenant server configured to host data connectors and log sources, the tenant server configured to control a flow of data to and from the log sources; and a security information and event management (SIEM) provider server communicatively coupled to the tenant server and the display, the SIEM provider server configured to store and execute a SIEM management application configured to: couple the SIEM provider server to the data connectors and generate JavaScript Object Notation (JSON) based solution bundles for the log sources; cause the display to visualize a user interface of a SIEM management application including a proposed SIEM protocol for the tenant server, the SIEM protocol being based, at least in part, on the JSON-based solution bundle; and deploy the proposed SIEM protocol from the SIEM provider server to the tenant server.

[0059] Section 13 13. The system of claim 12, wherein the proposed bundle includes a plurality of SIEM artifacts configured to manage how the data connectors control the flow of data to and from the log sources.

[0060] Section 14 14. The system of claim 12 or 13, wherein the SIEM management application is further configured to generate at least one of the plurality of SIEM artifacts to the SIEM provider server.

[0061] Section 15 15. The system of any of claims 12 to 14, wherein the SIEM management application is further configured to cause the SIEM provider server to configure a data connector based at least in part on the generated SIEM artifacts.

[0062] Section 16 16. The system of any of claims 12 to 15, wherein the SIEM management application is further configured to cause the SIEM provider server to autonomously configure the data connector.

[0063] Section 17 17. The system of any of claims 12-16, wherein the plurality of SIEM artifacts include at least one of a resource group, a log analysis workspace, a playbook, and a workbook, or a combination thereof.

[0064] Section 18 18. The system of any of clauses 12-17, wherein at least one of the plurality of SIEM artifacts includes a plurality of alert rules configured to manage how the data connector controls the flow of data to and from the log source.

[0065] Section 19 The system of any of clauses 12-18, wherein the proposed SIEM protocol for the tenant server is a first proposed SIEM protocol of a plurality of proposed SIEM protocols generated based, at least in part, on the JSON-based solution bundle, and the method further includes visually displaying the plurality of proposed SIEM protocols via a user interface of a SIEM management application.

[0066] Section 20 20. The system of any of claims 12-19, wherein deploying the proposed SIEM protocol from the SIEM provider server to the tenant server is based at least in part on a user selection of the proposed SIEM protocol from a plurality of proposed SIEM protocols.

[0067] Section 21 and a security information and event management (SIEM) provider server communicatively coupled to the tenant server and a display, the SIEM provider server configured to store and execute a SIEM management application configured to: couple the SIEM provider server to a data connector; generate a JavaScript Object Notation (JSON) based solution bundle for a log source hosted by the tenant server; cause the display to visualize a user interface of the SIEM management application including a proposed SIEM protocol for the tenant server, the SIEM protocol being based, at least in part, on the JSON-based solution bundle; and deploy the proposed SIEM protocol from the SIEM provider server to the tenant server.

[0068] Section 22 11. The SIEM provider server of claim 1, wherein the proposed bundle includes a plurality of SIEM artifacts configured to manage how the data connectors control the flow of data to and from the log sources.

[0069] All patents, patent applications, publications, or other disclosure materials described herein are incorporated herein by reference in their entirety, as if each individual reference were expressly incorporated by reference. All references and any material, or portions thereof, that are said to be incorporated herein by reference are incorporated herein only to the extent that the incorporated material does not contradict existing definitions, descriptions, or other disclosed material set forth in this disclosure. Therefore, and to the extent necessary, the present disclosure set forth herein takes precedence over any conflicting material incorporated herein by reference, and the present disclosure is expressly set forth within the control of this application.

[0070] Various exemplary and illustrative embodiments have been described. The embodiments described herein are understood to provide illustrative features of various details of the various embodiments of the present disclosure, and therefore, unless otherwise specified, it is to be understood that, to the extent possible, one or more features, elements, components, ingredients, materials, structures, modules, and / or aspects of the embodiments of the present disclosure may be combined, separated, substituted, and / or rearranged with or for one or more other features, elements, components, ingredients, materials, structures, modules, and / or aspects of the embodiments of the present disclosure without departing from the scope of the present disclosure. Thus, one skilled in the art will recognize that various substitutions, modifications, or combinations of any of the exemplary embodiments may be made without departing from the claimed subject matter. Moreover, one skilled in the art will recognize or be able to ascertain, upon review of this specification, many equivalents to the various embodiments of the present disclosure using no more than routine experimentation. Thus, the present disclosure is not limited by the description of the various embodiments, but only by the scope of the claims.

