METHODS AND APPARATUS FOR GRAPHICAL USER INTERFACE ENVIRONMENT FOR CREATING THREAT RESPONSE COURSES OF ACTION FOR COMPUTER NETWORKS

摘要

A graphical user interface provides network security administrators a tool to quickly and easily create one or more courses of action for automatic response to a network threat. The courses of action are hardware and system agnostic, which allows a common response task to be implemented by an underlying response engine for any or multiple similar-function devices regardless of brand or version. The course of action builder allows the administrator to use a simple, graphic-based, business modeling concept to craft and design security response processes rather than having to hard code response routines specific to each piece of hardware on the network. The graphic interface model allows the user of the threat response software incorporating the course of action builder to easily understand the overall flow and paths the response may take, as well as understand the data requirements and dependencies that will be evaluated.

主权项

1. A method of facilitating user interactions with a graphical user interface to build a workflow for responding to a security event on a computing network, the graphical user interface generated and rendered on a display of a computer system connected to the computing network, by executing software with a processor of the computer system, the method comprising:
providing a plurality of task stencils within the graphical user interface for selection by a user to design the workflow, each task stencil from the plurality of task stencils representing a task to be performed by a plurality of hardware devices to respond to the security event; receiving from the user a selection of a task stencil from the plurality of task stencils, the task stencil corresponding to one or more tasks from a plurality of tasks; receiving from the user a selection of a plug-in module from a plurality of plug-in modules, each plug-in module of the plurality of plug-in modules having one or more activation commands for activating a corresponding hardware device of the plurality of hardware devices connected to the computing network to perform a task from the plurality of tasks; providing a first configuration interface to associate an activation command of the plug-in module with the one or more tasks; providing a second configuration interface to associate input data, output data, and parameter configuration data for use in executing the activation command with the one or more tasks.