APPARATUS, SYSTEM, AND METHOD FOR STREAMING AND STANDARDIZING SECURITY DATA INTAKE FROM MULTIPLE TENANTS - Patent application

Abstract

A method is disclosed for streamlining and standardizing the ingestion of security data from a plurality of tenant networks, each of the plurality of tenant networks including at least one log source, the method comprising: receiving, by each of a plurality of data gateway modules, raw log data from an associated log source thereof, generating, by each of the plurality of data gateway modules, formatted log data based on the raw log data, ingesting, by an edge module, the formatted log data from the plurality of data gateway modules, automatically updating, by a central control plane module, a configuration of at least one of the plurality of data gateway modules based on changes in an associated log source thereof, and performing, by a security monitoring system, a security action associated with at least one of the plurality of tenant networks based on the ingested formatted data.

Description

[Technical field]

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS This application is related to U.S. Provisional Patent Application No. 63 / 295,150, filed December 30, 2021, entitled "Apparatus, System, and Method for Streamlining and Standardizing the Ingestion of Security Data from Multiple Tenants," the disclosure of which is incorporated herein by reference in its entirety.

[0002] The present disclosure relates generally to network security, and more particularly to improved apparatus, systems, and methods for streamlining and standardizing the ingestion of data from multiple tenants. Summary of the Invention

[0003] The following summary is provided to facilitate understanding of some of the innovative features unique to the aspects disclosed herein and is not intended to be a complete description, A complete understanding of the various aspects can be obtained by taking the specification, claims, and abstract in their entirety.

[0004] In various aspects, a method is disclosed for streamlining and standardizing the ingestion of data from multiple tenant networks in a security monitoring system. In one aspect, the security monitoring system includes an edge module, a central control plane module, and multiple data gateway modules, each of the multiple data gateway modules associated with a different log source, and each of the multiple tenant networks includes at least one log source. In another aspect, the method includes receiving, by each of the multiple data gateway modules of the security monitoring system, raw log data from the log source associated therewith, generating, by each of the multiple data gateway modules of the security monitoring system, formatted log data based on the raw log data, ingesting, by the edge module of the security monitoring system, the formatted log data from the multiple data gateway modules, automatically updating, by the central control plane module of the security monitoring system, a configuration of at least one of the multiple data gateway modules based on changes in its associated log source, and performing, by the security monitoring system, a security action associated with at least one of the multiple tenant networks based on the ingested formatted data.

[0005] In various aspects, a security monitoring system is disclosed that can streamline and standardize the ingestion of data from a plurality of tenant networks, each of the plurality of tenant networks including at least one log source. In one aspect, the security monitoring system includes a plurality of data gateway modules, each of the plurality of data gateway modules associated with a different log source, each of the plurality of data gateway modules configured to generate formatted log data based on the raw log data and to receive the raw log data from its associated log source, an edge module configured to ingest the formatted log data from the plurality of data gateway modules, and a central control plane module configured to automatically update a configuration of at least one of the plurality of gateway modules in response to changes in the log source associated therewith, wherein the security monitoring system is configured to perform a security action associated with at least one of the plurality of tenant networks based on the ingested formatted data.

[0006] In various aspects, a system for streamlining and standardizing security data ingestion is disclosed. In one aspect, the system includes a plurality of tenant networks, each of the plurality of tenant networks including at least one log source, and a security monitoring subsystem, the security monitoring subsystem including a plurality of data gateway modules, each of the plurality of data gateway modules associated with a different log source, each of the plurality of data gateway modules configured to receive raw log data from the log source associated therewith and generate formatted log data based on the raw log data, an edge module that ingests the formatted log data from the plurality of data gateway modules, and a central control plane module configured to automatically update a configuration of at least one of the plurality of gateway modules in response to changes in the log source associated therewith, and the security monitoring subsystem is configured to perform a security action associated with at least one of the plurality of tenant networks based on the ingested formatted data.

[0007] These and other objects, functions, and characteristics of the present disclosure as well as the method of operation, function of the associated structural elements, combination of parts, and economies of manufacture will become more apparent from a consideration of the following description and appended claims which refer to the accompanying drawings, all of which form a part hereof, and in which like reference characters indicate corresponding parts in the various views, It is to be expressly understood, however, that the drawings are for the purpose of illustration and description only and are not intended as a definition of the limits of the present disclosure. [Brief description of the drawings]

[0008] Various features of the aspects described herein are set forth with particularity in the appended claims, however the various aspects, both as to organization and method of operation, and their advantages may be understood from the following description taken in conjunction with the accompanying drawings, as follows:

[0009] [Figure 1] FIG. 1 illustrates a system configured for a multi-tenant security information and event management (SIEM) implementation in accordance with at least one non-limiting aspect of this disclosure.

[0010] [Diagram 2] FIG. 2 is a diagram of a system configured to streamline and standardize the ingestion of log data from multiple tenants in accordance with at least one non-limiting aspect of the present disclosure.

[0011] [Diagram 3] FIG. 3 is an illustration of a system configured to streamline and standardize the ingestion of log data from multiple tenants in accordance with at least one non-limiting aspect of the present disclosure.

[0012] [Figure 4A] FIG. 1 illustrates a system configured to streamline and standardize log data ingestion by an example tenant network in accordance with at least one non-limiting aspect of the present disclosure. [Figure 4B] FIG. 1 illustrates a system configured to streamline and standardize log data ingestion by an example tenant network in accordance with at least one non-limiting aspect of the present disclosure.

[0013] [Diagram 5] FIG. 1 illustrates an example subsystem architecture including a data gateway module configured to receive, process, and route log data from one or more on-premise log sources in accordance with at least one non-limiting aspect of the present disclosure.

[0014] [Figure 6] FIG. 1 illustrates a method for streamlining and standardizing the ingestion of security data from multiple tenant networks in accordance with at least one non-limiting aspect of the present disclosure.

[0015] [Figure 7] FIG. 1 illustrates a computing system in accordance with at least one non-limiting aspect of the present disclosure.

[0016] Corresponding reference numerals indicate corresponding parts throughout the several views. The exemplifications set forth herein are illustrative of various aspects of the present disclosure in one aspect, and such exemplifications are not to be construed as limiting the scope of the present disclosure in any aspect. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0017] The applicant of this application owns the following patent applications, the disclosures of each of which are incorporated herein by reference in their entirety: U.S. Provisional Patent Application No. 63 / 196,458, filed June 3, 2021 (Name of Invention: DEVICES, SYSTEMS, AND METHODS FOR ENHANCING SECURITY INFORMATION & EVENT MANAGEMENT UPDATES FOR MULTIPLE TENANTS BASED ON CORRELATED, AND SYNERGISTIC DEPLOYMENT NEEDS) U.S. Provisional Patent Application No. 63 / 196,991, filed June 4, 2021 (Title of Invention: DEVICES, SYSTEMS, AND METHODS FOR STANDARDIZING & STREAMLINING THE DEPLOYMENT OF SECURITY INFORMATION & EVENT MANAGEMENT ARTIFACTS FOR MULTIPLE TENANTS) U.S. Provisional Patent Application No. 63 / 294,570, filed December 29, 2021 (Name of Invention: DEVICES, SYSTEMS, AND METHODS FOR PROVISIONING AND UPDATING SECURITY INFORMATION & EVENT MANAGEMENT ARTIFACTS FOR MULTIPLE TENANTS) U.S. Provisional Patent Application No. 63 / 295,150, filed on December 30, 2021 (Name of Invention: DEVICES, SYSTEMS, AND METHODS FOR STREAMLINING AND STANDARDIZING THE INGEST OF SECURITY DATA ACROSS MULTIPLE TENANTS) U.S. Provisional Patent Application No. 63 / 302,828, filed on January 25, 2022 (Title: DEVICES, SYSTEMS, AND METHODS FOR REMOTELY MANAGING ANOTHER ORGANIZATION' SECURITY ORCHESTRATION, AUTOMATION, AND RESPONSE) U.S. Provisional Patent Application No. 63 / 313,422, filed on February 24, 2022 (Name of Invention: DEVICES, SYSTEMS, AND METHODS FOR IDENTIFYING CYBER ASSETS AND GENERATING CYBER RISK MITIGATION ACTION BASED ON DOMAIN REDIRECTS) U.S. Provisional Patent Application No. 63 / 341,264, filed May 12, 2022 (Title: DEVICES, SYSTEMS, AND METHODS FOR SUMMARIZING ANALYTIC OBSERVATIONS) U.S. Provisional Patent Application No. 63 / 344,305, filed May 20, 2022 (Title: DEVICES, SYSTEMS, AND METHODS FOR INGESTING & ENRICHING SECURITY INFORMATION TO AUTONOMOUSLY SECURE A PLURALITY OF TENANT NETWORKS) U.S. Provisional Patent Application No. 63 / 345,679, filed May 25, 2022 (Name of Invention: DEVICES, SYSTEMS, AND METHODS FOR IDENTIFYING CYBER ASSETS AND GENERATING CYBER RISK MITIGATION ACTIONS BASED ON A DEMOCRATIC MATCHING ALGORITHM) International Patent Application No. PCT / US22 / 72739 filed on June 3, 2022 (Name of Invention: DEVICES, SYSTEMS, AND METHODS FOR ENHANCING SECURITY INFORMATION & EVENT MANAGEMENT UPDATES FOR MULTIPLE TENANTS BASED ON CORRELATED, AND SYNERGISTIC DEPLOYMENT NEEDS) International Patent Application No. PCT / US22 / 72743 filed on June 3, 2022 (Name of Invention: DEVICES, SYSTEMS, AND METHODS FOR STANDARDIZING & STREAMLINING THE DEPLOYMENT OF SECURITY INFORMATION & EVENT MANAGEMENT ARTIFACTS FOR MULTIPLE TENANTS) U.S. Provisional Patent Application No. 63 / 365,819, filed June 3, 2022 (Title: DEVICES, METHODS, AND SYSTEMS FOR GENERATING A HIGHLY-SCALABLE, EFFICIENT COMPOSITE RECORD INDEX) U.S. Provisional Patent Application No. 63 / 353,992, filed June 21, 2022 (Title: DEVICES, SYSTEMS, AND METHODS FOR CATEGORIZING, PRIORITIZING, AND MITIGATING CYBER SECURITY RISKS) U.S. Provisional Patent Application No. 63 / 366,903, filed June 23, 2022 (Name of Invention: DEVICES, SYSTEMS, AND METHOD FOR GENERATING AND USING A QUERYABLE INDEX IN A CYBER DATA MODEL TO ENHANCE NETWORK SECURITY) U.S. Provisional Patent Application No. 63 / 368,567, filed on July 15, 2022 (Title: DEVICES, SYSTEMS, AND METHODS FOR UTILIZING A NETWORKED, COMPUTER-ASSISTED, THREAT HUNTING PLATFORM TO ENHANCE NETWORK SECURITY) U.S. Provisional Patent Application No. 63 / 369,582, filed on July 27, 2022 (Title: AUTONOMOUS THREAT SCORING AND SECURITY ENHANCEMENT) U.S. Provisional Patent Application No. 63 / 377,304, filed September 27, 2022 (Title: DEVICES, SYSTEMS, AND METHODS FOR CONTINUOUSLY ENHANCING THE IMPLEMENTATION OF CODE CHANGES VIA ENRICHED PIPELINES)

[0018] Numerous specific details are described in this disclosure to provide a thorough understanding of the overall structure, function, manufacture, and use of the embodiments described in the accompanying drawings. Well-known operations, components, and elements have not been described in detail so as not to obscure the embodiments described herein. The reader will understand that the embodiments described and illustrated herein are non-limiting embodiments. It will therefore be understood that the specific structural and functional details disclosed herein may be representative and exemplary. Changes and modifications may be made without departing from the scope of the claims.