[0071] Those skilled in the art will recognize that the terms used herein in general, and in the appended claims in particular (e.g., the body of the appended claims), are generally intended as "open-ended" terms (e.g., the term "including" should be interpreted as "including but not limited to," the term "having" should be interpreted as "having at least," the term "includes" should be interpreted as "including but not limited to," etc.). It will be further understood by those skilled in the art that where recitation of a particular number of introduced claims is intended, such intent will be expressly recited in the claims, and in the absence of such recitation, no such intent exists. For example, as an aid to understanding, the following appended claims may include the use of the introductory phrases "at least one" and "one or more" to introduce the recitation of claims. However, the use of such phrases should not be construed as implying that the introduction of a claim recitation with the indefinite article "a" or "an" limits any particular claim that includes such an introduced claim recitation to claims that include only one of such recitations, even when the same claim includes the introductory phrases "one or more" or "at least one" and an indefinite article such as "a" or "an" (e.g., "a" and / or "an" should ordinarily be construed to mean "at least one" or "one or more").

[0072] Furthermore, even if a particular number of enumerations in an introduced claim are explicitly recited, one of ordinary skill in the art will recognize that such enumerations should typically be interpreted to mean at least the number recited (e.g., the mere enumeration of "two enumerations," without other modifiers, typically means at least two enumerations or more than two enumerations). Furthermore, in those cases where a convention similar to "at least one of A, B, and C, etc." is used, such a structure is generally intended in the sense that one of ordinary skill in the art would understand the convention (e.g., "a system having at least one of A, B, and C" includes, but is not limited to, A alone, B alone, C alone, a system having A and B together, a system having A and C together, a system having B and C together, and / or a system having A, B, and C together, etc.). In instances where a convention similar to "at least one of A, B, or C, etc." is used, such construction is generally intended in the sense that one of ordinary skill in the art would understand the convention (e.g., "a system having at least one of A, B, or C" includes, but is not limited to, A alone, B alone, C alone, a system having A and B together, a system having A and C together, a system having B and C together, and / or a system having A, B, and C together, etc.). It will be further understood by those of ordinary skill in the art that disjunctions and / or phrases, whether in the description, claims, or drawings, that typically present two or more alternative terms, should be understood to contemplate the possibility of including one of the terms, either of the terms, or both terms, unless the context dictates otherwise. For example, the phrase "A or B" will typically be understood to include the possibilities of "A" or "B" or "A and B."

[0073] With respect to the appended claims, those skilled in the art will appreciate that the actions recited therein may generally occur in any order. Also, while the claim recitations are presented in order(s), it should be understood that various actions may occur in other orders than those described, or may occur simultaneously. Examples of such alternative orders include overlapping, interleaving, interrupting, reordering, incremental, preparatory, supplementary, simultaneous, reverse, or other variant orders, unless the context dictates otherwise. Moreover, terms such as "responsive," "related to," or other past tense adjectives are generally not intended to exclude such variants, unless the context dictates otherwise.

[0074] It should be noted that any reference to "one embodiment," "embodiment," "exemplary," "one example," and the like means that a particular feature, structure, or characteristic described in connection with an embodiment is included in at least one embodiment. Thus, the appearances of the phrases "in one embodiment," "in an embodiment," "in an example," and "in one example" in various places throughout this specification do not necessarily all refer to the same embodiment. Furthermore, the particular features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0075] As used herein, the singular forms "a," "an," and "the" include plural references unless the context clearly dictates otherwise.

[0076] Directional terms used herein, such as, for example, but not limited to, up, down, left, right, below, upward, front, rear, and variations thereof, relate to the orientation of the elements as shown in the accompanying drawings and are not intended to be limiting with respect to the claims, unless expressly stated otherwise.

[0077] The term "about" or "approximately" as used in this disclosure, unless otherwise specified, refers to an acceptable error for a particular value as determined by one of ordinary skill in the art, which depends in part on how the value is measured or determined. In certain embodiments, the term "about" or "approximately" refers to within 1, 2, 3, or 4 standard deviations. In certain embodiments, the term "about" or "approximately" refers to within 50%, 200%, 105%, 100%, 9%, 8%, 7%, 6%, 5%, 4%, 3%, 2%, 1%, 0.5%, or 0.05% of a given value or range.

