US20080301175A1 - Distributed system for monitoring information events - Google Patents

Distributed system for monitoring information events Download PDF

Info

Publication number
US20080301175A1
US20080301175A1 US12/130,569 US13056908A US2008301175A1 US 20080301175 A1 US20080301175 A1 US 20080301175A1 US 13056908 A US13056908 A US 13056908A US 2008301175 A1 US2008301175 A1 US 2008301175A1
Authority
US
United States
Prior art keywords
event
information
events
rule
service
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Abandoned
Application number
US12/130,569
Other languages
English (en)
Inventor
Michael Applebaum
Jeffrey Garvett
Christopher Bradley
Karl Ginter
Michael Bartman
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Informatica LLC
Original Assignee
Individual
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Individual filed Critical Individual
Priority to US12/130,569 priority Critical patent/US20080301175A1/en
Assigned to AGENT LOGIC, INC. reassignment AGENT LOGIC, INC. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: BRADLEY, CHRISTOPHER, BARTMAN, MICHAEL, GARVETT, JEFFREY H., GINTER, KARL, APPELBAUM, MICHAEL S.
Publication of US20080301175A1 publication Critical patent/US20080301175A1/en
Assigned to INFORMATICA CORPORATION reassignment INFORMATICA CORPORATION ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: AGENT LOGIC, INC.
Abandoned legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/24—Querying
    • G06F16/245—Query processing
    • G06F16/2455—Query execution
    • G06F16/24568—Data stream processing; Continuous queries
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/24—Querying
    • G06F16/245—Query processing
    • G06F16/2455—Query execution
    • G06F16/24564—Applying rules; Deductive queries
    • G06F16/24565—Triggers; Constraints
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/24—Querying
    • G06F16/245—Query processing
    • G06F16/2457—Query processing with adaptation to user needs
    • G06F16/24573—Query processing with adaptation to user needs using data annotations, e.g. user-defined metadata

Definitions

  • This invention relates to systems and techniques for monitoring information events from various data sources, and further relates to systems and techniques for specifying shared event sources, constructing distributed event processing systems, and techniques and systems for managing event processing rules and specifications.
  • Information flows can be considered as a sequence of individual events, each of which must be collected, processed, evaluated, as part of an information processing system.
  • Individual events such as a new order, a 911 call, a customer service request, a geographic position update, or an updated investigative report represent the foundation of new and changing data throughout an organization that must be continually monitored to identify opportunities and threats.
  • Previous systems have employed news feeds, databases, and search engines to receive, process, and index data as it becomes available.
  • cataloging information into databases and search engines takes time and computing resources. Meanwhile, the user must periodically query the data system for new results that match their search criteria.
  • One manager estimated that his analysts spend the first 1-2 hours of each workday checking existing databases and search engines for new information and manually further processing the information into actionable events.
  • Raw information becomes actionable events through a defined series of information processes and/or processing steps.
  • Existing systems provide for static processing systems using IT-defined, process-driven workflows that often add time to the processing. Mechanisms for access to raw and processed information, the processing steps and workflow definitions, and resulting assessment and actions have historically been neglected.
  • Extant information monitoring systems often rely on monolithic architectures over continuously connected networks in order to process information. These systems suffer from significant drawbacks. First, these systems are often statically configured, requiring users with appropriate permissions to pre-compute the amount of processing power and processing resources that must be made available for each step of system's processing. Thus, these types of systems do not scale well as information loads, resources, staffing, or processing requirements change.
  • present system architectures lack effective ways to share and control data about information sources, data management processes and recipes, and information filtering techniques/processing recipes.
  • Microsoft Windows products provide an interface for ODBC drivers in which an information database connection can be loaded onto a user's machine, but which provides no other controls than the connection string.
  • ODBC technologies support only local and network connected databases, and are not useful for newer distribution mechanisms such as web-based information sources and RSS feeds.
  • RSS feed readers store URLs and authorization information to access data feeds, but do not provide continued processing capabilities.
  • extant systems and methods do not provide mechanisms for successful information processing and filtering recipes and techniques to be captured in a transportable manner and subsequently used within a distributed environment.
  • Raw information is obtained, pre-processed, and assessed as part of a process that transforms the information into an actionable event.
  • the mechanisms for obtaining the information, pre-processing it, and assessing the information are traditionally hard coded into information processing systems, and are thus not easily distributable or sharable between users, sites in a distributed system, or different systems or instances of a system.
  • Current systems generally rely on individuals to obtain, process, and assess information feeds independently. This results in significant duplication of processing efforts at system, machine and personnel levels.
  • workflows, rules, and processing recipes for processing information are generally hard coded into present day information system, or are configured by specialized IT staff.
  • the information systems often impose restrictions on how, where, and by whom the rules can be changed, and are not structured to support reuse of rules and processing recipes, nor the sharing of user developed rules, recipes, and workflows.
  • What is needed is a system that permits for the management of user-defined resources, processing recipes, and subsequent event management workflows within a scalable, distributed framework for connecting to and receiving information from a plurality of resources, processing this information, and producing actionable events which are effective to provide real-time event detection, analysis, and response in highly complex and secure environments.
  • the present invention provides a robust solution for event correlation and monitoring applicable in a variety of fields.
  • the present invention provides a variety of user-configurable methods for interfacing with data sources, recognizing and selecting events, and providing actions based upon those events.
  • FIG. 1 shows a logical representation of the components involved in an input stage of the present invention.
  • FIG. 2 shows a process flow diagram illustrating event processing steps in accordance with an illustrative embodiment of the present invention.
  • FIG. 3 shows a schematic representation of a Portable Producer Specification (PPS) in accordance with one embodiment of the present invention.
  • PPS Portable Producer Specification
  • FIG. 4 shows an exemplary Rule Specification (RS) object within the scope of the present invention.
  • FIG. 5 illustrates a logical representation of a publish/subscribe action between workspaces.
  • FIG. 6 shows a logical representation of the architecture in accordance with one embodiment of the present invention.
  • FIG. 7 shows a schematic representation of the architecture in accordance with one embodiment of the present invention.
  • FIG. 8 shows a schematic representation of the architecture in a distributed configuration in accordance with one embodiment of the present invention.
  • FIG. 9 is a process flowchart depicting a first exemplary use of an enterprise-wide event management system.
  • a distributed information and processing system and architecture (“the system”) is described that processes information across disparate information sources, such as data streams, sensors, communications systems, legacy systems, databases, and flat files, produces and processes events based upon information from these information sources, and initiates specified actions as a result of this event processing.
  • the system creates “event objects” as information flows through one or more information systems, either by polling underlying data systems or by receiving specific notifications.
  • Event objects are describe at least one aspect of a detected event and optionally describe meta-data associated with the event, such as the time at which it was detected, the source of the information used, the version of the software used to process the detection, etc.
  • the system When the system detects an event, or a combination of events, that match conditions specified in a rule, it executes one or more corresponding responses (actions). Events that do not match any rule do not result in responses being executed. This mechanism removes unwanted, insignificant, or not yet significant events from further immediate processing, permitting available computing resources to be focused on those events that are of interest, and the execution of responses to them. Events, or information derived from them, can be retained by the system when one or more rules specify this, and be used in the future evaluation of rules, thus providing the system with a “memory” and the ability to detect combinations of events over time. Events which are not significant when first detected later can be found significant in combination with other events that occur at a later time. For example, one failed attempt at providing a valid password for access to a user account on a computer is not significant, but a large number of failed attempts over a short time span might be.
  • event responses can be initiated using a variety of mechanisms well understood by those skilled in the art, such as email instant message alerts, Web Service and business process activation, event enrichment responses to collect additional information about the event, and browser alerts through such mechanisms as Agent Logic's (Hemdon, Va.) Real-Time BrowserTM, and instant GIS/Link Analysis tool updates.
  • Agent Logic's Hemdon, Va.
  • Real-Time BrowserTM Real-Time BrowserTM
  • instant GIS/Link Analysis tool updates can be either triggered in real time, or processed as a group at specific points in time.
  • An aspect of some embodiments of the present invention is the ability to generate events based on information obtained from commonly defined information and data sources, the processing required to determine the relevance of piece of information and/or data to one or more specified event or set of events, and initiate responses.
  • a further aspect is to make access to these information sources, the processing steps required, and the actions to take in response to the information and/or data processing available to many users of the system without involving IT personnel.
  • both individual and complex events across many different systems are simultaneously detected and responded to. As shown in FIG.
  • a plurality of information sources ( 1100 , 1110 , 1120 , & 1130 ) can be input through the use of a plurality of Connector/Protocol Adapters ( 1140 , 1150 , 1160 , & 1170 ) that incorporate necessary protocol knowledge to deal with each type of information source as well as an ability to convert the information obtained from each information source into a format understood by the system's producer services.
  • Connector/Protocol Adapters 1140 , 1150 , 1160 , & 1170
  • the said converted information is passed to a producer service ( 1180 ), that uses rules, pre-processing specifications and/or scripts obtained from a Portable Producer Specification (PPS) ( 1190 ) to evaluate the said converted information and to generate event objects from it as specified by the said rules, pre-processing specifications and/or scripts and place said event objects into appropriate event queues ( 1200 , 1210 & 1220 ) as determined by rules, pre-processing specifications, scripts or other materials incorporated into the PPS.
  • Event objects in event queues are further processed by other aspects of the system as described below.
  • Multiple producer services, and other applications, that are part of the system, running within a single instance of embodiments of the present invention can be managed separately so that any number of systems and users can leverage event-processing capabilities for a variety of isolated applications, all of which are running concurrently.
  • the flexible many-to-many event processing flow mechanisms support the partitioning of information and processing by security domain, workload, user, information source, event queue, priority, department, computing resources or other parameter or parameters. Partitioning is achieved through mechanisms such as “workspaces”, providing access and usage controls on all system objects, and by restrictions on the use of computing resources.
  • Computing resources comprise data processing hardware, such as CPUs, memory, communication means and data storage devices, and/or permission to make use of these, which are useful for execution of event processing flows.
  • Each enterprise-wide event management system is configurable to enforce any desired level of information segregation, so both users and information can be logically and physically separated in order to ensure processing integrity.
  • the described architecture provides for rapid deployment and scaling of each component, distribution of processing while maintaining data and processing partitioning, and for the organic growth of rules and rules sets without required intervention by IT staff.
  • the exemplary system provides for shared, and portable, complex, user-specified, rule-based calculations and formulas for the processing of information and events.
  • a sequence of event processing steps ( 2001 , 2002 , & 2003 ), effective to produce a desired outcome from event processing, is known herein as an “event processing flow” ( 2000 ).
  • Event processing steps ( 2001 , 2002 , & 2003 ) are a combination of rules, processes, event definitions and responses effective to receive information ( 2005 , 2006 , 2007 , & 2008 ), process said information, and produce one or more event objects ( 2020 , 2021 , 2022 , 2023 , 2030 , 2031 , 2032 & 2055 ) and/or responses (actions) ( 2050 , 2051 , & 2052 ) as a result of said processing.
  • the specific components of the event processing flow ( 2000 ) e.g.
  • Event processing nodes can be located on a single computing system, or distributed across any number of computing systems, consistent with computing resource restrictions configured into the system to maintain desired partitioning of information and processing.
