Distributed digital security system
地域：
CA
CA Irvine
摘要
A distributed security system can include instances of a compute engine that can execute either locally in security agents on client devices or as cloud instances in a security network. Event data can be processed by elements of the distributed security system according to centrally-defined ontological definitions and/or configurations. Bounding managers of local security agents can control how much event data is sent to the security network. A storage engine in the security network can store event data received from client devices, can route event data to other elements of the security network, including cloud instances of the compute engine. An experimentation engine of the security network can also at least temporarily adjust other elements of the distributed security system during experiments or tests.
說明書
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
An instance of the compute engine 102, in the security network 106 or in a security agent 108, can perform comparisons, such as string match comparisons, value comparisons, hash comparisons, and/or other types of comparisons on event data 122 for one or more events, and produce new event data 122 based on results of the comparisons. For example, an instance of the compute engine 102 can process event data 122 in an event stream using refinements and/or compositions of a fundamental model according to instructions provided in a configuration 132. Refinement operations 202 and composition operations 302 that instances of the compute engine 102 can use are discussed below with respect to
意見反饋
使用該功能遇到問題