[0078] As used herein, unless otherwise indicated, all numerical parameters are to be understood as being predicated and, in all instances, the numerical parameter should be understood to be modified by the term "about" given the inherent variability characteristic of the underlying measurement technique used to determine the numerical value of the parameter. At the very least, and not as an attempt to limit the application of the doctrine of equivalents to the scope of the claims, each numerical parameter set forth herein should at least be construed in light of the number of reported significant digits and by applying ordinary rounding techniques.

[0079] Any numerical range recited herein includes all subranges subsumed within the recited range. For example, a range of 1 to 100 includes all subranges between (and including) the recited minimum value of 1 and the recited maximum value of 100, i.e., having a minimum value of 1 or more and a maximum value of 100 or less. Also, all ranges recited herein include the recited range endpoints. For example, a range of 1 to 100 includes the endpoints 1 and 100. Any maximum numerical limitation recited herein is intended to include all lower numerical limitations subsumed therein, and any minimum numerical limitation recited herein is intended to include all higher numerical limitations subsumed therein. Thus, applicants reserve the right to amend this specification, including the claims, to explicitly recite subranges that are subsumed within the explicitly recited ranges. All such ranges are inherently described herein.

[0080] Any patent application, patent, non-patent publication, or other disclosure material mentioned in this specification and / or listed in any application data sheet is incorporated herein by reference to the extent that the incorporated material does not contradict this specification. Thus, and to the extent necessary, the present disclosure as expressly set forth herein takes precedence over any conflicting material incorporated herein by reference. Any material or portion thereof that is said to be incorporated herein by reference but that contradicts an existing definition, statement, or other disclosure material set forth herein is incorporated only to the extent that no contradiction occurs between the incorporated material and the existing disclosure material.

[0081] The terms "comprise" (and any form of comprise, such as "comprises", "comprising"), "have" (and any form of have, such as "has" and "have"), "include" (and any form of include, such as "includes" and "including"), and "contain" (and any form of contain, such as "contains" and "containing") are open-ended linking verbs. As a result, a system that "comprises", "has", "contains", or "contains" one or more elements possesses those one or more elements, but is not limited to possessing only those one or more elements. Similarly, an element of a system, device, or apparatus that "comprises", "has", "contains", or "contains" one or more features possesses those one or more features, but is not limited to possessing only those one or more features.

[0082] The foregoing detailed description describes various aspects of devices and / or processes through the use of block diagrams, flow charts, and / or examples. Where such block diagrams, flow charts, and / or examples include one or more functions and / or operations, those skilled in the art will appreciate that each function and / or operation in such block diagrams, flow charts, and / or examples can be individually and / or collectively implemented by a wide range of hardware, software, firmware, or substantially any combination thereof. Those skilled in the art will recognize that some aspects of the aspects disclosed herein can be equivalently implemented in whole or in part in an integrated circuit as one or more computer programs running on one or more computers (e.g., as one or more programs running on one or more computer systems), as one or more programs running on one or more processors (e.g., as one or more programs running on one or more microprocessors), as firmware, or substantially any combination thereof, and that designing the circuitry and / or writing the code for the software and / or firmware is within the skill of those skilled in the art in light of this disclosure. Further, those skilled in the art will appreciate that the mechanisms of the subject matter described herein can be distributed as one or more program products in a variety of forms, and that the illustrative forms of the subject matter described herein apply regardless of the particular type of signal-bearing medium used to actually effect the distribution.

[0083] The instructions used to program the logic to implement the various disclosed aspects may be stored in a memory in the system, such as a dynamic random access memory (DRAM), cache, flash memory, or other storage device. Additionally, the instructions may be distributed over a network or via other computer-readable media. Thus, a machine-readable medium is any mechanism for storing or transmitting information in a form readable by a machine (e.g., a computer), including, but not limited to, a floppy diskette, an optical disk, a compact disk, a read-only memory (CD-ROM), and a magneto-optical disk, a read-only memory (ROM), a random access memory (RAM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic or optical card, a flash memory, or a tangible machine-readable storage device used in transmitting information over the Internet via an electrical, optical, acoustic, or other form of propagated signal (e.g., carrier wave, infrared signal, digital signal, etc.). Accordingly, non-transitory computer-readable media includes any type of tangible machine-readable medium suitable for storing or transmitting electronic instructions or information in a form readable by a machine (eg, a computer).