  • Computing system are typically computer systems of common manufacture, such as servers, desktops, mainframes, embedded systems, as well as mobile computing devices such as laptops and cell phones.
  • computing systems can include single and multi-processor computers, as well as multi-core processor equipped computers.
  • Computing systems can similarly be equipped with any of the peripherals and communications technologies used in current-day computers.
  • PPSs Portable Producer Specifications
  • These comprise information such as procedures and specifications for procedures necessary to access and use various information sources, such as web pages, RSS feeds, and databases, as well as procedures for pre-processing the information obtained from said sources into event objects as used by the system, and placing said event objects into appropriate event queues.
  • PPSs are described in more detail below.
  • Each defined PPS used in the system can be specified by rule specifications (RSs) created or used by each user. Furthermore, each user can create such additional PPSs as they require, using templates and wizards (for novice users), or by directly creating PPSs through command or other user interface mechanisms as will be understood by those having skill in the art.
  • RSs rule specifications
  • Rules define the relationships between events (as represented by event objects) and responses. Each user can create such rules as they deem appropriate using templates and wizards (for novice users), by directly writing rules in a rules language, or by commands or other user interface mechanisms as will be apparent to those with skill in the art. Templates are partially defined rules within which the user is required to complete one or more aspects of the rule before use. A wizard is a software application that guides a user through coding a rule, or completing a template. Templates can also be used for more complex structures, such as defined processing flows.
  • RS rule specifications
  • An RS is an object containing a definition for a single rule and all parameters associated with the rule.
  • the parameters associated with the rule are implementation dependent, but can include such things as a rule ID, access restrictions for the rule, identification of the rule's author, etc.
  • a collection of PPSs, related event queue descriptions, and RSs that is sufficient to perform at least one event-processing step, when combined with appropriate services, such as producer or analytic services, is referred to as a “recipe”.
  • a recipe defines information sources, the event queues that event objects generated from these information sources are placed into, and the rules that operate on the said event objects to generate the responses specified by the rules.
  • FIG. 3 shows an exemplary Portable Producer Specification (PPS) object within the scope of the present invention.
  • PPS Portable Producer Specification
  • a PPS is an object that can be provided as a data file, database entry, directory entry, or in another machine-readable format that can be used by a producer service to configure its interaction with a data source.
  • PPSs can be shared between users, workspaces, or systems or exported and transported between users, workspaces, systems or instances of the invention and can optionally be included in RuleBooks to simplify sharing and transporting sets of PPSs.
  • the PPS ( 3100 ) includes one or more elements, including data source information ( 3110 ), optional access credentials ( 3120 ), optional rights specifications ( 3130 ), and optional pre-processing rules ( 3140 ).
  • a PPS can be encoded using any representation-appropriate encoding scheme, such as rows in a database table, as ASCII tag-value text in a properties file, or as an XML document.
  • Data source information ( 3110 ) includes one or more information elements that describe or inform the user, or producer service, about the data source, including name and description, source data type, contact information for an assistance provider (e.g. a help desk or system manager), account numbers, owning user, group or system, and related materials.
  • Data source information ( 3110 ) also can include elements that form an association between a producer service and the system, including a unique identifier or other ID of the producer service, authorization credentials required to use the information source, or other security and configuration indicia that can be used by the system to properly configure and authenticate the use of the information source, the producer service, and the system.
  • the specification of the precise information elements included in this group of elements is implementation dependant.
  • Access credentials ( 3120 ) includes information elements that provide machine-readable information that can be used by a producer service to gain access to the information source. Elements within this section can include a database access string, a URI, and/or a predefined query to define the information source location and/or mechanisms required to access the information source. If not encoded within the database access string or URI, the access credentials ( 3120 ) can also include the method or protocol to be used to access the information service, such as specification of a connector/protocol adapter to use with the particular information source. Additionally, the access credentials ( 3120 ) can contain authentication and authorization materials, such as user id, user name, password, digital certificate, or other indicia of authority to receive information from the information source. Other components can be added to the access credential section on a producer service by producer service basis.
  • Rights components ( 3130 ) is an optional specification that can include specifications of rights or tags to attach to information received from the information source.
  • rights components ( 3130 ) can include a rights specification, such as a rights specification defined using a rights specification language such as XrML.
  • Pre-processing rules ( 3140 ) are an optional set of components that provide rules for pre-processing information obtained from an information source, such as an RSS feed or email, for example, prior to passing the information to an analytics section, such as extracting and formatting information into the format required by an event specification, or the addition of meta-data, such as the time of collection, the source the information was collected from, the ID or software version of the producer service, or other information about the collected information or the mechanism used to collect it.
  • the pre-processing rules can include the actual rule specification itself, while in other embodiments, the pre-processing rules can comprise a reference to one or more rules specifications stored elsewhere.
  • Pre-processing rules specifications can also comprise specification of the event queue, or event queues, that are available to receive events generated as a result of pre-processing the source information, and what criteria are used to assign events to particular event queues.
  • Pre-processing rules specifications can optionally comprise script or procedure information that permits arbitrary processing as a part of event processing.
  • PPSs can optionally be encrypted for privacy or to enforce security partitioning, or as a form of digital signature to certify origin.
  • service definitions are both portable and sharable.
  • Sharable service definitions support the sharing of service definitions for producer, analytics, and responders as RSs are shared.
  • Portable service definitions permit service definitions to be moved between instances of the present invention, and for an appropriate service to be instantiated on the new instance using the original service definition.
  • the term portable as used throughout the present specification generally means transportable, but may also be used to describe objects, systems, data structures or other entities that are shareable without necessarily being transportable.
  • An advantage of using PPS's is that PPS's can be shared between users of an instance of a system of the present invention, can be shared between disparate instances of the present invention, and can even be made available on other systems, such as storefronts and within application provisioning systems.
  • PPS's provide a business a means to control access to information sources, while at the same time, maintaining the confidentially of the information and data source authentication materials. Coupled with controls over access and use, the arrangement of using PPS's permits control over access to materials at the same time facilitating sharing of common resources and the management of common accesses.
  • PPSs can be created and provided as a business service. Such services can be provided as a primary business activity, such as by consultants or as pre-packaged products, or as an incidental business activity, such as a news or other information service providing PPSs relating to the use of their news feeds.
  • FIG. 8 shows an exemplary Rule Specification (RS) object within the scope of the present invention.
  • An RS is a data structure that can be provided as a data file, database entry, directory entry, or in another machine-readable format that can be used to describe a rule and associated information.
  • RSs can be shared between users, workspaces, or systems or exported and transported between users, workspaces, systems or instances of the invention and can optionally be included in RuleBooks to simplify sharing and transporting RSs.
  • the RS ( 4200 ) includes two or more elements, including rule description information ( 4210 ), a rule definition ( 4220 ), optional rights specifications ( 4230 ), and optional access credentials ( 4240 ). These elements can be optionally cryptographically protected ( 4290 ) for integrity (e.g.
  • An RS can be encoded using any representation-appropriate encoding scheme, such as rows in a database table, as ASCII tag-value text in a properties file, or as an XML document.
  • Rule description information ( 4210 ) comprises one or more information elements that describe or inform the user, or services, about the RS, including name and description, owning user, group or system, and related materials. Rule description information ( 4210 ) also can include elements that form an association between an RS and the system, including a unique identifier or other ID of the RS. The specification of the precise information elements included in this group of elements is implementation dependant.
  • the rule definition ( 4220 ) comprises the information describing the rule itself, as well as associated information, such as event source information (e.g. event queue names or IDs), response information and other items required for the actual evaluation of the rule and execution of any actions required by the evaluation of the rule.
  • event source information e.g. event queue names or IDs
  • response information e.g. response information
  • other items required for the actual evaluation of the rule and execution of any actions required by the evaluation of the rule.
  • Rights Specifications comprise information specifying-authorization credentials required of the rule to make use of the event queues, computing resources, etc., or other security and configuration indicia that can be used by the system to properly configure, authenticate and implement the use of the rule.
  • Access credentials ( 4240 ) comprise information elements that provide machine-readable information that can be used by the system to validate authentication and authorization materials, such as user ID, user name, password, digital certificate, or other indicia of authority to access, or make use of the RS.
  • the specification of the precise information elements included in this group of elements is implementation dependant.
  • rights credentials ( 4240 ) can include a rights specification, such as a rights specification defined using a rights specification language such as XrML.
  • the RSs are both transportable and sharable.
  • Sharable RSs support the sharing of rule definitions for producer, analytics, and responders.
  • Transportable RSs permit rule definitions to be moved between instances of the present invention.
  • transportable RSs permit rules to be provided to several disconnected or intermittently connected systems that can function as part of a distributed network of systems.
  • transportable RSs can be created and provided as a business service. Such services can be provided as a primary business activity, such as by consultants or as pre-packaged products, or as an incidental business activity, such as a news or other information services providing RSs relating to the use of their news feeds.
  • One aspect of the present invention is that the various embodiments provide extensible analytics RuleBooks for user-based creation and sharing and/or transporting of event processing rules and recipes.
  • the system supports any number of RuleBooks.
  • a RuleBook is a portable container object comprising zero or more rulebook items.
  • the RuleBook is typically stored as a single object with a unique user-defined name.
  • the benefit is that a user can share or export a set of objects as a single operation, and users of the objects can transport and import, or subscribe to, the set of objects as a set, rather than having to work with each rulebook item individually.
  • a RuleBook can be stored in an instance of a database, a local storage location, in a distributed directory service, such as LDAP, or by other means as determined to be useful by those having skill in the art.
  • RuleBooks are thus collections of objects used by the system, and are defined as portable objects comprising one or more RSs, PPSs, recipes, template specification, wizards, access control lists, watch lists, event specification, process definition, and/or other objects relevant to the processing of information and event flows.
  • Objects contained within a RuleBook, or capable of being contained within a RuleBook are referred to as “RuleBook items”.
  • a RuleBook can be stored as an external file that comprises at least one definition for a RuleBook item, stored in a database or directory system such as LDAP, or in any other form as determined to be effective by those having skill in the art.
  • a Rulebook Item can be included as part of a Rulebook by direct inclusion (e.g.
  • This copy can be published within a particular instance of system, can be published by another instance of the system, or can be published by an external publishing source such as enterprise wide repository, data store, or even a commercial storefront.
  • RuleBook items can be exported and made transportable to other workspaces, systems or instances of the invention.
  • the RuleBook items, or RuleBooks can be transported without modification from a first system to a second system.
  • the RuleBook items, or RuleBooks are converted in format by exporting, for purposes of transport from a first system, and are converted again, by importing, for use on a second system.
  • the format of the RuleBook items, or RuleBooks, on the second system can be the same as or different from the format used on the first system.
  • the exported format used for transport can be any format recognized and useful by the first and second systems, such as XML, name-value pairs, or other formats well known to those with skill in the art.
  • the transported RuleBook items, or RuleBooks become separate instances of the RuleBook items, or RuleBooks.
  • Such transported entities have their own access restrictions, users and other aspects, limitations and controls and are not affected by changes to the original RuleBook items, or RuleBooks, they were created from, nor do changes to the transported entities result in changes to the original entities they were transported from.