[0019] Before describing in detail the various aspects and methods of the system disclosed herein, it should be noted that the exemplary aspects are not limited in application or use to the details disclosed in the accompanying drawings and description. It should be understood that the exemplary aspects may be implemented or incorporated in other aspects, variations, and modifications, and may be practiced or carried out in various ways. Furthermore, unless otherwise indicated, the terms and expressions used herein have been selected for the purpose of describing the exemplary aspects for the convenience of the reader, and are not intended to be limiting thereof. For example, it will be understood that any reference to a particular manufacturer, software suite, application, or development platform disclosed herein is merely intended to illustrate some of the many aspects of the disclosure. This includes any reference to trademarks. Thus, it should be understood that the devices, systems, and methods disclosed herein can be implemented to enhance any software update according to any intended use and / or user preference.

[0020] As used herein, the term "server" may refer to or include one or more computing devices that operate through or facilitate communication and processing for multiple parties in a network environment, such as the Internet or any public or private network. As used herein, references to a "server" or "processor" may refer to the previously enumerated servers and / or processors that are enumerated as performing the previous steps or functions, different servers and / or processors and / or combinations of servers and / or processors.

[0021] As used herein, the term "network" may refer to or include an entire enterprise information technology (IT) system deployed by a tenant. For example, a network may include a group of two or more nodes (e.g., assets) connected by any physical and / or wireless connections and configured to communicate and share information with one or more other nodes. However, the term network is not limited to any particular nodes or any particular means of connecting the nodes. A network may include any combination of assets (e.g., devices, servers, desktop computers, laptop computers, personal digital assistants, mobile phones, wearables, smart appliances, etc.) connected to an Ethernet, intranet, and / or extranet and configured to communicate with each other via ad-hoc connections (e.g., Bluetooth, Near Field Communication (NFC), etc.), local area connections ("LANs"), wireless local area networks ("WLANs"), and / or virtual private networks ("VPNs") regardless of the physical location of each device. The network may further include any tools, applications, and / or services deployed by the devices or otherwise utilized by enterprise IT systems, such as firewalls, email clients, document management systems, office systems, etc. In some non-limiting aspects, the "network" may include third party devices, applications, and / or services that are owned and controlled by a third party, but that the tenant is authorized to access the enterprise IT systems.

[0022] As used herein, the term "platform" may include software architecture, hardware architecture, and / or combinations thereof. A platform may include any of a standalone software product, a network architecture, and / or a software product configured to be integrated into a software architecture and / or a hardware architecture as necessary to provide its technical benefits to the software product. For example, a platform may include any combination of chipsets, processors, logic-based devices, memory, storage, graphical user interfaces, graphics subsystems, applications, and / or communication modules (e.g., transceivers). In other words, a platform may provide the resources necessary to enable the technical benefits provided by the software. According to some non-limiting aspects, the technical benefits provided by the software are provided to the physical resources of the ecosystem or to other software employed by the physical resources (e.g., APIs, services, etc.) in the ecosystem. According to other non-limiting aspects, a platform may include a framework of several software applications intended and designed to function together.

[0023] As used herein, the term "security monitoring platform" may refer to or include software configured to aggregate and analyze activity from many different resources from across an information technology (IT) infrastructure. For example, a security monitoring platform may include a security information and event management (SIEM) platform and / or other types of platforms used to monitor and / or analyze data (e.g., Slpunk Enterprise Security, Microsoft Sentinel, Datadog Security Monitoring, ELK, etc.). Various aspects of the devices, systems, and methods disclosed herein in relation to SIEM may be applied to any type of security monitoring platform as well.

[0024] SIEMs can be used to aggregate data from multiple platforms (e.g., log data, event data, threat intelligence data, etc.) and analyze that data to detect anomalous behavior and potential cyber attacks. SIEMs can collect security data from network devices, servers, domain controllers, etc. SIEMs store, normalize, aggregate, and apply analytics to data to discover trends, detect threats, and investigate alerts. While known SIEM tools (also referred to herein as SIEM detection engines) offer powerful functionality, including the ability to monitor events across a network, collect data, and issue security alerts, such tools are typically tailored to the implementing organization and, more specifically, to the specific network architecture, which can often be complex.

[0025] In certain forms, the implementation of SIEM tools and other security monitoring platforms can be complicated due to the variety of data sources that may be configured within a particular organization's network architecture. Such diversity of data sources can result from organizations employing various combinations of on-premise and cloud-based data logging tools to collect, aggregate, and forward data from within their networks. For example, a network may employ on-premise data logging tools such as SysLog forwarding, Windows event forwarding, Filebeat forwarding, or other commercially available software for data logging and forwarding. Additionally, organizations may also utilize cloud-based data services such as Amazon Web Services (AWS), Microsoft 365, and Okta for data log collection and aggregation. SIEM tools must be able to ingest log data from these various sources in order to utilize the data to detect security-related events and trends. However, the data generated by each type of log source may have different characteristics, for example, different formats and different configurations of content. Therefore, the deployment of a SIEM tool typically requires customization based on the specific data log sources implemented in a particular network.

[0026] The customization efforts required to deploy a SIEM tool or any security monitoring platform can be time-consuming, especially for security service providers (MSSPs) whose business is managing the security of multiple client (i.e., multiple tenant) networks. For example, Splunk Enterprise Security (Splunk Cloud) is a cloud-based SIEM detection engine that is often used by MSSPs. However, deploying Splunk Cloud across multiple tenants typically requires customization based on each tenant's unique combination of log sources. This customization requires a high level of skill, while also being very time-consuming and error-prone. In addition, data ingestion configurations for a particular tenant network may need to be updated every time a tenant updates, adds, removes, or otherwise modifies a log source. Also, most cloud-based SIEM products, such as Splunk Cloud, are subject to various manufacturer-driven changes that can affect all tenants simultaneously and require additional ingestion configuration updates.

[0027] The customization required to handle the ingestion of data from multiple tenant networks can be costly for both the MSSP, who must hire more expensive experts, and the tenants, who often bear at least a portion of the increased expense. However, the deployment needs of various tenants are often the same. For example, many organizations may utilize one or more of the same types of data log sources. As such, it may be useful to leverage common morphology across networks to implement a centralized system that manages the ingestion of a wide variety of data types from multiple tenant networks. Unfortunately, known SIEM tools and other security monitoring platforms are not technically capable of leveraging such synergies. As such, opportunities for MSSPs to increase efficiency across multiple clients through various updates related to SIEMs and log sources from the initial deployment are limited. Thus, there is a need for improved devices, systems, and methods to streamline and standardize the ingestion of log data from multiple tenants. Such enhancements can provide improved technical performance and cost-effectiveness of SIEM tools and / or other security monitoring platforms for MSSPs. For example, such enhancements can reduce the resources required for the initial deployment of SIEM tools and / or security monitoring platforms across multiple tenant networks. Additionally, such enhancements can significantly reduce the manpower required to update ingestion configurations in response to SIEM, security monitoring platform, and / or log source related updates.

[0028] The present disclosure presents such an apparatus, system, and method for streamlining and standardizing the ingestion of log data from multiple tenants, all of which provide a number of technical advantages. For example, the apparatus, system, and method disclosed herein can provide: (1) a reduction in resources required for the initial deployment of a security monitoring platform across multiple tenant networks in an ad-hoc manner using a centrally controlled data gateway module that processes various types of log data from multiple tenant networks into a standardized format for streamlined ingestion by edge modules; (2) a reduction in human resources required to accommodate changes in log sources by automatically updating the configuration of the data gateway module; (3) an improvement over updates to ingestion configurations performed by human security analysts, achieved by simultaneously updating the configuration of multiple data gateway modules based on common changes to log sources from multiple tenant networks; and / or (4) practical application by performing security actions based on security-related events and trends detected in the ingested data.

[0029] 1, a system 1000 configured for a multi-tenant SIEM implementation is illustrated in accordance with at least one non-limiting aspect of the present disclosure. The system 1000 can include a SIEM provider server 1002 including a memory 1004 and a processor 1006. In various aspects, the SIEM provider server 1002 can comprise a computer system 9000 and various components thereof (e.g., the processor 1006 can be similar to the processor(s) 9004, the memory 1004 can be similar to the main memory 9006, etc.), as described further with reference to FIG. 7. In various aspects, the memory 1004, when executed by the processor 1006, can include a central control plane module 200, data gateway modules 2101, 2102, 2122, 2104, 2106, 2108, 2109, 2200, 2201, 2202, 2203, 2204, 2205, 2206, 2207, 2208, 2209, 2210, 2211, 2212, 2213, 2214, 2215, 2216, 2217, 2218, 2219, 2221, 2222, 2230, 2231, 2232, 2233, 2234, 2235, 2236, 2237, 2238, 2239, 2240, 2241, 2242, 2243, 2244, 2245, 2246, 2247, 2248, 2249, 2250, 2251, n , 212 n, and edge modules 2201, 220 n , 222 n (described with reference to FIG. 2 ). In various configurations, the SIEM provider server 1002 may be a computational resource owned or leased by the MSSP. The SIEM provider server 1002 may communicate with multiple tenants 10101, 10102, . . . 1010 via a network 1008. n A plurality of tenants 10101, 10102, . . . 1010 are connected to each other so as to be able to communicate with each other. n may each represent a customer (e.g., an organization) that has contracted with the MSSP for security services. According to the non-limiting form of FIG. 1, the network 1008 may include any of a variety of wired, long-range wireless, and / or short-range wireless networks. For example, the network 1008 may include an internal network, a local area network (LAN), WiFi, a cellular network, a near field communication (hereinafter "NFC"), etc.