[0084] As used in any aspect of the present specification, the term "control circuitry" may refer to, for example, hardwired circuitry, programmable circuitry (e.g., a computer processor with one or more individual instruction processing cores, a processing unit, a processor, a microcontroller, a microcontroller unit, a controller, a digital signal processor (DSP), a programmable logic device (PLD), a programmable logic array (PLA), or a field programmable gate array (FPGA), a state machine circuit, firmware that stores instructions executed by the programmable circuit, and any combination thereof. Control circuitry may be embodied, collectively or individually, as circuitry that forms part of a larger system, e.g., an integrated circuit (IC), an application specific integrated circuit (ASIC), a system on a chip (SoC), a desktop computer, a laptop computer, a tablet computer, a server, a smartphone, etc. Thus, as used herein, "control circuitry" may refer to, for example, a hardwired circuit, a programmable logic device (e.g., a hardwired circuit), a programmable logic array (PLA), a programmable logic device (PLA), a programmable logic array (FPGA), a programmable logic device (PLD), a programmable logic array (PLA), or a field programmable gate ...FPGA), a programmable logic device (FPGA), a programmable logic device (FPGA), a programmable logic device (FPGA), a programmable logic device (FPGA), a programmable logic device (FPGA), a programmable logic device ( includes, but is not limited to, electrical circuitry having at least one discrete electrical circuit, electrical circuitry having at least one integrated circuit, electrical circuitry having at least one application specific integrated circuit, electrical circuitry forming a general purpose computing device configured by a computer program (e.g., a general purpose computer configured by a computer program at least in part to execute a process and / or a device described herein, or a microprocessor configured by a computer program at least in part to execute a process and / or a device described herein), electrical circuitry forming a memory device (e.g., a form of random access memory), and / or electrical circuitry forming a communication device (e.g., a modem, a communication switch, or an optoelectronic device).Those skilled in the art will recognize that the subject matter described herein may be implemented in an analog or digital fashion or some combination thereof.

[0085] As used in any aspect herein, the term "logic" may refer to an application, software, firmware, and / or circuitry configured to perform any of the aforementioned operations. Software may be embodied as a software package, code, instructions, instruction sets, and / or data recorded on a non-transitory computer-readable storage medium. Firmware may be embodied as code, instructions, or instruction sets, and / or data hard-coded (e.g., non-volatile) within a memory device.

[0086] As used in any aspect of this specification, the terms "component," "system," "module," etc. may refer to a computer-related entity, hardware, a combination of hardware and software, software, or software in execution.

[0087] As used in any aspect of the present specification, an "algorithm" refers to a self-consistent sequence of steps leading to a desired result, where the "steps" refer to manipulations of physical quantities and / or logical states which may, but need not, take the form of electrical or magnetic signals that can be stored, moved, combined, compared, and otherwise manipulated. It is common to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, or the like. These and similar terms may be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities and / or states.

Claims

1. 1. A method for enhancing network security across multiple tenants configured to host multiple client applications, comprising: providing a SIEM management application configured to be hosted by a security information and event management (SIEM) provider server, the SIEM provider server being communicatively coupled to a tenant server; coupling the SIEM management application to log sources hosted by the tenant servers via data connectors, the data connectors configured to control the flow of data to and from the log sources; generating, via the SIEM management application, a JavaScript Object Notation (JSON) based solution bundle for the log source; visually displaying, via a user interface of the SIEM management application, a proposed SIEM protocol for the tenant server based at least in part on the JSON-based solution bundle; deploying the proposed SIEM protocol from the SIEM provider server to the tenant server via the SIEM management application.

2. The method of claim 1 , wherein the proposed bundle includes a plurality of SIEM artifacts configured to manage how the data connectors control the flow of data to and from the log sources.

3. The method of claim 2 , further comprising generating at least one of the plurality of SIEM artifacts via the SIEM management application.

4. The method of claim 3 , further comprising configuring the data connectors based at least in part on the generated SIEM artifacts.

5. The method of claim 3 , wherein configuring the data connector is performed autonomously by the SIEM provider server.

6. The method of claim 2 , wherein the plurality of SIEM artifacts comprises at least one of a resource group, a log analysis workspace, a playbook, and a workbook, or a combination thereof.