  • Transporting of such entities can be useful for creation of redundant systems, for disaster recovery purposes, for creation of variant instances of a system or part of a system, for research or testing purposes, for creation and provision of RuleBook items, or RuleBooks, as a business service, or for other purposes as will be apparent to those having skill in the art.
  • RuleBooks can be made available for workspaces to import or subscribe to, and can thus be shared or transported between one or more workspaces.
  • RuleBook sharing can be accomplished using different physical copies of a RuleBook (export/import), shared from a common location (such as a common file share similar to those provided by NFS or CFIS), or by loading the components contained within a RuleBook into external storage means such as a database, and then sharing the storage means between workspaces (publish/subscribe).
  • RuleBooks can be made transportable between users, systems or instances of the invention. When transported in this manner, the transported RuleBooks become separate instances of the original RuleBook. Such transported RuleBooks have their own access restrictions, users and other aspects, limitations and controls and are not affected by changes to the original RuleBooks they were exported from, nor do changes to the transported RuleBooks result in changes to the original RuleBooks they were exported from. Transporting of RuleBooks can be useful for creation of redundant systems for disaster recovery purposes, for creation of variant instances of the system or part of the system for research or testing purposes, for checkpoint or backup purposes, for creation and provision of RuleBooks as a business service, or for other purposes as will be apparent to those having skill in the art.
  • Rulebooks can have access controls associated with them, at both the Rulebook and at the Rulebook Item level. Thus, a first user can be granted access only to a first RuleBook, a second user can be granted access to a second RuleBook, and a third user can be granted access to both the first and second RuleBooks. Similarly, a specific item within a Rulebook can be access controlled, with similar outcomes.
  • a default RuleBook is also provided with system-provided analytics features as described below.
  • a workspace binds to, shares or prepares a RuleBook for transport as described above, e.g. with the import and export, or publish and subscribe capabilities.
  • Subscribing to a RuleBook, or importing a RuleBook makes the RuleBook itself accessible to the workspace, but other functions are used to make RuleBook contents available to the workspace, without loading the RuleBook contents into the workspace as if they had been locally defined (i.e. with full access to and control over them). These functions include “mount” and “unmount”. Mounting a RuleBook makes the RuleBook contents available to a workspace to the extent permitted by relevant access controls, which can be less than full access to the RuleBook and its contents.
  • a workspace might have access to make use of RSs contained in a RuleBook, but not have sufficient access rights to change the RSs in the RuleBook, or to make use of rule wizards in the RuleBook to create new RSs.
  • Some users of the workspace can have rights that implicitly allow them to use any mounted RuleBook.
  • Mounting a RuleBook to a distributed workspace can cause the RuleBook to be physically distributed to all servers that support the distributed workspace.
  • Unmount removes the availability of a RuleBook from a workspace, without removing the binding of the RuleBook to the workspace. The unmount command will not succeed if aspects of the RuleBook are referenced from components within the workspace.
  • the “publish” function for a RuleBook makes a specific RuleBook available to a specific workspace, user or role. In other words, it adds the RuleBook to the workspace, user or role's access list. “Unpublish” removes the availability of the RuleBook from the specified workspace, user or role.
  • the ability to publish to all users or roles, or to sets of users or roles, with a single publish operation is supported.
  • RuleBooks provide an effective means of sharing or transporting complete and partial RSs and/or recipes between workspaces, users, roles or instances of the system.
  • a first user develops a particularly useful recipe for event processing
  • that user can create a RuleBook that comprises PPSs, event definitions, RSs, namespaces, event queue specification, and any other components required to successfully process events using the recipe.
  • the first user can then make this RuleBook available to a second user to facilitate the second user's processing of events.
  • the election of whether to share the processing recipe using a RuleBook, or by using a workspace that publishes an end result such as a set of event queues or response action effects, is made based upon whether the processing rules should be exposed to the second user. In the instance where the workspace publishes end results, the processing rules are not exposed to the second user.
  • the processing rules can be exposed to the second user, depending on the access rights of the second user with respect to the RuleBook.
  • PPSs Event objects, RSs, recipes, workspaces, and other components of the system can be named. Each of these components is specified using at least one namespace. Specification of individual components within namespaces is well understood by those skilled in the art.
  • An example of a namespace system that is well known in the art includes that defined for XML-based systems.
  • An XML-based schema for specifying namespaces describes namespaces and is used as follows:
  • references to a “table” item would be ambiguous without the use of namespaces to permit specification of which “table” item is being referred to . . . the HTML table or the physical object plywood table.
  • similar ambiguities can occur with respect to PPSs, RSs, event queues, workspaces, and other aspects of the system due to factors such as publish/subscribe relationships, and importation of exported objects, such as RuleBooks.
  • a first workspace creates an event queue for events related to news items obtained from wire services, named, “current_news”, then publishes it
  • a second workspace creates an event queue for internal company events, also named, “current_news”, then publishes it
  • the event queue published by the first workspace is associated with a namespace bound to the first workspace
  • the event queue published by the second workspace is associated with a namespace bound to the second workspace
  • the third workspace can refer to either event queue in an unambiguous fashion.
  • Each workspace is associated with one or more namespaces.
  • a workspace becomes associated with each namespace as the result of binding the workspace with a RuleBook that defines one or more namespaces, by a user action that associates a namespace with the workspace, a user profile that defines one or more namespaces, or from a globally defined profile that defines one or more namespaces.
  • Namespaces are named using globally unique identifiers. Globally unique identifiers are well understood by those with skill in the art.
  • Namespaces are used by the system to unambiguously define names and references to the data and processing elements used by the system.
  • event queues, RuleBooks or other entities are created, they are each associated with a namespace.
  • namespaces When these entities are bound to a workspace, such as by a publish/subscribe relationship, the namespace associated with each is retained and used to unambiguously refer to the entity or its attributes.
  • Other entities in the workspace can have names or attributes that are the same as those of the first entity, but due to the different namespaces associated with each entity, there is no ambiguity as to which is being referenced.
  • the system uses namespaces to specify the names and attributes of elements referenced by rules, event objects, and other components of the system.
  • Partitioning One challenge in developing and deploying user-specified rules, calculations, and formulas for the processing of information events is the logical separation of sets of information and processing based upon function and usage. In some business environments, this is called the compartmentalization of information, and is known herein as “partitioning”. Partitioning is supported in the present invention through mechanisms such as “workspaces” and access limitations on objects such as PPSs, RSs, event queues, and RuleBooks.
  • a workspace is a sharable and portable specification for one or more PPSs, RSs, event queues, event objects, RuleBooks, templates, wizards, publish/subscribe relationships, authorization credentials, computing resources and/or associated entities used to define, implement, control and monitor event processing flows, and its subsequent implementation through provisioning of each aspect of the workspace to one or more computing resources.
  • Each item that is part of the workspace specification is called a “workspace item”.
  • a workspace item can be included as part of a workspace by direct inclusion (e.g. a copy within the workspace), or by reference to a known published copy. This copy can be published within a particular instance of system, can be published by another instance of the system, or can be published by an external publishing source such as enterprise wide repository, data store, or even a commercial storefront.
  • Each workspace thus defines a specific information and event processing configuration and implementation comprising of workspace items bound to each other and to disparate computing resources. This permits a workspace to either specify specific resource requirements, or to specify types of resources and to be subsequently provisioned with available resources as necessary.
  • a process called “binding” establishes the association of a workspace with specific users or roles, workspace items, and computing resources.
  • a workspace instance is said to be “bound” to one or more specific resource(s), workspace items, and/or computing resources.
  • the binding of the workspace item with a particular resource establishes the controls between the resource and the workspace.
  • An example of a user action permission binding is generally described herein, however, generalized associative binding techniques are well understood by those skilled in the art.
  • provisioning of workspaces is performed using techniques that are well understood by those skilled in the art
  • Each workspace participates in specific information partitions based on the access rights assigned.
  • a workspace may be shared between one or more users or roles, and a first workspace can share RuleBooks, PPSs, event queues and other objects with one or more second workspaces.
  • Each association is formed in conjunction with an optional control mechanism that limits the actions or capability of the associated component.
  • a user or role shared by one or more users
  • Authentication and authorization can be performed at the granularity of a workspace, a specific system or server, a cluster of systems or servers, or at the enterprise level.
  • User authentication and authorization materials may be stored in one or more database(s), registry(ies), or directory(ies), such as an LDAP, flat file(s), or other storage mechanism(s) suitable for storing user authentication and authorization materials.
  • User preference and profile materials can be stored with user authentication or authorization materials.
  • user preference and profile materials may be stored in a different one or more database(s), registry(ies), or directory(ies), such as an LDAP system, flat file(s), or other storage mechanism(s) suitable for storing user preference and profile materials.
  • a workspace can be associated with one or more RSs and/or recipes.
  • these RSs and recipes are provided in collected sets as RuleBooks. In other implementations, they are included within the workspace as individual elements.
  • Each association of a first workspace with a specific RuleBook makes the contents of the RuleBook available to that workspace.
  • RSs and recipes can also be provided within a first workspace, whether created by a user of the first workspace or published by a user of a second workspace and subscribed to by a user of the first workspace. Associations can also be made to individual named components within a RuleBook or workspace.
  • a workspace can be associated with one or more event and information sources, as specified by one or more PPSs and acquired through use of a producer service.
  • event and information sources can be specified within a first workspace, can be published by a second workspace and subscribed to by a first workspace, specified within one or more RuleBooks, or can be provided by a mechanism external to the system.
  • these event and information sources, as well as the producer services associated with each can be located on a plurality of computing resources.
  • one or more bindings may be established between a workspace and a computing resource that indicates the amount, or identities, of computing resources that the workspace may use.
  • a binding may be established between a workspace and a computer that limits the amount of CPU and memory provided by the computer to the workspace.
  • a workspace can be restricted to use of particular computing resources by permitting it to bind only with those computing resources, and allowing no CPU or other resource use on systems the workspace is not permitted to bind to.
  • restrictions can be for various purposes, such as information partitioning and maintenance of security, for optimizing distribution of workspace tasks over available computing resources, or for optimizing distribution of workspace tasks and information access to limit communication means bandwidth use.
  • Each workspace can be logically isolated from all other workspaces.
  • one or more aspects of a workspace can be shared with other workspaces.
  • This organization provides advantages when the event and information processing within a first workspace should be hidden from a second workspace.
  • the first workspace can make specific aspects of its processing available to other workspaces without exposing the details of the event and information processing configuration.
  • Publishing can be used to make aspects of a first workspace available to a second workspace. “Publishing” refers to making an object available to a plurality of entities. Objects can be published within an instance of the invention, or published across a plurality of instances of the invention using mechanisms external to the invention (such as LDAP, shared file systems or database servers). Published objects can be access controlled.
  • a workspace makes use of a published object by “subscribing” to it.
  • Subscribing consists of making at least one aspect of a published object available to an entity other than the publishing entity. Both publish and subscribe actions are controlled actions within their respective workspaces. Users must possess special permissions in order to establish publish/subscribe relationships. Publish/subscribe relationships are especially advantageous when implementing event and information processing systems that use common information processing mechanisms or processes.