[0030] With further reference to FIG. 1, each of a number of tenants 10101, 10102, . . . 1010 n Each of the tenants 10101 may host one or more instances of one or more clients 1012, 1014, 1016. For example, a first tenant 10101 may host one or more client applications 10121, 10122, ... 1012. n , and a second tenant 10102 may include one or more machines implementing one or more client applications 10141, 10142, ... 1014 n and / or a third tenant 1010. n One or more client applications 10161, 10162, ... 1016 n Each tenant 10101, 10102, 1010 nmay include an intranet (i.e., a network) over which each machine can communicate. As mentioned above, each tenant 10101, 10102, ... 1010 n Each of the tenants 10101, 10102, ..., 1010 may represent a customer, such as an organization that has contracted with the MSSP for security services. Thus, the SIEM provider server 1002 may store a single SIEM instance for each of the multiple tenants 10101, 10102, ..., 1010. n , and is responsible for monitoring and managing threats to each client application 1012, 1014, 1016.

[0031] As mentioned earlier, tenants 10101, 10102, ... 1010 n The architecture is complex. Complex tenant architectures, such as different types of data log sources employed by each tenant, can be complex for MSSPs to manage. For example, a known SIEM detection engine might be deployed to each tenant 10101, 10102, ... 1010. n According to a non-limiting aspect of the present disclosure, the SIEM provider server 1002 includes a central control plane module 200 and data gateway modules 2101, 2102, 2122, . . . 2104, which are described below with respect to FIG. n , 212 n and one or more edge modules 2201, . . . 220 n , 222 n Using ,tenants 10101, 10102, . . . 1010 n The present invention addresses these deficiencies in a non-traditional manner to streamline and standardize the ingestion of log data across the enterprise. Moreover, these enhancements can be practically applied to take security actions based on security-related events and trends detected in the ingested data. For example, based on the ingested data, SIEM provider server 1002 may report security events and trends across tenants 10101, 10102, ..., 1010. nAs another example, the SIEM provider server 1002 may be configured to generate security alerts that are sent to at least one administrator of the tenant networks 10101, 10102, . . . 1010 based on the captured data. n can be configured to prohibit access to.

[0032] 2, a diagram of a system 2000 configured to streamline and standardize the ingestion of log data from multiple tenants in accordance with at least one non-limiting aspect of the present disclosure is shown. The system 2000 includes a SIEM provider server 2002 and multiple tenants 20101, 20102, ... 2010. n In some embodiments, the SIEM provider server 2002 may be similar to the SIEM provider server 1002 of FIG. 1. Similarly, the SIEM provider server 2002 may include a plurality of tenants 20101, 20102, . . . 2010. n is multiple tenants 10101, 10102, ... 1010 in Figure 1. n In this manner, the SIEM provider server 2002 may be a computational resource (e.g., a cloud infrastructure hosting environment) owned or leased by the MSSP, and may host multiple tenants 20101, 20102, ... 2010. n Each of the may represent a network of a customer (e.g., an organization) that has contracted with the MSSP for security services.

[0033] With further reference to Figure 2, tenants 20101, 20102, ... 2010 n Each tenant may have an on-premise infrastructure 102. For example, tenant 20101 is depicted as having an on-premise infrastructure 1021, tenant 20102 is depicted as having an on-premise infrastructure 1022, and tenant 2010 n On-Premises Infrastructure 102 nIn addition, tenants 20101, 20102, ... 2010 n At least one of the tenants 20102 may have a cloud-based infrastructure 104. For example, tenant 20102 is depicted as having a cloud-based infrastructure 1042, and tenant 2010 n Cloud-Based Infrastructure 104 n The on-premises infrastructure 102 may have at least one on-premises log source 112 (e.g., on-premises infrastructure 1021 may have on-premises log source 1121, on-premises infrastructure 1022 may have on-premises log source 1122, on-premises infrastructure 102 may have on-premises log source 1123, on-premises infrastructure 102 may have on-premises log source 1124, on-premises infrastructure 102 may have on-premises log source 1125, on-premises infrastructure 102 may have on-premises log source 1126, on-premises infrastructure 102 may have on-premises log source 1127, on-premises infrastructure 102 may have on-premises log source 1128, on-premises infrastructure 102 may have on-premises log source 1129, on-premises infrastructure 102 may have on-premises log source 1121, on-premises infrastructure 102 may have on-premises log source 1122, on-premises infrastructure 102 may have on-premises log source 1124, on-premises infrastructure 102 may have on-premises log source 1126, on-premises infrastructure 102 may have on-premises log source 1127, on-premises infrastructure 102 may have on-premises log source 1128, on-premises infrastructure 102 may have on-premises log source 1129, on-premises infrastructure 102 may have on-premises log source 1129, on-premises infrastructure 102 may have on-premises log source 1129, on-premises infrastructure 102 may have on-premises log source 1127, on-premises infrastructure 102 may have on-premises log source 1128, on-premises infrastructure 102 may have on-premises log source 1129, on-premises infrastructure 102 may have on-premises log source 1129, on-premises infrastructure 102 may have on-premises log source 11 n On-Premises Log Source 112 n The cloud-based infrastructure 104 may include at least one cloud-based log source 114 (e.g., the cloud-based infrastructure 1042 may include a cloud-based log source 1142, and the cloud-based infrastructure 104 may include a cloud-based log source 1143). n Cloud-based log sources 114 n1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 108, 109, 108, 109, 108, 109, 101, 102, 103, 104, 105, 106, 107, 108, 109 n can have any of a vast number of combinations of on-premise and cloud-based infrastructures 102, 104, each having any one or more of several different types of log sources 112, 114.

[0034] 2, the SIEM provider server 2002 can comprise a central control plane module 200. The central control plane module 200 can be configured to generate multiple data gateway modules 210, 212. Each of the multiple data gateway modules 210, 212 can be associated with a different log source 112, 114. For example, the data gateway module 2101 is associated with an on-premise log source 1121, the data gateway module 2102 is associated with an on-premise log source 1122, the data gateway module 2122 is associated with a cloud-based log source 1142, and the data gateway module 2101 is associated with an on-premise log source 1123, the data gateway module 2102 is associated with an on-premise log source 1124, the data gateway module 2102 is associated with a cloud-based log source 1142, and the data gateway module 2102 is associated with a cloud-based log source 1142. n On-Premises Log Source 112 n 212, which is associated with the data gateway module n Cloud-based log sources 114 n Each of the plurality of data gateway modules 210, 212 may be configured to receive raw log data from its associated log source 112, 114. Each of the plurality of data gateway modules 210, 212 may be further configured to generate formatted log data from the received raw log data. For example, each data gateway module may be configured to filter the raw log data to include only fields determined to be relevant to SIEM detections. As another example, each data gateway module may be configured to normalize and / or parse the raw log data based on a standard schema (i.e., a standard format). The raw log data may be formatted by the data gateway module 210, 212 such that the formatted log data may be processed (i.e., analyzed) by a SIEM detection engine.

[0035] Each of the multiple data gateway modules 210, 212 may also be configured to route the formatted log data based on SIEM and tenant data requirements. For example, in some embodiments, the data gateway modules 210, 212 may be configured to route the formatted log data to an edge module 220 hosted on a SIEM provider server. The edge module 220 may be configured to ingest the formatted log data with high volume, speed, and / or redundancy. This ingested formatted data may then be processed (i.e., analyzed) by a SIEM detection engine 230 hosted on the SIEM provider server 2002. Additionally, in some embodiments, the data gateway modules 210, 212 may be configured to route the formatted log data to a SIEM detection engine 260 hosted on a third party network 250. Additionally, in some embodiments, the data gateway modules 210, 212 may be configured to route the raw data to a tenant storage 120. The tenant storage 120 may be, for example, a compliance archival consisting of low-cost immutable storage. Depending on the tenant's needs and / or preferences, the tenant storage 120 may be hosted by the SIEM provider server 2002 (e.g., tenant storage 1201), or the tenant storage 120 may be hosted on the tenant's cloud-based infrastructure 104 (e.g., tenant storage 1202, 1204). n ), or the tenant storage may be hosted on a server that is not related to the SIEM provider server 2002 or the tenant's cloud-based infrastructure 104.

[0036] Still referring to FIG. 2, the central control plane module 200 can be configured to perform various actions based on changes to the SIEM detection engines 230, 260 and / or based on changes related to the data logs 112, 114. For example, the central control plane module 200 can be configured to automatically update the configuration of one or more data gateway modules 210, 212 in response to changes (e.g., updates) to the log source(s) associated with one or more data gateway modules 210, 212. In various aspects, the central control plane module 200 can be configured to simultaneously update the configuration of multiple gateway modules 210, 212 based on a common change to the log sources 112, 114 associated therewith. For example, a particular type of log source may undergo a system-wide update. In response, the central control plane module 200 can update any gateway modules 210, 212 that are receiving raw log data from the updated log source of the particular type (e.g., firewall-related updates, etc.).

[0037] In various aspects, the central control plane 200 can be configured to update the configuration of a data gateway module 210, 212 that requires a non-standard configuration based on exceptions associated with the log sources 112, 114 from which it receives data. For example, this type of partial change can be implemented when a type of log source 112, 114 may be common to multiple tenants 2010, but only one instance of that type of log source 112 (or 114) in a particular tenant 2010 requires an update to the associated data gateway module 210 (or 212). This local-only change allows that particular data gateway module 210 (or 212) to be updated without implementing a global update that affects all data gateway modules 210, 212 that receive raw log data from the same type of log source 112, 114. In this manner, the central control plane module 200 can generate both automatic system-wide configuration updates for the data gateway modules 210, 2102 and local-only configuration updates for the data gateway modules 210, 212.

[0038] In various aspects, the central control plane module 200 can be configured to generate new data gateway modules 210, 212. For example, a new tenant 2010 can be added to the system 2000. The central control plane module 200 can cause new data gateway modules 210, 212 to be generated for all log sources 112, 114 in the new tenant network. As another example, an existing tenant 2010 can update its network to add new log sources 112, 114. The central control plane module 200 can cause new gateway modules 210, 212 to be generated for the new log sources 112, 114.

[0039] In various aspects, the central control plane module 200 can enable triage of health-related information by the system 2000. For example, the central control plane module 200 can detect and / or identify log sources 112, 114 that are no longer sending raw log data. The central control plane module 200 can implement an action, such as issuing an alert, in response to detecting such health-related information. In various aspects, the central control plane module 200 can be configured to remove the data gateway modules 210, 212. For example, a tenant 2010 may be removed from the system 2000 and the associated data gateway modules 210, 212 may be removed by the central control plane module 200. As another example, the tenant 2010 can update its network and remove one or more log sources 112, 114. The central control plane module 200 can be configured to remove the data gateway modules 210, 212 associated with the removed one or more log sources 112, 114.