7. 7. The method of claim 6, wherein at least one of the plurality of SIEM artifacts comprises a plurality of alert rules configured to govern how the data connector controls the flow of data to and from the log source.

8. 2. The method of claim 1 , wherein the proposed SIEM protocol for the tenant server is a first proposed SIEM protocol of a plurality of proposed SIEM protocols generated based at least in part on the JSON-based solution bundle, the method further comprising visually displaying the plurality of proposed SIEM protocols via a user interface of the SIEM management application.

9. 9. The method of claim 8, wherein deploying the proposed SIEM protocol from the SIEM provider server to the tenant server is based at least in part on a user selection of the proposed SIEM protocol from the plurality of proposed SIEM protocols.

10. 2. The method of claim 1 , wherein the tenant server is a first tenant server of a plurality of tenant servers communicatively coupled to the SIEM provider server, the proposed solution bundle being common to at least a subset of the plurality of tenant servers, and the method further comprising aggregating, via the SIEM management application, the plurality of tenant servers into a workspace based, at least in part, on the common solution bundle.

11. The method of claim 10 , wherein deploying the proposed SIEM protocol further comprises deploying the proposed SIEM protocol from the SIEM provider server to each tenant server of the subset of the plurality of tenant servers.

12. 1. A system for enhancing network security, comprising: A display and a tenant server configured to host a data connector and a log source, the data connector configured to control the flow of data to and from the log source; a security information and event management (SIEM) provider server communicatively coupled to the tenant server and to the display; Equipped with the SIEM provider server configured to store and execute a SIEM management application; The SIEM management application configures the SIEM provider server to: coupling the SIEM provider server to the data connector; generating a JavaScript Object Notation (JSON) based solution bundle for said log source; causing the display to visualize a user interface of a SIEM management application including a SIEM protocol proposed for the tenant server, the SIEM protocol being based at least in part on the JSON-based solution bundle; A system configured to deploy the proposed SIEM protocol from the SIEM provider server to the tenant server.

13. 13. The system of claim 12, wherein the proposed bundle includes a plurality of SIEM artifacts configured to manage how the data connectors control the flow of data to and from the log sources.

14. The system of claim 13 , wherein the SIEM management application is further configured to cause the SIEM provider server to generate at least one of the plurality of SIEM artifacts.

15. 15. The system of claim 14, wherein the SIEM management application is further configured to cause the SIEM provider server to configure the data connector based at least in part on the generated SIEM artifacts.

16. 16. The system of claim 15, wherein the SIEM management application is further configured to cause the SIEM provider server to autonomously configure the data connector.

17. 14. The system of claim 13, wherein the plurality of SIEM artifacts comprises at least one of a resource group, a log analysis workspace, a playbook, and a workbook, or a combination thereof.

18. 20. The system of claim 17, wherein the at least one SIEM artifact of the plurality includes a plurality of alert rules configured to govern how the data connector controls the flow of data to and from the log source.

19. 13. The system of claim 12, wherein the proposed SIEM protocol for the tenant server is a first proposed SIEM protocol of a plurality of proposed SIEM protocols generated based at least in part on the JSON-based solution bundle, the method further comprising visually displaying the plurality of proposed SIEM protocols via a user interface of the SIEM management application.

20. 20. The system of claim 19, wherein deploying the proposed SIEM protocol from the SIEM provider server to the tenant server is based at least in part on a user selection of the proposed SIEM protocol from the plurality of proposed SIEM protocols.

21. a security information and event management (SIEM) provider server communicatively coupled to the tenant server and the display, configured to store and execute a SIEM management application; The SIEM management application is configured to: coupling the SIEM provider server to the data connector; generating a JavaScript Object Notation (JSON) based solution bundle for a log source hosted by the tenant server; causing the display to visualize a user interface of a SIEM management application including a SIEM protocol proposed for the tenant server, the SIEM protocol being based at least in part on the JSON-based solution bundle; A SIEM provider server configured to cause the tenant server to deploy the proposed SIEM protocol from the SIEM provider server.

22. The SIEM provider server of claim 1 , wherein the proposed bundle includes a plurality of SIEM artifacts configured to manage how data connectors control the flow of data to and from the log sources.

Images