  • a workspace definition including component bindings, controls such as access control lists, publish/subscribe relationships, rules, and information processing state(s) are typically defined within the components of the system. In some cases, these items are defined within a workspace. In other alternative implementations, one or more of these aspects may be defined and stored external to a workspace (e.g. globally) and be shared between one or more workspaces.
  • a machine-readable workspace definition can be exported from a workspace into a transportable format by using the export capability associated with the workspace. Exporting comprises making at least one object ready for transportation. The complementary operation is referred to as “importing”. Importing comprises making at least one transported object ready for use in at least one aspect of at least one instance of the invention.
  • An import capability can be used to read the transportable format and create a workspace that is comprised of the component bindings, controls, publish/subscribe relationships, rules, and information processing states of the original workspace. Import and export are useful for backup and restore purposes, to create duplicate workspaces for workers performing similar duties, and to define a transportable event detection and management system arrangement.
  • the import and export actions are controlled actions (e.g. subject to access and configuration controls).
  • One example transportable format is an XML representation of the workspace definition.
  • a limited example, for illustration purposes only, of an XML workspace representation might be:
  • the exported workspace definition can be stored in a RuleBook, as described below.
  • FIG. 5 illustrates an example of a publish/subscribe model.
  • a first information processing mechanism embodied in a first workspace ( 5500 ) that provides a common pre-processing or filtering function on “raw” information.
  • the first workspace publishes event objects to a published event queue ( 5600 ) that require additional analysis.
  • One or more second workspaces subscribe to the said published event queue and process the said event objects according to the RSs they are bound or subscribed to.
  • the information sources and processing techniques within the first workspace are thus hidden from subscribers to the published event queue, with only the published event queue and the event objects it contains, and their respective namespaces, being exposed to the subscribers.
  • Two additional information processes can be implemented as a second and third workspace ( 5710 and 5720 ) respectively, each of which subscribes to the published event queue of the first workspace.
  • the subscription to the published event queue and the controls over the subscription are shown by the subscribe arrows joining the workspaces and the event queue.
  • the second and third workspaces have no access to the information sources and processing activities of the first workspace
  • the first workspace has no access to the RSs and processing activities of the second and third workspaces. This is one example of how information, and processing of information, can be partitioned within the system.
  • FIG. 6 shows a logical instance of an embodiment of a workspace 6000 of the present invention, which includes an input section 6010 , an analytics section, 6020 and a responder section 6030 .
  • Information flows from information sources, both internal and external to the input section 6010 , where it is processed, expanded and passed on to the analytics section 6020 .
  • the input section's 6010 role is to gather input from a plurality of data sources, generate additional information (e.g. the information source ID, time of collection, version of the collection software, etc.), and aggregate this information together as one or more completed event objects for further processing.
  • additional information e.g. the information source ID, time of collection, version of the collection software, etc.
  • the analytics section 6020 provides a framework in which one or more analytic rules may be applied to event objects obtained from event queues. Each event object is processed by one or more rules. The results of the rule processing can include creating additional event objects, taking specific actions, or simply saving the event for possible later use. Specific actions resulting from rules acting on event objects, including external notifications, system updates, generation of additional event objects, etc., are managed by one or more responder sections 6030 .
  • the responder section(s) 6030 provide the external interfaces and program logic required to effect each configured action.
  • Each of input, analytic, and responder sections may be deployed on a single computer, or may be distributed across a plurality of computers.
  • each input section instance 6012 , 6014 , analytics section instance 6022 , 6024 and responder section instance 6032 , 6034 is in messaging communication with other sections.
  • the configuration of the components within each section and the communication means used to communicate between sections are defined using configuration information for the system, each section, and each component (respectively).
  • the distribution of particular services, workspaces, RuleBooks, event queues, and other aspects of the system can be restricted by system configuration such that specific instances of these, or those bearing particular access specifications or other characteristics, are placed only on a particular computer or computers.
  • This partitioning of data and the processing of that data permits required levels of isolation to be maintained for security purposes, tracking purposes, or for other reasons, such as load balancing or system redundancy, while still permitting distribution of the system across a plurality of computing resources. Due in part to the implementation of the system as a set of cooperating services using shared resources to exchange information, the distribution of aspects of the system across available computing resources can change over time as computing resource availability changes so as to optimize use of available computing resources and/or maintain partitioning of data and processing.
  • FIG. 7 is a schematic view of a logical instance of one embodiment of the present invention, which includes an input section ( 7110 ), an analytics section ( 7120 ), and a responder section ( 7130 ) interfaced using communications means ( 7140 ; 7150 ).
  • the input section ( 7110 ) further includes one or more producer services ( 7112 a , 7112 b , 7112 c ), which are operable to interface with at least one information source using communications means (not shown), and one or more portable producer specifications (PPSs) ( 7114 a , 7114 b , 7114 c ). These PPSs can be used to define the access and initial pre-processing/enrichment of one or more information sources.
  • PPSs portable producer specifications
  • the input section ( 7110 ) further includes an optional input section log ( 7118 ) that records the actions of the producer services.
  • An optional input section log ( 7118 ) that records the actions of the producer services.
  • One or more instances of input sections can be supported by various exemplary implementations of the present invention.
  • Each input section ( 7110 ) is connected to one or more analytics sections ( 7120 ) in order to support further processing of the information.
  • the analytics section ( 7120 ) receives information from one or more input section instances in the form of “event objects.”
  • input and analytics sections are associated in a many-to-many relationship using one or more communications means.
  • the associations are made using a messaging mechanism such as a messaging technology such as MQ from IBM Corporation of Armonk, N.Y., or the Java Messaging System (JMS) from Sun Microsystems of Santa Clara, Calif.
  • JMS Java Messaging System
  • other technologies such as sockets, streams, and inter-process control messaging also can be used.
  • non-message-based mechanisms such as shared databases or common event queues can be used.
  • Each analytics section ( 7120 ) further includes one or more analytics plug-ins ( 7122 a , 7122 b , 7122 c ) which can process event objects received from the input section over the communication means ( 7140 ), one or more analytic rule definitions ( 7124 a , 7124 b , 7124 c ) which are used to define the processing by an analytics plug-in, and an optional analytics section log ( 7128 ) which is used to record the actions of the analytics plug-ins.
  • One or more instances of an analytics section can be supported by a specific exemplary implementation of the present invention.
  • Each analytics section is logically connected to one or more responder sections using one or more instances of a communications means ( 7150 ) in order to support further processing of the information.
  • the communications means ( 7140 ; 7150 ) can be similar technologies, but are not required to be identical or even compatible. Thus, each of the analytics and responder sections are also associated using a many-to-many relationship. In some embodiments (not shown), a communications means can be used to directly link input section components to responder components without the use of an analytics section.
  • a responder section ( 7130 ) receives notification requests (or “notifications”) from an analytics section through the communications means ( 7150 ) and processes these requests.
  • Each responder section further includes one or more responder services ( 7132 a , 7132 b , 7132 c ), which can convert notifications into responses for further processing, responder rules ( 7134 a , 7134 b , 7134 c ) that are used to configure the operation of the responder services, and an optional responder-processing log ( 7138 ), which is used to record the operation of the responder section.
  • Analytics and responder services optionally can perform additional pre-processing/enrichment of events, and can insert events into any of the communication interfaces linking components of the system.
  • Various embodiments of the present invention further include one or more instances of a rules engine ( 7160 ), one or more instances of an enterprise agent service ( 7170 ), and one or more instances of configuration information ( 7180 ) that defines configurations of aspects of an input section, an analytics section, a responder section, a communications means, and/or other components of the present invention.
  • Rules engine ( 7160 ) can be provided as a common instance of a rules engine or can be distributed with instances of specific analytic and responder sections.
  • Configuration materials ( 7180 ) can be stored as a local disk file, within a service on the local machine, in a local database (e.g.
  • the Configuration Materials ( 7180 ) describes the configuration of an input section, an analytic section, and a responder section, including the configuration of each of the services that are part of each respective section.
  • the Configuration materials ( 7180 ) further defines the communications means used.
  • the configuration materials ( 7180 ) define an input section, including the number and types of producer services ( 7112 a , 7112 b , 7112 c )) that are started, and the computing resources that each can use.
  • Each defined producer service is associated with at least one PPS (e.g.
  • analytic section configuration materials define the rules engines, RSs and RuleBooks to use in processing event objects obtained from event queues.
  • event queues can be published from a first workspace, which makes them available to one or more second workspaces.
  • one or more input section instances can generate event objects that are aggregated within a first event queue, the “commercial news sources” event queue.
  • the “commercial news sources” event queue can include event objects corresponding to each article published in commercially available news sources.
  • Producer processes of authorized users place events into the said event queue and the analytic processes of the same, or other authorized, user(s) can process the said event objects.
  • Authorized users can create more finely grained event queues, such as an event queue for commercial news having to do with occurrences in a particular city, and appropriate producer processes can be configured to write events to these queues.
  • a responder service can generate one or more event objects and add them to specific event queues for processing.
  • an analytics section component can identify a specific news story that matches one of its rules. That rule might specify to match all news stories from the AP newswire service that have the word “NASA” in their title or text, and to create an event object related to that news item in the “NASA” event queue for all news items that match.
  • an analytics plug-in matches keywords in the news story with the keyword “NASA,” and if a match occurs, creates and sends an event object to the “NASA” event queue.
  • the selection of response to take e.g., create and send an event object
  • where to send the resulting event object e.g., to the event queue
  • a system in accordance with an embodiment of the present invention can be developed using any of the technologies known to those skilled in the art of developing complex software systems.
  • the software components can be developed in Java using a service-based framework such as the Spring Framework.
  • Rules engines and related components can be provided using java-compatible technologies such as the Drools Rules Engine and the Antlr Parser tools. Other technologies, such as C# or C++ can also be used.
  • the database ( 7190 ) can be any available database, such as Oracle, MySQL, Informix, DB2, HSQLDB, Cloudscape/Derby, or another database product.
  • the database can be stored solely within a computer memory (e.g., RAM), within memory and on a persistent memory such as disk, or solely in a persistent memory.
  • a networked service can be any available networked service, for example, an LDAP accessible directory service, such as the Active Directory product provided by Microsoft Corporation of Redmond Wash.
  • LDAP accessible directory service such as the Active Directory product provided by Microsoft Corporation of Redmond Wash.
  • Other types of network services are described at various points herein. Each of these services can be implemented by those skilled in the art.
  • An example system in accordance with one embodiment of the present invention is an enterprise-class system, meaning the system needs to support many different deployment configurations. Distribution of services, portable producer specifications, rule specifications, and event descriptions and objects allows embodiments of the system of the present invention to be deployed across a distributed network of computer systems.
  • FIG. 8 shows a sample distribution, in which a first computer system (A) includes the input processing section ( 8110 ), including source services ( 8112 a - c ), source definitions ( 8114 a - c ), optional log ( 8116 ), and a communications means ( 8118 ).
  • the communications means operably connects the first computer system to a second computer system (B) using networking techniques well known to those skilled in the art.
  • the second computer system (B) includes an input section ( 8130 ) and an analytics section ( 8140 ), including components as described above for FIG. 7 .