[0040] In various aspects, the central control plane module 200 may be configured to update the configuration of the multiple data gateway modules based on 210, 212 based on the requirements of the SIEM detection engines 230, 260. For example, the SIEM detection engines 230, 260 may receive an update that requires changes to how the raw data is formatted (e.g., filtered, normalized, and / or parsed). In response to this update, the central control plane module 200 may cause a corresponding configuration change across the multiple data gateway modules based on 210, 212 to ensure that the raw data is correctly formatted. This may be an automated system-wide update. As another example, it may be determined that the raw data needs to be filtered differently (e.g., based on an update of what is considered the relevant security fields that need to be monitored). In response to this update, the central control plane module 200 may cause a corresponding configuration change across the multiple data gateway modules 210, 212 to ensure that the raw data is correctly filtered. This may be an automated system-wide update. In this manner, the central control plane module 200 may act as a single point from which all data log sources 112 , 114 may be managed based on the provisioning and updating of multiple data gateway modules 210 , 212 .

[0041] In various aspects, the central control plane module 200 can be composed of software components including an infrastructure orchestration system, a graphical user interface (GUI) for pre-processing software configuration management, and a cloud infrastructure hosting environment. The infrastructure orchestration system can be software components such as, for example, Chef, Puppet, Ansible, etc. The cloud infrastructure hosting environment can be a commercially available hosting environment such as, for example, AWS, Google Cloud Platform, Azure, etc. In various aspects, the SIEM provider server 2002 can be a cloud infrastructure hosting environment.

[0042] In various aspects, the one or more edge modules 220 can be comprised of software components such as a cloud infrastructure hosting environment, pre-processing software, and an infrastructure orchestration system. The cloud infrastructure hosting environment can be, for example, a commercially available hosting environment such as AWS, Google Cloud Platform, Azure, etc. In various aspects, the SIEM provider server 2002 can be a cloud infrastructure hosting environment. The pre-processing software can be, for example, commercial software or open source software (e.g., Crbl, FluentD, Kafka, Logstash, etc.). The infrastructure orchestration system can be, for example, a software component such as Chef, Puppet, Ansible, etc. With further reference to the non-limiting form of FIG. 2, the central control plane module 200 is shown as being hosted on the edge module 220. In other aspects, the central control plane module 200 can be abstracted into its own hosting environment.

[0043] In various embodiments, the data gateway module 210 associated with the on-premise log source 112 can be configured with a virtual private network (VPN) connection with the tenant's 2010 on-premise infrastructure 102. The data gateway module 212 associated with the cloud-based log source 114 can be configured with an application programming interface (API), such as a cloud-based RESTful API, to extract data from the tenant's 2010 cloud-based infrastructure 104. Each data gateway module 210, 212 can generally be comprised of software components, such as an edge device and pre-processing software. The edge device software component can be, for example, a virtual or physical host server, a parcel of such hosts for high availability, or a virtual or physical cluster of host nodes using container technology (e.g., Kubernetes, etc.). The pre-processing software can be, for example, commercial software, or open source software (e.g., Crbl, FluentD, Kafka, Logstash, etc.).

[0044] In various aspects, the data gateway module 212 associated with a cloud-based log source can be configured as a “cloud-native collector” data gateway module. For example, the cloud-native collector data gateway module can reside within a tenant 2010 cloud-based infrastructure 104 (e.g., an Azure tenant, AWS, etc.). The cloud-native collector data gateway module can be configured to natively process and ingest cloud-native data. Additionally, the cloud-native collector data gateway module can be generated by an automated cloud-native collector deployment package, reside in the tenant 2010 cloud-based infrastructure 104, and establish connections to both cloud-native data log sources and destinations for formatted and raw log data (e.g., SIEM 260). The direct connections enabled by the cloud-native collector data gateway module can ensure high availability of continuous data flow and enable faster, higher volume, and more diverse ingestion of data compared to traditional SIEM data ingestion methods.

[0045] 2, the system 2000 includes tenants 20102, 20102, . . . 2010 nThe data gateway module 210 may be configured to allow for joint management between the MSSP and the tenant that contracts with the tenant to provide the cybersecurity server. For example, one or more tenants 2010 may desire visibility into the data collected by the data gateway module 210, 212. In such a case, one or more tenants 2010 may be provided with read-only and / or full access to one or more data gateway modules 210, 212. This may allow one or more tenants 2010 to have both visibility and shared control over the data generated by the log sources 112, 114 and / or the data gateway module 210, 212. As another example, one or more tenants 2010 may be concerned that the data flow will be "broken" (e.g., flow to the system will stop in such a way that the system cannot process the data). In such a case, one or more tenants 2010 may be given access to maintain a common system with the MSSP to control the data processing needs. This may be implemented, for example, by providing one or more tenants 2010 with access to control the routing and / or processing of raw data by the associated data gateway module 210, 212. The co-management functionality described herein is provided by the MSSP and tenants 20101, 20102, ... n This enables each party to maintain control over their respective data processing needs and ensure correct data processing and routing for all parties.

[0046] A non-standard combination of a central control plane module 200, data gateway modules 210, 212, and edge modules 220 provides services to multiple tenants 20101, 20102, ... 2010 nA system 2000 can be realized that streamlines and standardizes the ingestion of log data from. This ad-hoc combination allows the system 2000 to be adaptable to a vast number of combinations of on-premise and cloud-based infrastructures 102, 104 that a tenant 2010 may employ. This includes adapting to multiple different types of log sources 112, 114 that may be employed within the on-premise and cloud-based infrastructures 102, 104. This ad-hoc combination also allows for remote processing and routing of raw log data from within the tenant 2010 environment. For example, from within the tenant 2010 environment, raw log data intended for a compliance archive (e.g., the tenant storage 120 can be a compliance archive) can be routed to low-cost immutable storage, while a copy of this data can be filtered to relevant security fields, normalized to a common schema so that security alerts can be detected, and routed to a SIEM detection engine (e.g., SIEM 230, 260). This ad-hoc combination further ensures flexibility on different system architectures. The SIEM detection engines (e.g., SIEMs 230, 260) and compliance archives (e.g., tenant storage 120) can be hosted by any combination of the tenant 2010 network, a third-party vendor, or the SIEM provider servers 2002. Furthermore, this ad-hoc combination allows for centralized management of data ingestion from hundreds of thousands of data sources in different environments by generating and updating data gateway modules 210, 212, and the central control plane module 200 manages the data flow from log sources 112, 114 across multiple (e.g., tens, hundreds, thousands, etc.) tenants 20101, 20102, ... 2010 having various network architectures. n , and simultaneously guarantees that it is constant for

[0047] Additionally, the ad-hoc combination of the central control plane module 200, data gateway modules 210, 212, and edge modules 220 performs operations that could not be realistically performed by the human brain, improving the performance of the SIEM detection engines 230, 260. For example, this ad-hoc combination enables the ability to propagate changes in data structures or data tags using an automated process (i.e., the central control plane module 200 generates automated configuration updates to the data gateway modules 210, 212 that impact raw log data processing), eliminating the risk of human effort and error. Additionally, in the cybersecurity industry, most data ingestion is manually configured on a case-by-case (i.e., per tenant) basis, with few if any benefits of leveraging common forms of tenant networks. This ad-hoc combination can be used to scale the data ingestion of multiple tenants 20101, 20102, ... 2010 with various combinations of on-premise and cloud-based log sources 112, 114. n Improve SIEM performance by streamlining and standardizing the ingestion of log data from

[0048] 3, a diagram of a system 3000 configured to streamline and standardize the ingestion of log data from multiple tenants in accordance with at least one non-limiting aspect of the present disclosure is shown. n The system 3000 may include a plurality of tenants, each having various combinations of on-premise infrastructure 302 and cloud-based infrastructure 304. The system 3000 may also configure tenant storage 320. For example, tenant storage 3201 associated with tenant 30101 may be hosted by the MSSP's cloud (e.g., a SIEM provider server), tenant storage 3202 associated with tenant 30102 may be hosted by the cloud-based infrastructure 3042 of tenant 30102, and tenant storage 3203 associated with tenant 30103 may be hosted by the cloud-based infrastructure 3042 of tenant 30104. n Related Tenant Storage 320n Tenant 3010 n Cloud-based infrastructure of 304 n It can be hosted by multiple tenants 30101, 30102, ... 3010 n , On-Premises Infrastructure 3021, 3022, ... 302 n , Cloud-based infrastructure 3042, ... 304 n , and tenant storage 3201, 3202, ... 320 n In Figure 2, multiple tenants 20101, 20102, ... 2010 n , On-Premises Infrastructure 1021, 1022, ... 312 n , Cloud-based infrastructure 1042, ... n , and tenant storage 1201, 1202, ... 120 n The present invention can be configured in a similar manner to or similar to the above.

[0049] 3, the system 3000 may include a central control plane module 400, a plurality of data gateway modules 410, 412, and one or more edge modules 420. The system 3000 may also include a SIEM detection engine 360. The central control plane module 400, a plurality of data gateway modules 4101, 4102, 4122, . . . 410 n , 412 n , one or more edge modules 420, and the SIEM detection engine 360, each of which includes a central control plane module 200, a plurality of data gateway modules 2101, 2102, 2122, . . . 210 n , 212 n , edge module 220, and SIEM detection engine 260 of FIG 2. Thus, the features and advantages discussed above with respect to system 2000 of FIG 2 may be equally applicable to system 3000 of FIG 3.

[0050] 4A-4B, a system 5000 configured to streamline and standardize log data ingestion for an example tenant 5010 network in accordance with at least one non-limiting aspect of the present disclosure is illustrated. Referring primarily to FIG. 4B, the tenant 5010 network may include an on-premise infrastructure 502 and a cloud-based structure 504. The on-premise structure 502 may include one or more on-premise log sources 512. Similarly, the cloud-based infrastructure 504 may include one or more cloud-based log sources 514. The system 5000 may also include a tenant storage 520. The tenant 5010, the on-premise infrastructure 502, the on-premise log sources 512, the cloud-based infrastructure 504, the cloud-based log sources 514, and the tenant storage 520 may each correspond to a plurality of tenants 20101, 20102, ... 2010 of FIG. 2. n , On-Premises Infrastructure 1021, 1022, ... 102 n , On-Premises Log Sources 1121, 1122, ... 112 n , Cloud-based infrastructure 1041, 1042, ... 104 n , Cloud-based log sources 1141, 1142, ... 114 n , and tenant storage 1201, 1202, ... 120 n may be the same as or similar to.

[0051] 4A-4B, the system 5000 may include one or more central control plane modules 600, data gateway modules 610, 612, and an edge module 620. The system 5000 may also include a SIEM detection engine 660. The one or more central control plane modules 600, data gateway modules 610, 612, edge module 620, and SIEM detection engine 660 may each be integrated into the central control plane module 200 and the multiple data gateway modules 2101, 2102, 2122, ... 2104. n , 212 n , may be the same as or similar to edge module 220. Thus, the features and advantages discussed above with respect to system 2000 of FIG. 2 may be similarly applicable to system 5000 of FIG. 4A-4B. Additionally, any of the detailed features shown in FIG. 4A-4B, such as, for example, tenant 5010 network, on-premise infrastructure 502, cloud-based infrastructure 504, central control plane 600, data gateways 610, 612, edge module 620, SIEM detection engine 660, and other components or features within the data streams, may be incorporated into system 1000 of FIG. 1, system 2000 of FIG. 2, and / or system 3000 of FIG. 3.

