Auditing Software Alert Profile Relevance Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In large and complex computer systems, alert profiles that were relevant at a certain time may become irrelevant due to system growth or changes in traffic, leading to unnecessary alerts that create 'background noise', which can be ignored by users.
Innovation Solution
The auditing software, which includes a classifier trained using machine learning, monitors event logs to determine if an alert profile is relevant and deactivates or deletes it when it is no longer relevant, thereby reducing active alert profiles and improving security by minimizing unnecessary alerts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If alert profiles are continuously monitored and manually managed in large computer systems, then security monitoring coverage is maintained, but system complexity and resource consumption increase significantly
Solution Approach 1:
The system automatically monitors event logs and determines alert profile relevance without requiring manual intervention. The auditing software autonomously evaluates whether alert profiles remain relevant based on current system state and event log analysis, eliminating the need for continuous manual management while maintaining comprehensive security monitoring coverage
Solution Approach 2:
Manual alert profile management is replaced with an automated computer-based system that uses event log analysis and relevance determination algorithms. This substitution of mechanical/manual operations with automated computational processes reduces system complexity while maintaining or improving monitoring effectiveness
2Loss of information
If alert profiles are retained in active status, then historical monitoring coverage is preserved, but background noise increases and reduces alert effectiveness
Solution Approach 1:
Alert profile status transitions from static to dynamic, allowing profiles to automatically transition between active and inactive states based on their relevance to current system conditions. This dynamic management ensures that only currently relevant alert profiles generate notifications, eliminating background noise from obsolete alerts while preserving the ability to restore profiles when needed
Solution Approach 2:
The system automatically discards (deactivates) alert profiles that are no longer relevant based on event log analysis, removing them from active monitoring to eliminate background noise. When needed, these profiles can be recovered (reactivated) through the user interface, preserving historical monitoring coverage while maintaining clean alert streams
3Reliability
If multiple alert profiles are actively monitored, then comprehensive security coverage is achieved, but computing resources and network bandwidth are consumed
Solution Approach 1:
The system performs preliminary analysis of event logs to determine alert profile relevance before generating full alert notifications. By pre-evaluating whether an alert profile is relevant based on current system state and event patterns, the system avoids consuming computing resources and network bandwidth on obsolete alerts while maintaining comprehensive security coverage for active threats
Data Source
AI summary
Systems and techniques for managing alert profiles, including creating the alert profiles and deactivating the alert profiles, are described. Auditing software executing on a central server may receive an event log from a software agent. The event log may identify activities associated with a network element in a computer system. The auditing software may include a classifier trained using machine learning. The auditing software may determine that the event log is indicative of an interesting activity, such as malicious activity. The auditing software may create an alert profile. The auditing software may assign a severity to the alert profile. The auditing software may determine whether the alert profile is relevant. The auditing software may deactivate the alert profile based on determining that the alert profile is not relevant.