  • the input and analytics sections are joined using a communications means ( 8138 ), such as TCP/IP, messaging queues, or other inter-process communication system, such as shared memory, in order to pass information between the input processing section of the second computer system (B) and at least one analytics section.
  • the analytics section of the second computer system (B) is also connected with the input processing section of the first computer system (A) ( 8110 ) using the communication means ( 8118 ).
  • the second computer system (B) is also connected to a third computer system (C) using communications means 8128 , which can be any of the communications means herein described.
  • the third computer system (C) includes a responder section ( 8120 ) and is connected to the second computer system (B) through the communications means ( 8128 ), and further includes responder services ( 8122 a , 8122 b ), responder rules ( 8124 a , 8124 b ), and optional log ( 8126 ).
  • responder services 8122 a , 8122 b
  • responder rules 8124 a , 8124 b
  • optional log 8126
  • web servers and web services that provide a user interface. These components can be present on any computer system that hosts aspects of the described invention. Alternatively, a user interface can be constructed using other technologies, such as hard-coded C/C++ or Java applications. The determination of user interface specifics is implementation dependent and can be implemented by anyone skilled in the art. Web-based examples of user interfaces presented herein are exemplary in nature and are not intended to limit the implementation to a web-based interface.
  • FIG. 9 depicts a first exemplary use of an enterprise-wide event management system.
  • the system is configured to monitor an RSS news feed for stories about airplanes ( 9110 ).
  • the system is configured with several instances of an RSS producer service ( 9120 ); each instance of the service is configured using one or more PPSs that describe the RSS interfaces to external information source(s) ( 9130 ).
  • the producer service contacts the information source using the PPS information and access credentials provided in the source definition ( 9140 ).
  • the information source is an RSS feed.
  • the PPS provides a URL for source of the RSS feed ( 9150 ), and the pre-processing step of fetching the full text story using the URL embedded in the RSS feed using a specified RSS connector/protocol adapter component ( 9160 ).
  • This configuration establishes the information flow from the information source to the producer service.
  • the producer service receives the information provided ( 9170 ), performs the specified pre-processing as specified by the PPS ( 9180 ), and produces an event object based upon the information provided ( 9190 ).
  • the event object contains some or all of the specific information provided to the producer service; in other cases, the event contains meta-information relevant to the event, such as the time at which the information was obtained, the version of the software used to obtain the information, or other information about the source information or how it was obtained, instead of, or in addition to source information provided to the producer service.
  • the event includes a reference to the source information rather than the information itself, and optionally including meta-information about the source information or a reference to such meta-information.
  • additional event objects can be created and placed in event queues so as to cause responses that collect additional information from the same or different information sources and aggregate said additional information with the original event object or its content in a new event object ( 9200 ). This, and similar, processes of refining “raw” information by obtaining additional information and aggregating the additional information with the first information is called event enrichment.
  • the enriched event is forwarded to one or more analytics section(s) ( 9210 ) based upon the specified processing of the relevant rule specifications.
  • an event representing a newly received story is received by the defined analytics section ( 9220 ) where the event is processed by a rules engine and one or more analytics plug-ins ( 9230 ).
  • the rules engine processes the event in response to one or more rules defined for use by the analytics section. These rules can be taken from a database, a directory, shared files, or other storage means known to those skilled in the art. In some embodiments, groups of rules can be used together. These rules also can be from collections of sharable and portable RSs and recipes, called “RuleBooks”, can be associated as part of a larger rule, or can be individually provided. In addition, further analysis of events can be provided using plug-in analytic programs associated with at least one rule ( 9240 ).
  • the rules engine and/or analytic programs can generate additional responder section notifications on the basis of the rules processing, or upon the basis of processing by an analytics plug-in program ( 9250 ).
  • the responder section notifications are forwarded to one or more responder section(s) based upon the specifications of the relevant RSs ( 9260 ).
  • the responder section operates one or more responder services, which convert responder notifications received within the system ( 9270 ) into responses (e.g., external notifications, messaging, or other actions) ( 9280 ).
  • a responder service can convert responder notifications resulting from the processing of an event object (such as the one above representing a news story that passed the pattern matching for “airplane”) into an e-mail message, using information contained within the event object to fill in one or more aspects of the email message, such as a “To:” address or “Subject:”.
  • Each responder service has one or more configuration components in the form of responder rules. These rules can be taken from a database, a directory, shared files, RuleBooks, or other storage means known to those skilled in the art.
  • the resulting response (e.g., external communication or other action) ( 9280 ) completes the exemplary processing of a responder notification by the system of the present invention.
  • the architecture of the event management system is inherently distributed. Distribution of the system provides scalability, redundant processing, and other benefits.
  • the distributed architecture is enabled by the communication interfaces and modular component design described above.
  • the distribution of services and rules management permits the system to operate with a minimum of centralized IT support, and leverages the capability of the system to collect and share rules and information processing techniques between users and their workspaces.
  • Distribution of event processing permits the construction of scalable, highly redundant systems that are resistant to single point failure and that can be quickly scaled in response to changes in data volumes, information workflow, and user communities.
  • Different information management and distribution strategies can be employed to implement these features—the choice of specific information management mechanisms utilized is implementation dependant. It is advantageous for distributed instances of an enterprise-wide event management system to use a common time source, so event and analytic timing is consistent. The use of common distributed time sources is well understood in the art.
  • each instance of the system of the present invention runs a web interface and connects to the same back-end data storage service or database, but each server instance negotiates for and actively loads only a subset of the services and rules stored in the data storage service or database.
  • a back-end database system or storage server is preferably highly available.
  • the backend database is not used. Rather, the configuration materials, PPSs, RSs, services, and other aspects of the system are propagated to each system that requires them.
  • the propagation can be performed manually, using automated tools, or using shared disks or services such as a mounted disk or by integrating the materials as part of a shared directory service.
  • shared disks or services such as a mounted disk or by integrating the materials as part of a shared directory service.
  • Other mechanisms for sharing information between system instances also can be used and are well understood by those with skill in the art.
  • An enterprise-wide event management system of the present invention provides for an implementation-dependant degree of redundancy and reliability. Distribution of services as described above provides redundancy and fault tolerance by distributing service instances across several computer systems.
  • the distributed computing systems can be configured using one or more communications means in order to effect distribution and redundancy.
  • a rules engine within the analytics section
  • producer service is configured to use instances of RSs stored within a shared storage system, service, or database
  • the rules engine enables a new style of distribution: event processing flow then can be load-balanced across multiple computer systems while sharing a common configuration and rules set.
  • Each system instance connects to the same storage system, service, or database.
  • Each service instance is able to evaluate and update any rule in the system, consistent with access controls, because the state of the rule network is entirely persistent within the database.
  • each service instance only processes a fraction of the incoming event flow. This approach helps to eliminate the IPO bottlenecks that occur in systems that process large volumes of data, and provides redundancy and fault-tolerance to the architecture.
  • Event queues and service in-core lists can be persisted to disk, storage service, or database in order to permit fault tolerant restarts without loss of information.
  • An enterprise-wide event management system in accordance with various embodiments of the present invention provides for controls on the use and flow of information using access control lists on each security enabled system object and service. These access control lists are used to grant access rights to the object or service. Access controls can be used to restrict creation, storage, viewing, modification, use, export/import, publishing/sharing or deletion of PPSs, RSs and recipes, RuleBooks, event objects, event queues, workspaces, or other aspects of the system.
  • Each security-enabled system object and service contains a set of access control list entries. Each entry specifies:
  • the permission field is completely flexible. Any text can be entered as a permission, so the list of available permissions can grow as needed. When a new database retrieval or update operation is written, the operation specifies which permissions are acceptable to complete the operation.
  • ADMIN permission implies READ and WRITE permission
  • WRITE permission implies READ permission
  • User interfaces inform the user of their access rights by displaying or hiding links, form buttons, and other controls as appropriate. (For example, if a user has read access but not write access, they can view an object's detail page but the link to the Edit feature will be hidden.)
  • HTTP error e.g., 403 Not Authorized or 404 Not Found.
  • the system in accordance with various embodiments of the present invention provides for auditing and logging of configuration and configuration changes, event object generation, event queues, service operations, and rule evaluations.
  • the system also provides for object access, export/import, and publish/subscribe logging.
  • Exemplary implementations of the present invention provide means to create new RuleBooks, edit existing RuleBooks, publish and un-publish RuleBooks, subscribe to published RuleBooks, export and import RuleBooks and destroy (delete) RuleBooks. These functions can be restricted or prohibited based on the access rights of the user or role attempting them.
  • a user wants to publish several rules used by their stock-watching event processing flow, so that other users can implement their own stock-watching event processing flows, the user can create a RuleBook containing their stock watching rules, and the PPSs used to collect the information to feed through the rules. Other users can subscribe to the RuleBook, subject to access controls, and use the rules to establish their own stock-watching event processing flows.
  • the following steps may be carried out to edit an existing RuleBook so as to add or remove RuleBook items currently incorporated into the said RuleBook:
  • the following steps may be carried out to publish a RuleBook so as to make the said RuleBook available to other users, roles or workspaces:
  • the following steps may be carried out to unpublish a RuleBook, so as to remove it from availability for subscription by one or more other users, roles, or workspaces:
  • the following steps may be carried out to subscribe to a published RuleBook, so as to permit binding it to a workspace for use:
  • the following steps may be carried out to export a RuleBook from the current workspace, so that it can be imported into another workspace, or transported to another instance of the system:
  • the following steps may be carried out to import a RuleBook into the current workspace, so that it can be used:
  • Events are related to real-life occurrences pulled in from the outside world by producer services. Events can be anything that a user has deemed of interest, such as 911 dispatches, breaking news headlines, network outages, and the like. Some other examples of events include:
  • Producer processes automatically generate event objects as they gather and pre-process inputs from information source, such as web pages, RSS feeds, sensors, databases and others. Millions of event objects can be passed through the system every day. When an event object is generated, its parameters are identified and used to assign the event object to a specific event queue. As described above, producer services manufacture event objects based upon the data they extract from underlying systems and information feeds. A single real-world event, such as a stock price change, news article, or credit card transaction, can result in a plurality of event objects being generated within the system. These event objects can be placed in a plurality of event queues for processing by one or more analytic sections. Rules as applied to event objects can produce additional event objects and trigger responder services to take action as a result of events. Therefore, event objects are central to event processing flows and resulting actions by the system.
  • An event object has one or more properties associated with it.
  • Each event object can include properties common to all event objects, some properties common to one or more groups of event objects, and some properties that are specific to a particular event object type.
  • the properties associated with each type of event object are defined at the time the event object type is defined.
  • Some common properties associated with event objects include:
  • Each event type, class, and property is named within one or more namespaces, making them usable within one or more rules or workspaces. Namespaces are described in more detail above and below.
  • an event object encapsulates a Java object of any type.
  • the properties of the event object are the properties of the enclosed Java object.
  • Event objects are typically read-only once they are created. For read only event objects, modifications to event objects are not allowed, although an event object can be copied and the copy modified.
  • Event definitions can be exported in a sharable or transportable form.
  • Sharable and transportable event definitions facilitate the use of sharable and transportable services, PPSs, RSs, and related entities to facilitate distributed processing and creation of additional instances of the system, such as for disaster recovery, research or testing purposes. They can also be used to enable sharing and porting of services, PPSs.