[0052] 5, an exemplary subsystem 7000 architecture is shown that includes a data gateway module 710 configured to receive, process, and route log data from one or more on-premise log sources 750 in accordance with at least one non-limiting aspect of the present disclosure. The subsystem 7000 may include a central control plane module 700, a data gateway module 710, and an edge module 720. The data gateway module 710 may be located within a tenant's on-premise infrastructure (e.g., the on-premise infrastructure 102 of the tenant 1010 as shown in FIG. 2) or within a cloud infrastructure managed by the tenant. The central control plane module 700 and the edge module 720 may be hosted on computing resources owned or leased by the MSSP (e.g., the SIEM provider server 2002 of FIG. 2). The central control plane module 700 may be configured to generate the data gateway module 710. To do this, the central control plane module 700 may be configured to generate VPN endpoint modules 730, 732, 734, 736 to establish a connection with the tenant's infrastructure. To improve the speed and performance of the connection between the central control plane module 700 and the data gateway module 710, a load balancing module 738 may also be created in the data gateway module 710.

[0053] Still referring to FIG. 5, the data gateway module 710 may include one or more data processing and routing modules 740. The data processing and routing module 740 may be configured to receive raw log data from one or more on-premise log sources 750, process (e.g., filter, normalise, and / or parse) the raw log data into formatted log data, and route the formatted log data for ingestion to the edge module 720. The central control plane module 700, the data gateway module 710, the edge module 720, and the on-premise log sources 750 may be the same as or similar to the central control plane module 200, the data gateway module 210, the edge module 220, and the on-premise log sources 112 of FIG. 2. Additionally, any of the detailed features illustrated in FIG. 5, such as, for example, the central control plane module 700, the data gateway module 710, the edge module 720, and any other components, modules and data stream features, may be incorporated into the system 1000 of FIG. 1, the system 2000 of FIG. 2, and / or the system 3000 of FIG. 3.

[0054] Figure 6 illustrates a method 8000 for streamlining and standardizing data ingestion in a security information and event management 1000 (SIEM) system among multiple tenant networks, such as described above in Figure 1, in accordance with certain non-limiting aspects of the present disclosure. Method 8000 may be performed by systems 2000, 3000, 5000 described in connection with Figures 2-4 above, implemented according to the exemplary subsystem 7000 architecture described above in connection with Figure 5.

[0055] Referring now primarily to FIG. 6, and also to FIGS. 1-5, in one embodiment, in accordance with a method 8000, a security monitoring system 2000 includes a plurality of data gateway modules 210, 212, each associated with a different log source 112, 114, an edge module 220, and a central control plane module 200, and includes a plurality of tenant networks 20101, 20102, ... 20103, in accordance with a method 8000. n Each of the plurality of data gateway modules 210, 212 of the security monitoring system 2000 comprises at least one log source 112, 114. In accordance with the method 8000, each of the plurality of data gateway modules 210, 212 of the security monitoring system 2000 receives raw log data from its associated log source 112, 114 (8002). Each of the plurality of data gateway modules 210, 212 of the security monitoring system 2000 generates formatted log data based on the raw log data (8004). The edge module 220 of the security monitoring system 2000 ingests the formatted log data from the plurality of data gateway modules 210, 212 (8006). The central control plane module 200 of the security monitoring system 2000 automatically updates the configuration of at least one of the plurality of data gateway modules 210, 212 based on changes to its associated log source 112, 114 (8008). The security monitoring system 2000 comprises a plurality of tenant networks 20101, 20102, . . . 2010. n and performing (8010) a security action associated with at least one of the following based on the captured formatted data.

[0056] 1-6, according to one aspect of the method 8000, each of the multiple data gateway modules 210, 212 of the security monitoring system 2000 filters the raw log data to include only relevant security fields to generate formatted log data, and normalizes the raw log data based on a standard schema to generate the formatted log data. In yet another aspect, according to the method 8000, a central control plane module of the security monitoring system updates the filtering of the raw log data performed by the multiple gateway modules 210, 212 based on updates to the relevant security fields.

[0057] 1-6, according to one embodiment of the method 8000, each of the multiple data gateway modules 210, 212 of the security monitoring system 2000 routes raw log data to the tenant storage archive 120 and routes formatted log data to the SIEM detection engines 230, 260. In another embodiment of the method 8000, the SIEM provider server 2002 hosts the edge module 220 and the SIEM detection engine 230, and the tenant server 104 hosts the tenant storage archive 120. In yet another embodiment, the edge module 220 is hosted by the SIEM provider server 2002, the SIEM detection engine 230 is hosted by the SIEM provider server 2002, and the tenant storage archive 120 is hosted by the SIEM provider server 2002. In yet another embodiment, the SIEM detection engine 260 is hosted by the third party server 250, and the tenant storage archive 120 is hosted by the tenant server 104. In yet another embodiment, the SIEM detection engine 260 is hosted by a third party server 250 and the tenant storage archive 120 is hosted by the third party server 250.

[0058] Continuing to refer to Figures 1-6, according to one aspect of the method 8000, the central control plane module 200 of the security monitoring system 2000 simultaneously updates the configuration of multiple gateway modules 210, 212 based on common changes to their associated log sources 112, 114, and updates the configuration of at least one of the multiple gateway modules 210, 212 based on exceptions associated with their associated log sources 112, 114.

[0059] Continuing with reference to FIGS. 1-6, according to one aspect of the method 8000, the central control plane module 200 of the security monitoring system 2000 creates new gateway modules 210, 212 associated with the new log sources 112, 114.

[0060] Continuing with reference to FIGS. 1-6, in accordance with one embodiment of the method 8000, multiple tenant networks 20101, 20102, . . . 2010 of the security monitoring system 2000 are n At least one of the log sources has a cloud-based log source and an on-premise log source, the cloud-based log source generating raw log data and the on-premise log source generating raw log data.

[0061] 1-6, according to one aspect of the method 8000, the edge module 220 is hosted by a SIEM provider server 2002 and the central control plane module 200 is hosted by the SIEM provider server 2002. In another aspect, the central control plane module 200 identifies log sources 112, 114 that are no longer generating raw log data.

[0062] Continuing to refer to FIGS. 1-6, according to one embodiment of the method 8000, in performing a security action, the security monitoring system 2000 monitors multiple tenant networks 20101, 20102, . . . 2010. nand in another aspect, generating a security alert to be sent to an administrator of at least one of the tenant networks 20101, 20102, . . . 2010. n access to at least one of the tenant networks 20101, 20102, ... 2010 n 10. Remove access rights from one or more devices (e.g., one or more machines implementing clients 1012, 1014, 1016) configured to access the.

[0063] 7 illustrates a computing system 9000 according to at least one non-limiting aspect of the present disclosure. The computing system 9000 and various components configured therein may be used to implement and / or execute any of the various components of systems 2000, 3000, 5000, and 7000 described herein above in connection with FIGS. 2-5, as described below.

[0064] According to the non-limiting form of Figure 7, the computer system 9000 may include a bus 9002 (i.e., interconnect), one or more processors 9004, a main memory 9006, a read-only memory 9008, a removable storage medium 9010, a mass storage device 9012, and one or more communication ports 9014. It should be understood that components such as removable storage media are optional and not required in all systems. The communication port 9014 may be connected to one or more networks by which the computer system 9000 may receive and / or transmit data.

[0065] As used herein, a "processor" may mean one or more microprocessors, central processing units (CPUs), computing devices, microcontrollers, digital signal processors, or similar devices, or any combination thereof, regardless of their architecture. An apparatus that performs a process may include, for example, a processor and devices such as input and output devices suitable for performing the process.

[0066] The processor 9004 may be any known processor that is generally well known to those skilled in the relevant art and well defined in the literature, such as, but not limited to, processors manufactured and sold by INTEL®, AMD®, MOTOROLA®, and the like. The communication port 9014 may be any of an RS-232 port for use with a modem-based dial-up connection, a 10 / 100 Ethernet port, a gigabit port using copper or fiber, or a USB port, and the like. The communication port 9014 may be selected according to the network, such as a local area network (LAN), a wide area network (WAN), a CDN, or any network to which the computer system 9000 is connected. The computer system 9000 may communicate with peripheral devices (e.g., display screen 9016, input device 9018) via input / output (I / O) port 9020.

[0067] The main memory 9006 may be a random access memory (RAM) or other dynamic storage device commonly known in the art. The read-only memory 9008 may be other static storage devices, such as programmable read-only memory (PROM) chips for storing static information, such as instructions for the processor 9004. The mass storage device 9012 may be used to store information and instructions. For example, hard disks, such as the Adaptec® family of small computer serial interface (SCSI) drives, optical disks, arrays of disks, such as a Redundant Array of Independent Disks (RAID), such as the Adaptec® family of RAID drives, or other mass storage devices may be used.

[0068] The bus 9002 communicatively couples the processor 9004 to other memory, storage, and communication blocks. The bus 9002 can be a PCI / PCI-X, SCSI, Universal Serial Bus (USB) based system bus (or other depending on the storage device used), etc. The removable storage medium 9010 can be an external hard drive, a floppy drive, an IOMEGA® Zip drive, a compact disk - read only memory (CD-ROM), a compact disk - rewriteable (CD-RW), a digital versatile disk - read only memory (DVD-ROM), etc.

[0069] The embodiments described herein may be provided as one or more computer program products, which may include machine-readable media having instructions stored thereon that may be used to program a computer (or other electronic device) to execute a process. As used herein, the term "machine-readable medium" refers to any medium, a combination of the same or different media, that participates in providing data (e.g., instructions, data structures) that may be read by a computer, a processor, or a similar device. Such media may take a variety of forms, including, but not limited to, non-volatile media, volatile media, and transmission media. Non-volatile media include persistent memory, such as optical and magnetic disks. Volatile media include dynamic random access memory, which typically constitutes the main memory of a computer. Transmission media include coaxial cables, copper wire, and optical fibers, including the wires that constitute a system bus coupled to a processor. Transmission media may include or transmit acoustic waves, light waves, and electromagnetic radiation, such as those generated during radio frequency (RF) and infrared (IR) data communications.

