Distributed digital security system
摘要
說明書
At block 1004, the storage processor 810 can perform de-duplication on the event data 122 from the topic 808. For example, if the topic 808 contains duplicate copies of certain event data 122, and/or the storage processor 810 already operated on another copy of that event certain event data 122 in the past, the duplicate copy can be discarded from the storage engine 116 and not be processed further by the distributed security system 100. Here, because event data 122 is sorted and routed into topics 808 and corresponding storage processors 810 based on an identifier of the security agent 108 that sent the event data 122, copies of the same event data 122 can be routed to the same storage processor 810. Accordingly, there can be a confidence level that different storage processors 810 are not operating on separate copies of the same event data 122, and that the particular storage processor 810 associated with event data 122 from a particular security agent 108 can safely discard extra copies of duplicated event data 122 from that particular security agent 108.