  • an event object In normal use, an event object is “used up” (consumed) when the event object is processed by a rule or rule set, however, it is sometimes desirable to make event objects available beyond their initial processing. This is advantageous when more than one event object is required to identify a pattern of events, such as a particular sequence of events, a particular frequency of events, a triggering event count, or a particular set of events all occurring within a given period of time. This process of retaining event objects and making them available for further processing is called “persisting” an event object. An event object that has been persisted is said to be “persistent”.
  • an event object can be made persistent by adding the event object to a persistent event queue.
  • the persistent event queue can be made persistent by safe-storing it to a non-volatile storage device (e.g. a hard disk, flash memory, or magnetic tape) or a database, and by the system not removing event objects from persistent event queues when they are processed. Event objects will remain in this event queue until they are explicitly removed, and can be processed a plurality of times while they remain in the persistent event queue. This type of event persistence is useful when a manual interaction is desired to acknowledge a particular event.
  • persistent event objects can be stored in a memory list by one or more services in order to make the event persistent.
  • This type of event persistence can be made to survive process crashes and shutdowns by safe-storing the events stored in memory to a non-volatile storage device (e.g. a hard disk, flash memory, or magnetic tape) or a database.
  • persistent event objects can possess an expiration parameter that specifies a time at which the event object should be destroyed, the number of times that an event object can be processed before it is automatically destroyed, or another rule that specifies the conditions under which the event object should cease to be persistent and should be destroyed.
  • This capability is useful for implementing time-limited or other semi-persistent event processing. Such capabilities can be useful, for instance, when an event object has persistent utility, but only for a limited time span, such as a current building temperature reading in a building control system that acquires and broadcasts a new temperature reading every 15 minutes, or a system that calculates a moving average for closing stock prices over the prior 30 days.
  • the system can automatically persist all event objects until they are manually deleted, or automatically deleted under control of one or more rules.
  • Events can be “enriched” during processing by the system.
  • Enrichment is a process by which additional properties and/or data are associated with an event object as the event object is processed by the system.
  • Enrichment of event objects is a rule-based process, in which event objects are first identified by one or more rules, the responses of which are specified to either make changes in the event object's structure (e.g. add/remove/change properties), or to collect additional information and add that additional information to the event object.
  • adding, removing, or changing a property of the event object can enrich an event.
  • a rule can identify an event object of a first type, and for all event objects of this type that it identifies, add a property to the event object that indicates that the event object was processed by a specific instance of a service or a rules engine, or at a particular time.
  • This type of event enrichment is useful for marking event objects as processed (which is particularly useful for persistent event objects), for adding other relatively static properties that indicate an aspect of the event or event object, and the like.
  • an event can be enriched by employing a rule that specifies a response that collects additional information and adds it to the event.
  • an event object can correlate to a stock symbol and price, and the response might be to use an SQL statement parameterized by an event object's properties to look up the stock ticker symbol in a database and obtain additional information about the stock issue from the database, such as name or price/earning ratio.
  • This event enrichment procedure can be repeated a plurality of times for any given event.
  • Event enrichment information can be added to the original event as new or changed properties and values, or can be implemented by creation of a new event object that contains both the original event's information and parameters as well as the new information and parameters resulting from enrichment actions.
  • an event object can be enriched by combining information from two or more event objects. For example, a first event object is generated for a news story that matches a keyword rule that results in it being put in the “NASA” event queue, and a second event object is generated for the same news story that matches a keyword rule for “airplane”. The two event objects can be combined to produce an enriched event object that has properties that indicate that the news story matches the “airplane” keyword and is (or was) in the “NASA” event queue.
  • the event enrichment process can be repeated without limit, enabling the provisioning of research/information enrichment steps using rules and RuleBooks, resulting in the fully automated production of packages of enhanced information from a variety of information sources that are provided to or by end-users.
  • the system supports several technical communications means for communicating between and within system instances and services.
  • Each of these technical communication means provides an interface abstracted as one or more sharable lists of events, individually called an “event queue”.
  • Event queues also can be implemented using techniques other than communications techniques described above, for example, using a table in a shared database, an in-memory list, or a shared messaging bus.
  • Event bus Collectively, the operating set of communication mechanisms implemented for an implementation of an enterprise-wide event management system is called the “event bus.”
  • Event queues can be published and shared within the system, or they can be left private and visible only within a single workspace. Private event queues are used internally to event processing flows, or are made available to specific services, users, roles or workspaces on the basis of specific access controls. The visibility of event queues, either private or published, can be controlled using one or more access controls, as described herein. Each event queue can be ordered as a queue (first in, first out), or can be priority ordered based upon one or more event object properties.
  • Each event queue can have zero or more associated event sources, such as producer services or response section services that generate event objects in response to processing of other event objects according to rules.
  • Each event queue also can have zero or more associated event object consumers, such as analytic section services. These event object consumers obtain event objects from an event queue and process them. Obtaining an event object from an event queue deletes the event from the queue, unless the event queue is a persistent event queue, or the event object has a parameter specifying that it is persistent.
  • the association of an event source and the right to place an event object into an event queue is controlled by one or more access control mechanisms, as described herein. In some exemplary implementations the access rights of an event source can be specified in a PPS. Similarly, the association of an event consumer, and the right to retrieve an event from an event queue, is controlled by one or more access control mechanisms. In some exemplary implementations the access rights of an event consumer can be specified in an RS.
  • event objects can be propagated to one or more components of the system. Distribution of event objects can occur either by sharing event queues between distributed aspects of the system or by replication of event objects to distributed aspects of the system. Some or all of the event objects in the event queue can be propagated in this manner.
  • Event queues also provide for the configurable safe storing of event objects added to each event queue.
  • the safe storing of event objects in event queues is a configuration option that can be turned on or off and is used to determine when to save event objects.
  • all event objects are saved to a database, or other non-volatile storage, immediately upon receipt (i.e. at the time they are removed from an event queue).
  • event objects can be processed first and only then saved if they are found to participate in a partial match with one or more rule(s).
  • Event queues can have properties associated with them. These properties can be used to define mandatory and optional aspects of event objects associated with each event queue, to optionally define default values for these properties if alternative values are not assigned, or to define aspects of the event queue itself, such as a name or ID, access rights required to place event objects into the queue, or to remove event objects from the queue, or by producer services to determine appropriate event queues to place generated event objects into. Event queue properties are used in a variety of ways as described herein.
  • Event queues can be used to categorize event objects and their properties. When an event object is created, the event object's properties and values are identified and categorized using one more rules and/or event queue definitions. The event object is then added to each appropriate event queue. If there is more than one event queue that is appropriate for a given event object, the event object is duplicated and one copy placed into each appropriate event queue. Event objects in a published event queue are made available to any subscriber to the said published event queue. For example, if a news-related event object is added to the “World News” published event queue, any subscriber of the “World News” published event queue can process the said event object. If the published event queue is not a persistent event queue, and the event object is not parameterized to be persistent, the first subscriber that processes the event object will consume it and the event object will be removed from the event queue and not be available to other subscribers to the published event queue.
  • New event queue properties can be created automatically. If an event object that contains a new property (e.g., “author”) is the first event object containing that property to be placed into that event queue, then the property is added to the event queue's list of properties. As new rules or services are created, this allows producer services and other event object sources to “learn” to automatically associate event objects with one or more event queues.
  • a new property e.g., “author”
  • event queues examples include:
  • One aspect of the present invention is to allow a user to view event objects currently in the system.
  • a user can select one or more views of event objects using the following procedure:
  • An example event object list provides the following information:
  • Embodiments of the present invention can process millions of event objects per day and could produce many screens of seemingly random event objects.
  • a capability for viewing event objects filtered by topic is provided. For example, if the user is only interested in seeing event objects related to stock prices, they can use the following procedure:
  • the exemplary implementation of the present invention includes the ability to view event queues that there are sufficient access rights to. Access rights are defined using access control lists, as described herein. Access rights required to view a given event queue are defined as part of the event queue definition. In an illustrative embodiment, the following steps may be carried out to view all event queues:
  • the Event Queues screen lists all of the event queues that are visible to the user, showing the following information for each event queue:
  • the properties section provides information that can be used in determining the relevance of the event queue property to the event objects in the event queue. For each property, a count, frequency, and percentage are displayed.
  • the count, frequency, and percentage information can be used to aid in writing rules that have a greater chance of matching. For example, if use of a “title” property results in 80% of rule matches and a “headline” property only matches in 30% of rule matches, a user can use this information to determine that writing a rule using “title” rather than “headline” is more likely to result in a rule that matches event objects in the queue.
  • new event queues are created through services and properties are created automatically as previously described.
  • a user can use the “New>Topic” feature to create a new event queue manually.
  • the following steps may be carried out by a user to create a new event queue:
  • a user with the required access rights can disable or delete event queues. Disabling an event queue does not remove the event queue from the system; the event queue still appears in the event queue display and can be reactivated. A deleted event queue is removed from the system
  • the following steps may be carried out to disable or delete an existing event queue:
  • an event object may not be immediately available to test the rule.
  • the user can manually create an event object and customize the event object to match the new rule's conditions. For example, if the new rule invokes a response when stock symbol “MSFT” exceeds $90, the user can create an event object manually and specify MSFT as the symbol and $100 as the price to ensure that the response occurs as intended.
  • the “New Event” screen is used to customize an event that can be used to test a new rule:
  • the “Copy Event” screen is used to customize an existing event object that can be used to test a new rule. Perform the following steps to copy an existing event object:
  • the system provides for auditing of event objects, event queues, and response actions, including access attempts, event object creation, event object insertion into event queues and other aspects of the operation of the system.
  • the auditing mechanism creates logs of event actions that can be reviewed by appropriately authorized users.
  • a watch list is a set of stored data items.
  • the watch list is stored as a single object with a unique user-defined name.
  • the name can be specified within a specified namespace, or sans namespace. If the watch list is not associated with a specific namespace, it will use the default namespace of the workspace it is bound to.
  • the watch list name can be added to a rule and the rule will reference the data stored in the watch list object. The benefit is that a user can modify the data within the watch list at any time and the rule does not have to change. This is particularly useful when the rule is published and shared by a plurality of workspaces. If the rule does not specify a namespace for the watch list, each subscriber to the rule will be able to create their own watch list, and the shared rule will reference each subscriber's individual watch list to obtain the referenced watch list data.
  • a user wants to create several rules regarding their stock portfolio, they can create a watch list with all of their stocks. When a user creates a rule, they use the watch list rather than each individual stock symbol. Then, in the future, if the user's stock portfolio changes, they can modify the watch list and every rule will automatically use their updated portfolio.
  • the rule is published, and does not specify a namespace for the watch list, each subscriber to the rule can create their own watch list, and when the rule is evaluated, the watch list will take on the default namespace of the workspace the rule is subscribed from, and the user's local watch list will be referenced. The published rule will then be referencing different lists of stock symbols for each subscriber, and each subscriber can update their watch list of stock symbols at any time without requiring changes to the RS or having any effect on other users or workspaces.
  • a watch list can be stored in an instance of the database, a local storage location, a shared directory service, a RuleBook or by other means as determined to be proper by those having skill in the art.