[0070] Machine-readable media include, but are not limited to, floppy disks, optical disks, CD-ROMs, magneto-optical disks, ROMs, RAMs, erasable programmable read-only memories (EPROMs), electrically erasable programmable read-only memories (EEPROMs), magnetic or optical cards, flash memories, or other types of media / machine-readable media suitable for storing electronic instructions. Additionally, aspects described herein may be downloaded as a computer program product, where the program may be transferred from a remote computer to a requesting computer by data signals embodied in a carrier wave or other propagating medium over a communications link (e.g., a modem or network connection). Various forms of computer-readable media may be involved in transmitting data (such as sequences of instructions) to a processor. For example, data may be (i) delivered from a RAM to a processor, (ii) transmitted over a wireless transmission medium, (iii) formatted and / or transmitted according to a number of formats, standards, or protocols, and / or (iv) encrypted in any of a variety of ways known in the art.

[0071] The computer readable medium may store (in any suitable format) the program elements that are appropriate for carrying out the method.

[0072] As mentioned above, main memory 9006 is encoded with applications 9022 supporting the functionality described herein (applications 9022 may be applications that provide some or all of the functionality of the CD service described herein, including client applications). Applications 9022 (and / or other resources described herein) may be embodied as software code, such as data and / or logical instructions (e.g., code stored in memory or on another computer-readable medium such as a disk) that support processing functions according to different aspects described herein.

[0073] During operation of one embodiment, the processor 9004 accesses the main memory 9006 through use of the bus 9002 to run, execute, interpret, or otherwise execute logical instructions of an application 9022. The execution of the application 9022 generates processing functions for services associated with the application. In other words, the process 9024 represents one or more portions of the application 9022 executing in or on the processor 9004 within the computer system 9000.

[0074] In addition to the process 9024 performing the operations as described herein, it should be noted that other aspects described herein include the application 9022 itself (i.e., unexecuted or non-executed logic instructions and / or data). The application 9022 may be stored on a computer-readable medium such as a disk (e.g., a repository) or optical medium. According to other aspects, the application 9022 may also be stored in a memory-based system such as firmware, read-only memory (ROM), or executable code in the main memory 9006 (e.g., in a random access memory or RAM) as exemplified above. For example, the application 9022 may be stored in the removable storage medium 9010, the read-only memory 9008, and / or the mass storage device 9012.

[0075] Those skilled in the art will appreciate that computer system 9000 may include other processes and / or software and hardware components, such as an operating system that controls the allocation and use of hardware resources.

[0076] Various aspects of the subject matter described herein are set forth in the following numbered sections.

[0077] Item 1: A method for streamlining and standardizing data ingestion from a plurality of tenant networks in a security monitoring system, the security monitoring system comprising an edge module, a central control plane module, and a plurality of data gateway modules, each of the plurality of data gateway modules being associated with a different log source, each of the plurality of tenant networks including at least one log source, the method comprising: receiving, by each of the plurality of data gateway modules of the security monitoring system, raw log data from the log source associated therewith; generating, by each of the plurality of data gateway modules of the security monitoring system, formatted log data based on the raw log data; ingesting, by the edge module of the security monitoring system, the formatted log data from the plurality of data gateway modules; automatically updating, by the central control plane module of the security monitoring system, a configuration of at least one of the plurality of data gateway modules based on changes in an associated log source therewith; and performing, by the security monitoring system, a security action associated with at least one of the plurality of tenant networks based on the ingested formatted data.

[0078] Clause 2: The method of clause 1, further comprising: filtering, by each of the plurality of data gateway modules of the security monitoring system, the raw log data to include only relevant security fields to generate the formatted log data; and normalizing, by each of the plurality of data gateway modules of the security monitoring system, the raw log data based on a standard schema to generate the formatted log data.

[0079] Clause 3: The method of clause 1 or 2, further comprising a step of updating, by the central control plane module of the security monitoring system, the filtering of the raw log data performed by the multiple gateway modules based on updates to the associated security fields.

[0080] Clause 4: The method of any one of clauses 1 to 3, further comprising the steps of: routing the raw log data to a tenant storage archive by each of the plurality of data gateway modules of the security monitoring system; and routing the formatted log data to a SIEM detection engine by each of the plurality of data gateway modules of the security monitoring system.

[0081] Clause 5: A method according to any one of clauses 1 to 4, further comprising the steps of hosting the edge module by a SIEM provider server, hosting the SIEM detection engine by the SIEM provider server, and hosting the tenant storage archive by the tenant server.

[0082] Clause 6: A method according to any one of clauses 1 to 5, further comprising the steps of hosting the edge module by the SIEM provider server, hosting the SIEM detection engine by the SIEM provider server, and hosting the tenant storage archive by the SIEM provider server.

[0083] Clause 7: hosting the SIEM detection engine by a third party server; and hosting the edge module by the third party server; 7. The method of any one of claims 1 to 6, further comprising: hosting said tenant storage archive by said tenant party server.

[0084] Clause 8: The method of any one of clauses 1 to 7, further comprising the steps of hosting the SIEM detection engine by a third party server, and hosting the tenant storage system by the third party server.

[0085] Clause 9: The method of any one of clauses 1 to 8, further comprising: a step of simultaneously updating, by the central control plane module of the security monitoring system, configurations of the multiple gateway modules based on common changes to their associated log sources; and a step of updating, by the central control plane module of the security monitoring system, configurations of at least one of the multiple gateway modules based on exceptions related to the log source associated therewith.

[0086] Clause 10: A method according to any one of clauses 1 to 9, further comprising a step of generating, by the central control plane module of the security monitoring system, a new gateway module associated with the new log source.

[0087] Clause 11: A method according to any one of clauses 1 to 10, wherein at least one of the multiple tenant networks of the security monitoring system has a cloud-based log source and an on-premises log source, and the method further comprises a step of generating the raw log data by the cloud-based log source, and a step of generating the raw log data by the on-premises log source.

[0088] Clause 12: The method of any one of clauses 1 to 11, further comprising the steps of hosting the edge module by a SIEM provider server, and hosting the central control plane module by the SIEM provider server.

[0089] Clause 13: A method according to any one of clauses 1 to 12, further comprising a step of identifying, by the central control plane module, log sources that are no longer generating raw log data.

[0090] Clause 14: A method according to any one of clauses 1 to 13, wherein the step of performing a security action comprises the step of generating a security alert that is sent to an administrator of the at least one tenant network.

[0091] Clause 15: The method according to clauses 1 to 14, wherein the step of performing the security action comprises removing access rights to the at least one tenant network from one or more devices configured to access the at least one tenant network.

[0092] Clause 16: A security monitoring system capable of streamlining and standardizing data ingestion from a plurality of tenant networks, each of the plurality of tenant networks including at least one log source, the security monitoring system comprising: a plurality of data gateway modules, each of the plurality of data gateway modules associated with a different log source, each of the plurality of data gateway modules configured to receive raw log data from the log source associated therewith and generate formatted log data based on the raw log data; an edge module configured to ingest the formatted log data from the plurality of data gateway modules; and a central control plane module configured to automatically update a configuration of at least one of the plurality of gateway modules in response to changes in the log source associated therewith, the security monitoring system configured to perform a security action associated with at least one of the plurality of tenant networks based on the ingested formatted data.

[0093] Clause 17: The system described in clause 16, wherein each of the plurality of data gateway modules is configured to filter the raw log data to include only relevant security fields to generate the formatted log data, and to normalize the raw data based on a standard schema to generate the formatted log data.

[0094] Clause 18: The system described in clause 16 or 17, wherein the central control plane module is configured to update settings of the multiple gateway modules and update the filtering of the raw log data based on updates to associated security fields.

[0095] Clause 19: The system described in clauses 16 to 18, wherein at least one of the plurality of data gateway modules is configured to route the raw log data to a tenant storage archive and route the formatted log data to a SIEM detection engine.

[0096] Clause 20: The system described in clauses 16 to 19, wherein the edge module is hosted by a SIEM provider server, the SIEM detection engine is hosted by the SIEM provider server, and the tenant storage archive is hosted by a tenant server.

[0097] Clause 21: The system described in clauses 16 to 20, wherein the edge module is hosted by a SIEM provider server, the SIEM detection engine is hosted by the SIEM provider server, and the tenant storage archive is hosted by the SIEM provider server.

[0098] Clause 22: The system described in clauses 16 to 21, wherein the SIEM detection engine is hosted by a third party server, the edge module is hosted by the third party server, and the tenant storage archive is hosted by a tenant server.

[0099] Clause 23: The system described in clauses 16 to 22, wherein the SIEM detection engine is hosted by a third party server and the tenant storage archive is hosted by the third party server.

[0100] Clause 24: The system described in clauses 16 to 23, wherein the central control plane module is configured to simultaneously update configurations of the multiple gateway modules based on common changes to their associated log sources, and to update configurations of at least one of the multiple gateway modules based on exceptions related to the log sources associated therewith.

[0101] Clause 25: The system described in clauses 16 to 24, wherein the central control plane module is configured to create a new gateway module associated with the new log source.

[0102] Clause 26: The system described in clauses 16-25, wherein at least one of the plurality of tenant networks comprises a cloud-based log source and an on-premise log source.

[0103] Clause 27: The system described in clauses 16 to 26, wherein the edge module is hosted by a SIEM provider server and the central control plane module is hosted by the SIEM provider server.

[0104] Clause 28: The system described in clauses 16-27, wherein the central control plane module is configured to identify log sources that are no longer generating raw log data.

[0105] Clause 29: The system described in clauses 16 to 28, wherein the security action includes generating a security alert that is sent to an administrator of the at least one tenant network.

[0106] Clause 30: The system described in clauses 16 to 29, wherein the security action includes removing access rights to the at least one tenant network from one or more devices configured to access the at least one tenant network.

[0107] Clause 31: A system for streamlining and standardizing security data ingestion, comprising: a plurality of tenant networks, each of the plurality of tenant networks including at least one log source; and a security monitoring subsystem, the security monitoring subsystem comprising: a plurality of data gateway modules, each of the plurality of data gateway modules being associated with a different log source, the plurality of data gateway modules being configured to receive raw log data from the log sources associated therewith and generate formatted log data based on the raw log data; an edge module that ingests the formatted log data from the plurality of data gateway modules; and a central control plane module configured to automatically update a configuration of at least one of the plurality of gateway modules in response to changes in the log source associated therewith; and the security monitoring subsystem is configured to perform a security action associated with at least one of the plurality of tenant networks based on the ingested formatted data.

[0108] Clause 32: The system described in clause 31, wherein each of the plurality of data gateway modules is configured to filter the raw log data to include only relevant security fields to generate the formatted log data, and to normalize the raw data based on a standard schema to generate the formatted log data.

[0109] Clause 33: The system described in clause 31 or 32, wherein the central control plane module is configured to update settings of the multiple gateway modules and update the filtering of the raw log data based on updates to associated security fields.

[0110] Clause 34: The system described in clauses 31 to 33, wherein at least one of the plurality of data gateway modules is configured to route the raw log data to a tenant storage archive and route the formatted log data to a SIEM detection engine.

[0111] Clause 35: The system described in clauses 31 to 34, wherein the edge module is hosted by a SIEM provider server, the SIEM detection engine is hosted by the SIEM provider server, and the tenant storage archive is hosted by a tenant server.

