Automated Security Infrastructure for Event Standardization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security infrastructures face inefficiencies in analyzing and managing security events due to varying data formats from different monitoring systems, leading to human errors and delays in decision-making.
Innovation Solution
An automated security infrastructure that includes event-message formatters and distributors to standardize event data, allowing security agents to analyze and manage security issues efficiently, with artificial intelligence and hierarchical organization for comprehensive threat detection and response.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If events from different monitor systems are processed in their original formats, then each system maintains its native data structure, but security agents and personnel must perform repeated conversions and careful examination, leading to human errors and delays
Solution Approach 1:
The event-message formatter performs format conversion in advance, transforming events from various monitor systems into a standardized common format before distribution. This preliminary standardization eliminates the need for repeated conversions by security agents and personnel, directly resolving the time loss issue while maintaining adaptability to different source systems
Solution Approach 2:
The event-message formatter acts as an intermediary component between diverse monitor systems and security agents. It receives events in various native formats, converts them to a standardized format, and distributes them uniformly, thereby mediating the interface between incompatible systems and eliminating manual conversion efforts
2Measurement precision
If security personnel manually examine events in differing formats, then detailed analysis can be performed, but human errors increase and decision-making is delayed
Solution Approach 1:
The event-message formatter changes the format parameter of security events from multiple varying formats to a single standardized format. This parameter unification ensures consistent presentation of event data, eliminating human errors associated with manual format interpretation while maintaining the precision needed for accurate security analysis
Solution Approach 2:
The standardized event format enables security agents and personnel to reliably and efficiently extract information without manual format conversion. The system serves itself by providing pre-formatted, consistent event data that can be directly processed, reducing reliance on manual examination and its associated human errors
3Speed
If event-message consumers are directly connected to monitor systems, then real-time data is received, but consumers must monitor for event generation, which is burdensome for distributed personnel
Solution Approach 1:
The event-message distributor serves as an intermediary that receives events from monitor systems and automatically distributes them to subscribed security agents. This mediator handles the monitoring and distribution task, allowing distributed security agents to receive real-time event data without the operational burden of actively monitoring for event generation
Solution Approach 2:
The event-message distributor performs the self-service function of automatically monitoring for event generation and distributing them to consumers. Security agents simply subscribe to event types and receive automatic notifications, eliminating the need for them to continuously monitor systems while maintaining real-time data delivery
Data Source
AI summary
An automated security infrastructure is disclosed that includes security agents that are designed to analyze security issues. The security agents process events received from event-messages, and records data associated with a security issue in a ticket. Security and management personnel are kept informed based on notification subscription lists. Assigned security personnel's progress in resolving outstanding security issues is monitored until those issues are resolved.