  • the following steps may be carried out to create a new watch list:
  • a service is a configurable object that can be identified within the system by a unique identifier, and started and stopped.
  • Services are executable programs that run as part of the system. They include the service, a configuration, and an optional name.
  • the rules engine is dependent on external services to produce events and respond to them.
  • Services are sometimes used to interact with the computer systems or networks external to the system of the invention, collecting data and inputting that data into the system of the invention in the form of event objects.
  • a user can create and configure different services for a variety of data types, such as network monitors, news feeds, financial transactions, and so on. After a service is created, the user can schedule the service to run at any time and interval (e.g., 1 time every 30 minutes, every other day, the first day of the month, etc.).
  • This type of service is called a producer service.
  • a producer service is a service that is configured by a PPS and can be scheduled to run at specific times.
  • An example of a producer service is a news reader that extracts events from an RSS or Atom news feed.
  • Services are sometimes used to produce actions in computer systems or networks external to the system of the invention, such as by generating email messages or changes in databases.
  • a user can create and configure different services for a variety of interaction types, such as sending an email, writing data to a log file, activating an alarm or updating a database. After this type of service is created, the user can configure the service to respond to one or more events by specifying the service as the response defined for a rule.
  • a responder service is a service that carries out a response for an underlying service, such as an analytic service.
  • An example of a responder is an email service that sends email messages to notify specific users of the occurrence of particular events.
  • a response is a named service configuration. Responses are specified within rules to specify actions to take when rules match specific events.
  • an analytic service is a service that implements a data processing function.
  • An example of an analytic service is a match function that analyzes a set of input elements and returns a true or false result if all elements do or do not match specified criteria.
  • Services can be producers, analytics or responders.
  • a service can be both a producer and a responder.
  • the responder for the rule that determines the need for further event enrichment can be a producer service that acquires the additional information.
  • a service can be referenced as part of a PPS.
  • a user with the proper permissions can create, modify, configure, schedule, disable or delete services. Disabling a service does not remove the service from the system; the service still appears in the service list and can be reactivated.
  • Event objects are generated through producer services that are configured and scheduled using embodiments of the present invention.
  • a multitude of producer services can be configured to access outside information sources of many different types, such as RSS feeds, data monitors, databases, web pages, and computer systems.
  • Example producer services include those that interface to:
  • This service communicates with an Enterprise Agent Server (EAS) to offer the following capabilities:
  • EAS Enterprise Agent Server
  • the service configuration defines the properties needed to invoke an agent:
  • the EAS Agent Service is configured on initialization with the URL of the EAS Execution Servlet.
  • the EAS Agent Service reads the requested agent name from the Response object, along with any other properties defined by the response object.
  • the service then does an HTTP POST to the EAS Execution Servlet URL, with parameter agentName equal to the specified name.
  • the service encodes all available event properties as form parameters.
  • the EAS Execution Servlet makes those HTTP form-post properties available to the agent as event parameters. For example, if the AgentService sets a price parameter equal to 10, EAS will set $event-param:price$ to 10.
  • RTAM Real-Time Alert Manager
  • This service provides SMTP, POP, and IMAP interfaces to the system. It permits the system to:
  • the service configuration defines the mail server, account/mailbox, and authentication information necessary to communicate with the mail system.
  • the instant messaging service maps Jabber/XMPP messages and presence events to and from the system. This service leverages the Jabber IM service to:
  • the Jabber server can be configured to provide transports to other messaging services such as AOL Instant Messenger, MSN Messenger, IRC, etc.
  • Jabber/XMPP is a product of the Jabber Software Foundation of Denver, Colo.
  • the VFS API supports many common file systems (for example, local file, CIFS/Windows networking, FTP, HTTP, HTTPS, SFTP, temporary files, webdav, zip, jar, gzip, bzip2). It is a “dumb” retrieval/comparison algorithm, and submits the entire document when the document changes.
  • the URL Change Listener can delegate its services to lower-level change listeners that understand the most efficient ways to detect changes in their domain.
  • the HTTP Change Listener is one example where greater efficiency can be attained by leveraging protocol-specific features.
  • An HTTP change listener leverages HTTP protocol-specific features to efficiently determine when a web page has changed. Examples are ETag/If-Match, and If-Modified-Since. Those headers lets the user ask the web server if the page has changed since the last time the user retrieved the page, and the headers are a much more intelligent way to determine web page changes than downloading and comparing locally.
  • This service allows embodiments of the present invention to interact with a database through a JDBC driver.
  • Each service instance is pre-configured with a JDBC driver, connection string, and so on and accepts the following tasks:
  • An RSS producer service is an RSS listener that subscribes to one or more RSS feeds, and monitors each feed for RSS feed items (such as news stories).
  • the RSS producer service uses configuration information, such as a PPS, to define one or more feeds and to make the RSS association for these feeds.
  • the RSS producer service receives each feed and processes the feed, looking for items in the feed.
  • the RSS producer service can be optionally configured to generate an event object for each item found in the feed, to generate an event object for each new item found in the feed, or to generate an event object for each item in the feed that matches one or more defined pre-processing rules. For each feed item identified as requiring an event object, the RSS producer service generates one or more event objects. These event objects can be tagged with one or more topics, as defined by the PPS, or determined by pre-processing rules.
  • a windows file system listener watches a directory recursively for any changes within that directory tree; or the file system listener can watch a single file for changes.
  • the file system listener POSTs the file metadata and content using the HTTP REST interface.
  • Some example properties include:
  • Portable service definitions include configuration and naming for producers, responders (e.g. responses), and analytics, and can be stored in a database instance, on a local disk, in configuration materials, in a RuleBook, or other locations as is convenient.
  • a portable service definition references or includes a specific instance of an executable program that provides a service.
  • a portable service definition used to configure a producer service is known as a “Portable Producer Specification” (PPS).
  • Producer and response services can be scheduled as to when they run. Schedules do not apply to analytic services. Scheduling a service causes the service to run on a periodic basis to collect information from information sources or to process any responses that have been queued for delayed execution.
  • the following steps may be carried out by a user to schedule a specific service:
  • a schedule starts on Dec. 11, 2006 at 12:32:42 AM and ends at 11:59:59 PM.
  • the schedule will run once every hour.
  • the service After a service is scheduled, the service will run at the designated time and interval, producing or processing event objects.
  • a producer service is a service that generates event objects.
  • Producer services are configured by specification of a Portable Producer Specification (PPS) and can be scheduled to run at specific times or intervals.
  • PPS Portable Producer Specification
  • An example of a producer service is a news reader that extracts events from an RSS or Atom news feed.
  • the following steps may be carried out to create a new producer service:
  • An analytic is a service that provides a function.
  • the analytic can provide a simple function (like in an API) or can be a more complex service that connects to a remote server and performs some processing before returning.
  • the implementation details are transparent to the user and to the query language.
  • a service that implements the Analytic interface can be plugged into a system of the present invention for use within a query language specification as analytical functions.
  • the basic analytics are described and it is demonstrated how they can be used within a query language statement. Examples include Inxight, Metacarta GeoTagger, and so on (anything that needs to establish or verify a connection with a remote service).
  • the Match analytic determines whether all input objects are equal.
  • symbol identifier used above means the set of symbol properties from the selection of 3 stock quotes.
  • the match analytic operates on that set.
  • the embodiments of the invention pass the match analytic a Collection of symbol properties.
  • the match analytic returns a single Boolean result—true if all the input symbols are equal.
  • match operates on a single string property p.company_symbol and a set of 3 properties s.symbol.
  • the engine flattens the inputs and calls analyze with a Collection containing p.company_symbol and the 3 symbols from s. The result of match is true if all 4 elements of the Collection are equal.
  • the Range analytic computes the range of a collection of numbers (the difference between the largest input and the smallest input).
  • various embodiments of the invention analyze the range of the price properties in the parameter set.
  • the range analytic can operate on that set.
  • the various embodiments of the invention pass a Collection of Double objects to the range analytic, which returns the absolute value of the difference between the largest input and the smallest input. If that value is greater than 5, the expression is true.
  • the Count analytic returns the number of input elements—implemented as Collection.size( ).
  • the result is the number of symbol properties encountered in the input set. In this case, the condition is true if all 5 input events have a symbol property. If any of them are missing the property, the condition will be false.
  • the Xpath analytic returns the result specified by the xpath—implemented using Apache Commons' JXPath.
  • An object base is optional: if unspecified, the enclosing event is the object base.
  • WHEN ‘new document’ WITH xpath(“/document/summary/country/text( )”) contains “iraq” THEN . . .
  • one of the event's properties can be passed to the analytic as the base object.
  • the xpath is computed starting at the content property.
  • the Regex analytic returns a set of substrings of object.toString( ) that match the specified regex. If the base object is unspecified, the enclosing event is the base object.
  • the xpath starts with the ‘new document’ event, calls the toString( ) method on the ‘new document’, searches the document for the regex pattern “ab.*”, and returns a set of strings from the matching country nodes.
  • This example is the same except it runs the regex on the “content” property of the event, instead of the event itself.
  • Custom analytics also can be developed, using Inxight, ANNIE, and so on.
  • Analytic Input Uses extract-entities string set Finds entities in the input Inxight categorize string set Returns a set of categories Inxight summarize string set Returns a summary of the Inxight input
  • Spatial Analytics operate on geospatial points and regions.
  • An analytic service is a service that implements a data processor that can be plugged into a rule definition.
  • An example of an analytic service is a match function that analyzes a set of input elements and returns a true or false if all elements match.
  • the following steps may be carried out to create a new analytic:
  • Responses are initiated as part of rule evaluation. Response capabilities include the following:
  • Rules invoke responses to event conditions by invoking a pre-defined Response or by invoking a Responder Service.
  • a response can be an email to a specific user to notify that user of a specific event.
  • Responses defined in the Response user interface can be defined as templates where all or some fields can be left blank.
  • Response definitions can be stored in a database, in a RuleBook, in configuration materials, or locally within each instance of the system.
  • the response parameters can be defined at that time.
  • the user can specify key properties to be used as default values when the response is added to a rule. For example, in an email response, the user can specify a CC or BCC property where a specific user or account will receive copies of all the emails sent through that response.
  • responses include:
  • IM Message Generic IM with default values: screen name and message text.
  • Users with the proper access rights can disable or delete a response from the Edit Response screen. Disabling a response does not remove the response from the system; the response will still appear in the response list and can be re-activated. A deleted response is removed from the system and cannot be re-activated. Rules employing disabled or deleted responses do not match event objects in the rules engine.
  • a user can create several responses for each service type. For example, if a user selects mailto, he can create several different email responses, each used in a different scenario. For example, each email response can specify a different default subject and body. In an illustrative embodiment, the following steps may be carried out to create a new response:
  • the “New Response” screen is used to convert a selected service into a response.
  • only Responders and Producer/Responders can be converted into Responses. Thereafter, the user can add this response as part of a new rule.
  • the following steps may be carried out to create a response from an existing service, the user performs the following steps:
  • the rules engine processes rules.
  • the rules engine includes interfaces for propagating event objects into and out of the engine, parsing and creating rules, and tracking partial rule evaluations. Event objects are detected automatically through activation of user-defined rules that are configured within the various embodiments of the present invention.