[0112] Clause 36: The system described in clauses 31 to 35, wherein the edge module is hosted by a SIEM provider server, the SIEM detection engine is hosted by the SIEM provider server, and the tenant storage archive is hosted by the SIEM provider server.

[0113] Clause 37: The system described in clauses 31 to 38, wherein the SIEM detection engine is hosted by a third party server, the edge module is hosted by a third party server, and the tenant storage archive is hosted by a tenant server.

[0114] Clause 38: The system described in clauses 31 to 39, wherein the SIEM detection engine is hosted by a third party server and the tenant storage archive is hosted by the third party server.

[0115] Clause 39: The system described in clauses 31 to 40, wherein the central control plane module is configured to simultaneously update configurations of the multiple gateway modules based on common changes to their associated log sources, and to update configurations of at least one of the multiple gateway modules based on exceptions related to the log sources associated therewith.

[0116] Clause 40: The system described in clauses 31 to 39, wherein the central control plane module is configured to create a new gateway module associated with the new log source.

[0117] Clause 41: The system described in clauses 31-40, wherein at least one of the plurality of tenant networks comprises a cloud-based log source and an on-premise log source.

[0118] Clause 42: The system described in clauses 31 to 41, wherein the edge module is hosted by a SIEM provider server and the central control plane module is hosted by the SIEM provider server.

[0119] Clause 43: The system described in clauses 31 to 42, wherein the central control plane module is configured to identify log sources that are no longer generating raw log data.

[0120] Clause 44: The system described in clauses 31 to 43, wherein the security action includes generating a security alert that is sent to an administrator of the at least one tenant network.

[0121] Clause 45: The system described in clauses 31 to 44, wherein the security action includes removing access rights to the at least one tenant network from one or more devices configured to access the at least one tenant network.

[0122] Clause 46: A system and method for streamlining and standardizing the ingestion of data from multiple tenant networks for security information and event management is substantially disclosed and described herein.

[0123] All patents, patent applications, publications, or other disclosure materials described herein are incorporated herein by reference in their entirety, as if each individual reference were expressly incorporated by reference. All references and any material, or portions thereof, that are said to be incorporated herein by reference are incorporated herein only to the extent that the incorporated material does not contradict existing definitions, descriptions, or other disclosed material set forth in this disclosure. Therefore, and to the extent necessary, the present disclosure set forth herein takes precedence over any conflicting material incorporated herein by reference, and the present disclosure is expressly set forth within the control of this application.

[0124] Various exemplary and illustrative embodiments have been described. The embodiments described herein are understood to provide illustrative features of various details of the various embodiments of the present disclosure, and therefore, unless otherwise specified, it is to be understood that, to the extent possible, one or more features, elements, components, ingredients, materials, structures, modules, and / or aspects of the embodiments of the present disclosure may be combined, separated, substituted, and / or rearranged with or for one or more other features, elements, components, ingredients, materials, structures, modules, and / or aspects of the embodiments of the present disclosure without departing from the scope of the present disclosure. Thus, one skilled in the art will recognize that various substitutions, modifications, or combinations of any of the exemplary embodiments may be made without departing from the claimed subject matter. Moreover, one skilled in the art will recognize or be able to ascertain, upon review of this specification, many equivalents to the various embodiments of the present disclosure using no more than routine experimentation. Thus, the present disclosure is not limited by the description of the various embodiments, but only by the scope of the claims.

[0125] Those skilled in the art will recognize that the terms used herein in general, and in the appended claims in particular (e.g., the body of the appended claims), are generally intended as "open-ended" terms (e.g., the term "including" should be interpreted as "including but not limited to," the term "having" should be interpreted as "having at least," the term "includes" should be interpreted as "including but not limited to," etc.). It will be further understood by those skilled in the art that where recitation of a particular number of introduced claims is intended, such intent will be expressly recited in the claims, and in the absence of such recitation, no such intent exists. For example, as an aid to understanding, the following appended claims may include the use of the introductory phrases "at least one" and "one or more" to introduce the recitation of claims. However, the use of such phrases should not be construed as implying that the introduction of a claim recitation with the indefinite article "a" or "an" limits any particular claim that includes such an introduced claim recitation to claims that include only one of such recitations, even when the same claim includes the introductory phrases "one or more" or "at least one" and an indefinite article such as "a" or "an" (e.g., "a" and / or "an" should ordinarily be construed to mean "at least one" or "one or more").

[0126] Furthermore, even if a particular number of enumerations in an introduced claim are explicitly recited, one of ordinary skill in the art will recognize that such enumerations should typically be interpreted to mean at least the number recited (e.g., the mere enumeration of "two enumerations," without other modifiers, typically means at least two enumerations or more than two enumerations). Furthermore, in those cases where a convention similar to "at least one of A, B, and C, etc." is used, such a structure is generally intended in the sense that one of ordinary skill in the art would understand the convention (e.g., "a system having at least one of A, B, and C" includes, but is not limited to, A alone, B alone, C alone, a system having A and B together, a system having A and C together, a system having B and C together, and / or a system having A, B, and C together, etc.). In instances where a convention similar to "at least one of A, B, or C, etc." is used, such construction is generally intended in the sense that one of ordinary skill in the art would understand the convention (e.g., "a system having at least one of A, B, or C" includes, but is not limited to, A alone, B alone, C alone, a system having A and B together, a system having A and C together, a system having B and C together, and / or a system having A, B, and C together, etc.). It will be further understood by those of ordinary skill in the art that disjunctions and / or phrases, whether in the description, claims, or drawings, that typically present two or more alternative terms, should be understood to contemplate the possibility of including one of the terms, either of the terms, or both terms, unless the context dictates otherwise. For example, the phrase "A or B" will typically be understood to include the possibilities of "A" or "B" or "A and B."

[0127] With respect to the appended claims, those skilled in the art will appreciate that the actions recited therein may generally occur in any order. Also, while the claim recitations are presented in order(s), it should be understood that various actions may occur in other orders than those described, or may occur simultaneously. Examples of such alternative orders include overlapping, interleaving, interrupting, reordering, incremental, preparatory, supplementary, simultaneous, reverse, or other variant orders, unless the context dictates otherwise. Moreover, terms such as "responsive," "related to," or other past tense adjectives are generally not intended to exclude such variants, unless the context dictates otherwise.

[0128] It should be noted that any reference to "one embodiment," "embodiment," "exemplary," "one example," and the like means that a particular feature, structure, or characteristic described in connection with an embodiment is included in at least one embodiment. Thus, the appearances of the phrases "in one embodiment," "in an embodiment," "in an example," and "in one example" in various places throughout this specification do not necessarily all refer to the same embodiment. Furthermore, the particular features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0129] As used herein, the singular forms "a," "an," and "the" include plural references unless the context clearly dictates otherwise.

[0130] Directional terms used herein, such as, for example, but not limited to, up, down, left, right, below, upward, front, rear, and variations thereof, relate to the orientation of the elements as shown in the accompanying drawings and are not intended to be limiting with respect to the claims, unless expressly stated otherwise.

[0131] The term "about" or "approximately" as used in this disclosure, unless otherwise specified, refers to an acceptable error for a particular value as determined by one of ordinary skill in the art, which depends in part on how the value is measured or determined. In certain embodiments, the term "about" or "approximately" refers to within 1, 2, 3, or 4 standard deviations. In certain embodiments, the term "about" or "approximately" refers to within 50%, 200%, 105%, 100%, 9%, 8%, 7%, 6%, 5%, 4%, 3%, 2%, 1%, 0.5%, or 0.05% of a given value or range.

[0132] As used herein, unless otherwise indicated, all numerical parameters are to be understood as being predicated and, in all instances, the numerical parameter should be understood to be modified by the term "about" given the inherent variability characteristic of the underlying measurement technique used to determine the numerical value of the parameter. At the very least, and not as an attempt to limit the application of the doctrine of equivalents to the scope of the claims, each numerical parameter set forth herein should at least be construed in light of the number of reported significant digits and by applying ordinary rounding techniques.

[0133] Any numerical range recited herein includes all subranges subsumed within the recited range. For example, a range of 1 to 100 includes all subranges between (and including) the recited minimum value of 1 and the recited maximum value of 100, i.e., having a minimum value of 1 or more and a maximum value of 100 or less. Also, all ranges recited herein include the recited range endpoints. For example, a range of 1 to 100 includes the endpoints 1 and 100. Any maximum numerical limitation recited herein is intended to include all lower numerical limitations subsumed therein, and any minimum numerical limitation recited herein is intended to include all higher numerical limitations subsumed therein. Thus, applicants reserve the right to amend this specification, including the claims, to explicitly recite subranges that are subsumed within the explicitly recited ranges. All such ranges are inherently described herein.

[0134] Any patent application, patent, non-patent publication, or other disclosure material mentioned in this specification and / or listed in any application data sheet is incorporated herein by reference to the extent that the incorporated material does not contradict this specification. Thus, and to the extent necessary, the present disclosure as expressly set forth herein takes precedence over any conflicting material incorporated herein by reference. Any material or portion thereof that is said to be incorporated herein by reference but that contradicts an existing definition, statement, or other disclosure material set forth herein is incorporated only to the extent that no contradiction occurs between the incorporated material and the existing disclosure material.

[0135] The terms "comprise" (and any form of comprise, such as "comprises", "comprising"), "have" (and any form of have, such as "has" and "have"), "include" (and any form of include, such as "includes" and "including"), and "contain" (and any form of contain, such as "contains" and "containing") are open-ended linking verbs. As a result, a system that "comprises", "has", "contains", or "contains" one or more elements possesses those one or more elements, but is not limited to possessing only those one or more elements. Similarly, an element of a system, device, or apparatus that "comprises", "has", "contains", or "contains" one or more features possesses those one or more features, but is not limited to possessing only those one or more features.

[0136] The foregoing detailed description describes various aspects of devices and / or processes through the use of block diagrams, flow charts, and / or examples. Where such block diagrams, flow charts, and / or examples include one or more functions and / or operations, those skilled in the art will appreciate that each function and / or operation in such block diagrams, flow charts, and / or examples can be individually and / or collectively implemented by a wide range of hardware, software, firmware, or substantially any combination thereof. Those skilled in the art will recognize that some aspects of the aspects disclosed herein can be equivalently implemented in whole or in part in an integrated circuit as one or more computer programs running on one or more computers (e.g., as one or more programs running on one or more computer systems), as one or more programs running on one or more processors (e.g., as one or more programs running on one or more microprocessors), as firmware, or substantially any combination thereof, and that designing the circuitry and / or writing the code for the software and / or firmware is within the skill of those skilled in the art in light of this disclosure. Further, those skilled in the art will appreciate that the mechanisms of the subject matter described herein can be distributed as one or more program products in a variety of forms, and that the illustrative forms of the subject matter described herein apply regardless of the particular type of signal-bearing medium used to actually effect the distribution.

[0137] The instructions used to program the logic to implement the various disclosed aspects may be stored in a memory in the system, such as a dynamic random access memory (DRAM), cache, flash memory, or other storage device. Additionally, the instructions may be distributed over a network or via other computer-readable media. Thus, a machine-readable medium is any mechanism for storing or transmitting information in a form readable by a machine (e.g., a computer), including, but not limited to, a floppy diskette, an optical disk, a compact disk, a read-only memory (CD-ROM), and a magneto-optical disk, a read-only memory (ROM), a random access memory (RAM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic or optical card, a flash memory, or a tangible machine-readable storage device used in transmitting information over the Internet via an electrical, optical, acoustic, or other form of propagated signal (e.g., carrier wave, infrared signal, digital signal, etc.). Accordingly, non-transitory computer-readable media includes any type of tangible, machine-readable medium suitable for storing or transmitting electronic instructions or information in a form readable by a machine (eg, a computer).

[0138] As used in any aspect of the present specification, the term "control circuitry" may refer to, for example, hardwired circuitry, programmable circuitry (e.g., a computer processor with one or more individual instruction processing cores, a processing unit, a processor, a microcontroller, a microcontroller unit, a controller, a digital signal processor (DSP), a programmable logic device (PLD), a programmable logic array (PLA), or a field programmable gate array (FPGA), a state machine circuit, firmware that stores instructions executed by the programmable circuit, and any combination thereof. Control circuitry may be embodied, collectively or individually, as circuitry that forms part of a larger system, e.g., an integrated circuit (IC), an application specific integrated circuit (ASIC), a system on a chip (SoC), a desktop computer, a laptop computer, a tablet computer, a server, a smartphone, etc. Thus, as used herein, "control circuitry" may refer to, for example, a hardwired circuit, a programmable logic device (e.g., a hardwired circuit), a programmable logic array (PLA), a programmable logic device (PLA), a programmable logic array (FPGA), a programmable logic device (PLD), a programmable logic array (PLA), or a field programmable gate ...FPGA), a programmable logic device (FPGA), a programmable logic device (FPGA), a programmable logic device (FPGA), a programmable logic device (FPGA), a programmable logic device (FPGA), a programmable logic device ( includes, but is not limited to, electrical circuitry having at least one discrete electrical circuit, electrical circuitry having at least one integrated circuit, electrical circuitry having at least one application specific integrated circuit, electrical circuitry forming a general purpose computing device configured by a computer program (e.g., a general purpose computer configured by a computer program at least in part to execute a process and / or a device described herein, or a microprocessor configured by a computer program at least in part to execute a process and / or a device described herein), electrical circuitry forming a memory device (e.g., a form of random access memory), and / or electrical circuitry forming a communication device (e.g., a modem, a communication switch, or an optoelectronic device).Those skilled in the art will recognize that the subject matter described herein may be implemented in an analog or digital fashion or some combination thereof.

[0139] As used in any aspect herein, the term "logic" may refer to an application, software, firmware, and / or circuitry configured to perform any of the aforementioned operations. Software may be embodied as a software package, code, instructions, instruction sets, and / or data recorded on a non-transitory computer-readable storage medium. Firmware may be embodied as code, instructions, or instruction sets, and / or data hard-coded (e.g., non-volatile) within a memory device.

[0140] As used in any aspect of this specification, the terms "component," "system," "module," etc. may refer to a computer-related entity, hardware, a combination of hardware and software, software, or software in execution.

[0141] As used in any aspect of the present specification, an "algorithm" refers to a self-consistent sequence of steps leading to a desired result, where the "steps" refer to manipulations of physical quantities and / or logical states which may, but need not, take the form of electrical or magnetic signals that can be stored, moved, combined, compared, and otherwise manipulated. It is common to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, or the like. These and similar terms may be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities and / or states.

Claims

1. 1. A method for streamlining and standardizing data ingestion from multiple tenant networks in a security monitoring system, the security monitoring system comprising: an edge module; a central control plane module; and a plurality of data gateway modules, each of the plurality of data gateway modules associated with a different log source, each of the plurality of tenant networks including at least one log source, the method comprising: receiving, by each of the plurality of data gateway modules of the security monitoring system, raw log data from the log source associated therewith; generating, by each of the plurality of data gateway modules of the security monitoring system, formatted log data based on the raw log data; ingesting, by the edge module of the security monitoring system, the formatted log data from the plurality of data gateway modules; automatically updating, by the central control plane module of the security monitoring system, a configuration of at least one of the plurality of data gateway modules based on a change in a log source associated therewith; performing, by the security monitoring system, a security action associated with at least one of the plurality of tenant networks based on the captured formatted data; A method for providing the above.

2. filtering, by each of the plurality of data gateway modules of the security monitoring system, the raw log data to include only relevant security fields to generate the formatted log data; normalizing, by each of the plurality of data gateway modules of the security monitoring system, the raw log data based on a standard schema to generate the formatted log data; The method of claim 1 further comprising:

3. updating, by the central control plane module of the security monitoring system, the filtering of the raw log data performed by the plurality of gateway modules based on updates to the associated security fields; The method of claim 2 , further comprising:

4. routing, by each of the plurality of data gateway modules of the security monitoring system, the raw log data to a tenant storage archive; routing, by each of the plurality of data gateway modules of the security monitoring system, the formatted log data to a SIEM detection engine; The method of claim 1 further comprising:

5. hosting the edge module by a SIEM provider server; hosting the SIEM detection engine by the SIEM provider server; hosting the tenant storage archive by the tenant server; The method of claim 4 further comprising:

6. hosting the edge module by the SIEM provider server; hosting the SIEM detection engine by the SIEM provider server; hosting the tenant storage archive by the SIEM provider server; The method of claim 4 further comprising:

7. hosting the SIEM detection engine by a third party server; hosting the edge module by the third party server; hosting said tenant storage archive by said tenant party server; The method of claim 4 further comprising:

8. hosting the SIEM detection engine by a third party server; hosting the tenant storage system by the third party server; The method of claim 4 further comprising:

9. updating, by the central control plane module of the security monitoring system, configurations of the plurality of gateway modules simultaneously based on a common change to their associated log sources; updating, by the central control plane module of the security monitoring system, a configuration of at least one of the plurality of gateway modules based on an exception associated with the log source associated therewith; The method of claim 1 further comprising:

10. generating, by the central control plane module of the security monitoring system, a new gateway module associated with the new log source; The method of claim 1 further comprising:

11. At least one of the plurality of tenant networks of the security monitoring system includes a cloud-based log source and an on-premise log source; The method comprises: generating the raw log data by the cloud-based log source; generating the raw log data by the on-premise log source; The method of claim 1 further comprising:

12. hosting the edge module by a SIEM provider server; hosting the central control plane module by the SIEM provider server; The method of claim 1 further comprising:

13. identifying, by said central control plane module, log sources that are no longer generating raw log data; The method of claim 1 further comprising:

14. performing the security action includes generating a security alert that is sent to an administrator of the at least one tenant network. The method of claim 1.

15. performing the security action comprises removing access rights to the at least one tenant network from one or more devices configured to access the at least one tenant network. The method of claim 1.

16. 1. A security monitoring system capable of streamlining and standardizing the ingestion of data from a plurality of tenant networks, each of the plurality of tenant networks including at least one log source, the security monitoring system comprising: a plurality of data gateway modules, each of the plurality of data gateway modules being associated with a different log source, and each of the plurality of data gateway modules: receiving raw log data from said log sources associated therewith; generating formatted log data based on the raw log data; A plurality of data gateway modules configured as above; an edge module configured to ingest the formatted log data from the plurality of data gateway modules; a central control plane module configured to automatically update a configuration of at least one of the plurality of gateway modules in response to changes in the log source associated therewith; Equipped with the security monitoring system is configured to perform a security action associated with at least one of the plurality of tenant networks based on the captured formatted data. Security surveillance system.

17. Each of the plurality of data gateway modules is filtering the raw log data to include only relevant security fields to generate the formatted log data; and normalizing the raw data based on a standard schema to generate the formatted log data.

17. The system of claim 16.

18. the central control plane module is configured to update configurations of the plurality of gateway modules and update the filtering of the raw log data based on updates to associated security fields.

20. The system of claim 17.

19. At least one of the plurality of data gateway modules: Routing the raw log data to a tenant storage archive; routing the formatted log data to a SIEM detection engine; The system of claim 16 configured to:

20. the edge module is hosted by a SIEM provider server, the SIEM detection engine is hosted by the SIEM provider server, and the tenant storage archive is hosted by a tenant server; 20. The system of claim 19.

21. the edge module is hosted by a SIEM provider server, the SIEM detection engine is hosted by the SIEM provider server, and the tenant storage archive is hosted by the SIEM provider server; 20. The system of claim 19.

22. the SIEM detection engine is hosted by a third party server, the edge module is hosted by the third party server, and the tenant storage archive is hosted by a tenant server; 20. The system of claim 19.

23. the SIEM detection engine is hosted by a third party server, and the tenant storage archive is hosted by the third party server; 20. The system of claim 19.

24. The central control plane module: Simultaneously updating configurations of the plurality of gateway modules based on common changes to their associated log sources; and updating a configuration of at least one of the plurality of gateway modules based on an exception associated with a log source associated therewith.

17. The system of claim 16.

25. the central control plane module is configured to create a new gateway module associated with the new log source.

17. The system of claim 16.

26. At least one of the plurality of tenant networks comprises a cloud-based log source and an on-premise log source.

17. The system of claim 16.

27. the edge modules are hosted by a SIEM provider server and the central control plane module is hosted by the SIEM provider server; 17. The system of claim 16.

28. the central control plane module is configured to identify log sources that are no longer generating raw log data; 17. The system of claim 16.

29. the security action includes generating a security alert that is sent to an administrator of the at least one tenant network.

17. The system of claim 16.

30. the security action includes removing access rights to the at least one tenant network from one or more devices configured to access the at least one tenant network.

17. The system of claim 16.

31. 1. A system for streamlining and standardizing security data capture, comprising: a plurality of tenant networks, each of the tenant networks including at least one log source; a security monitoring subsystem, The security monitoring subsystem includes: a plurality of data gateway modules, each of the plurality of data gateway modules being associated with a different log source, and the plurality of data gateway modules: receiving raw log data from said log sources associated therewith; generating formatted log data based on the raw log data; A plurality of data gateway modules configured as above; an edge module that ingests the formatted log data from the plurality of data gateway modules; a central control plane module configured to automatically update a configuration of at least one of the plurality of gateway modules in response to changes in the log source associated therewith; Equipped with the security monitoring subsystem is configured to perform a security action associated with at least one of the plurality of tenant networks based on the captured formatted data. system.

Images