  • Event detection capabilities of the rules engine include the following:
  • the rules engine upon initialization, loads RSs from workspaces, RuleBooks and other storage locations configured for the rules engine.
  • the rules engine identifies the RSs, watch lists, and other components that must be loaded on the basis of one or more configuration materials. Each identified component is located, and loaded into the rules engine, translated from its storage or transportable format to an in-memory form, and stored within the memory of the rules engine. Internal event queues are also loaded as necessary to re-establish the historical context of the rules engine.
  • the rules engine is ready to start processing events.
  • the rules engine then registers to receive event objects from event queues and begins processing the event objects it receives.
  • the rules engine For each event object received, the rules engine evaluates each enabled rule to determine whether the rule matches the current event object. If no match occurs, the rules engine has completed processing the event object. If one or more matches occur, the rules engine selects the rules to be processed and then processes them. Rules associated with disabled or deleted topics are not matched. Similarly, disabled rules are not processed either. Each rule is processed by evaluating the rule and executing the proper response if the rule matches. The response is specified as part of the RS as described above and below.
  • the rules engine evaluates event objects in several ways.
  • a first method of event object evaluation is instant analysis of an event object when the event object is received. This method of evaluation provides for near-real time detection of specific events, and is implemented using simple tests for event object properties matching an expression with the immediate generation of a response when a match occurs.
  • a second method of event object evaluation is the evaluation of an event object in context of other event objects. This method of evaluation provides for recognizing a series or collection of related events, such as “IF event A has occurred and event B has occurred, then make an appropriate response.”
  • a third method of event evaluation is the evaluation of an event object for membership in partially completed event series.
  • each incoming event object must be evaluated against other event objects of the same type that have occurred in the recent past.
  • the rules engine uses internal event queues, watch lists, or database persistence to store the historical event objects for subsequent evaluation as described above.
  • the system provides for robust user-created rule authoring and sharing through formulas, wizards, and templates.
  • User-created rules created by a first user can be published and shared with, or exported for transport to, one or more additional second user(s) in a variety of ways, including:
  • the system permits individual users to create rules and event queues that translate their own information processing techniques into sharable, automated resources. These resources are made available to additional users by the capabilities supported by the system.
  • the system thus supports knowledge and information sharing on a variety of fronts, including the sharing of rules, analytic structures, and resulting collections of pre-processed information.
  • Rules can be taken from a database, a directory, shared files, or other storage means known to those skilled in the art. In some embodiments, groups of rules can be used together. These rules also can be obtained from RuleBooks of sharable and transportable rules and recipes, can be associated as part of a larger rule, or can be individually provided.
  • User-created rules can also be exported and transported to other instances of the system, such as when providing a business service comprising provision of rules and RuleBooks, or when suggesting topics for classifying information feeds.
  • Rules are used to analyze event objects based on specific conditions, and then to invoke responses when conditions match. For example, when a producer service (e.g. from reading a news feed) creates an event object that matches a specific condition (e.g., the news content contains “London”), the rule evaluation then invokes a specific response (e.g., send an email).
  • a producer service e.g. from reading a news feed
  • creates an event object that matches a specific condition e.g., the news content contains “London”
  • a specific response e.g., send an email.
  • the current invention provides for use of Rule Wizards that step users through the processes of selecting event queues and/or topics, rule specifications, and associated responses. Templates also can be provided by a user with appropriate access rights so the user simply inputs key values. Finally, the user can input rule text manually; however, this feature is for advanced users only.
  • Previously defined rules can be disabled, either by the system or a user with appropriate access rights. Disabling a rule does not remove the rule from the system; the rule will still appear in the rule list and can be reactivated.
  • the Rule Wizard steps the user through the process of selecting event queues and/or topics, rule definitions, and associated responses.
  • an auto complete function is available, which helps the user select topics and properties.
  • the following steps may be carried out to create a rule using the Rule Wizard:
  • Rule Templates are an alternative method to create new rules.
  • a user with appropriate access privileges can create templates representing common scenarios, such as news event alerts, stock quote price checks, and credit card transaction monitoring.
  • a user then can select one of these pre-existing templates and follow the instructions below to create a rule.
  • the following steps may be carried out to create a rule using a template:
  • Rule definitions leverage if/then/else statements, keyword/pattern matching, statistical processing, Boolean logic, overtime correlation, geospatial analysis, automatic cross-referencing against external sources, and more, to identify events.
  • the rules engine uses a query language to analyze multiple events based on joins, temporal (time) windows, spatial regions, and pluggable analytics.
  • the rules engine provides efficient storage and joining of multiple events, while ignoring/expiring old events (those that have surpassed the temporal boundary).
  • Features include:
  • a rule is defined using common computer parseable grammars.
  • the rules engine translates from human-readable forms (e.g. ASCII text) to machine usable formats (e.g. bytecodes). Both formats are considered rules.
  • RSs describe event queues from which to obtain event objects, each with optional selection criteria; rule definitions that specify matching criteria, optional temporal window constraints, etc.; and one or more responses to be executed when the rule is matched.
  • the following are example extensions to SQL that enable the query language to operate with event objects.
  • Rule definition text inherits characteristics common in existing languages, with some minor differences.
  • variable : (namespace ‘:’)? identifier (‘.’ identifier)*
  • last also could be newest, latest, and so on.
  • the identifier symbol passed into the match analytic is the set of 3 symbol properties from the event selection.
  • Each event has a WITH clause.
  • the second WITH uses the alias “s” to reference the first event. This is the preferred method.
  • c is being included in a template string, so serialize it to a String for inclusion in the template.
  • watchlist is a user profile object.
  • relationship_change event itself contains a property named “watchlist,” that property will be matched first. Normally the user would know if that is likely to happen. However, to guard against the possibility the default search order can be overridden by explicitly specifying the profile namespace.
  • the default namespace search order provides the results users expect about 99% of the time.
  • the second with clause has an unqualified reference to x; the reference is matched to an event alias, because one was declared previously.
  • This example is identical to the first one, except the fact that x is referencing an event is made explicit.
  • the default namespace search order will do what the user expects about 99% of the time. However, the namespace prefix will support those rare cases where specific behavior is required, or where the user wants to explicitly specify all references.
  • the . operator has the highest precedence in query language. It can dereference a single object or an entire set of objects, providing a more compact syntax than would otherwise be required for set operations.
  • variable is a set
  • every element in the set is dereferenced and a new set containing the dereferenced elements is returned. For example:
  • variable is a single data element (object)
  • named property is dereferenced:
  • WHEN stock.quote s ⁇ -- declares a single data element with alias “s” WITH s.price > 20 ⁇ -- s.price is just a number, not a set of numbers
  • a rule based on the query language can respond to a given situation by invoking a named Response or by invoking a Responder Service.
  • a named Response is a template that configures a responder service that is previously created by a user and saved with a name. The named Response contains stored values that optionally can be overridden by supplying parameters.
  • Query language also can invoke a Responder Service by name, but passes all the parameters required to successfully create a Response on the fly for that service to invoke.
  • a first example provides an alert when a value crosses a threshold, and prevents the alert from repeatedly firing when a value is regularly moving across the threshold value.
  • One issue with alerting on threshold values is that alarms will repeatedly trigger when using a simplistic formula that detects above/below a specific threshold. In the example given of Microsoft stock going below 40, will the alarm repeatedly go off every time Microsoft is reported below 40, or is there a way of saying, only send out a report if the stock was previously above 40?
  • this rule fires alerts only at the points in time where the price initially falls below the assigned threshold, and not every occurrence thereafter.
  • a solution could be implemented using event enrichment to access persisted information.
  • the event would be enriched with the last stock value and the amount of time since the last stock alert was fired.
  • event enrichment the rule would be changed to a SQL response that would write the current value of the stock to a column in a database (or to a watch list). This provides database-based persistence of the rule state.
  • the rule is configured to pull previous data from the watch list in the database using the SQL Service.
  • the SQL service retrieves from the alert database/watch list the last time the rule fired for that user. Then, the rule subtracts that value from the current time, and stores the value as a last_alert_fired data item.
  • a second example is the monitoring of an event by a “canned rule”.
  • rules and watch lists can be combined to monitor the rate of change of an event.
  • an alert is configured that calculates the rate of change and looks for missing or extra events in a regularly occurring event stream.
  • An example of this type of alert is monitoring a “heartbeat” event.
  • a first monitoring rule is established that triggers upon receipt of the designated heartbeat event.
  • the event has a response, which is to update a watch list used as a counter.
  • the watch list contains the last time the event triggered, a count of triggered events, and a moving average of the counter update interval.
  • a second rule is used to monitor the watch list, and to generate a response when an event is missed (e.g. now( )—last time the event is triggered>threshold).
  • a third rule is used to detect early triggering of the rule (e.g. the events coming too close together).
  • the above example illustrates an event updating a watch list that is monitored by several other events.
  • This is an example of a set of complex rules that can be used.
  • a set of rules and watch lists like the set described above can be packaged as a template and stored in a RuleBook. The packaging of the rules in this manner permits domain experts to write sets of arbitrarily complex rules and recipes and then publish them for use by a user community.
  • the invention can be implemented in digital electronic circuitry, or in computer hardware, firmware, software, or in combinations of them.
  • Apparatus of the invention can be implemented in a computer program product tangibly embodied in a machine-readable storage device for execution by a programmable processor; and method steps of the invention can be performed by a programmable processor executing a program of instructions to perform functions of the invention by operating on input data and generating output.
  • the invention can be implemented advantageously in one or more computer programs that are executable on a programmable system including at least one programmable processor coupled to receive data and instructions from, and to transmit data and instructions to, a data storage system, at least one input device, and at least one output device.
  • Each computer program can be implemented in a high-level procedural or object-oriented programming language, or in assembly or machine language if desired; and in any case, the language can be a compiled or interpreted language.
  • Suitable processors include, by way of example, both general and special purpose microprocessors.
  • a processor will receive instructions and data from a read-only memory and/or a random access memory.
  • a computer system will include one or more mass storage devices for storing data files; such devices include magnetic disks, such as internal hard disks and removable disks; magneto-optical disks; and optical disks.
  • Storage devices suitable for tangibly embodying computer program instructions and data include all forms of non-volatile memory, including by way of example semiconductor memory devices, such as EPROM, EEPROM, and flash memory devices; magnetic disks such as internal hard disks and removable disks; magneto-optical disks; and CD-ROM disks. Any of the foregoing can be supplemented by, or incorporated in, ASICs (application-specific integrated circuits).
  • semiconductor memory devices such as EPROM, EEPROM, and flash memory devices
  • magnetic disks such as internal hard disks and removable disks
  • magneto-optical disks magneto-optical disks
  • CD-ROM disks CD-ROM disks
  • the invention can be implemented on a computer system having a display device such as a monitor or LCD screen for displaying information to the user.
  • the user can provide input to the computer system through various input devices such as a keyboard and a pointing device, such as a mouse, a trackball, a microphone, a touch-sensitive display, a transducer card reader, a magnetic or paper tape reader, a tablet, a stylus, a voice or handwriting recognizer, or any other well-known input device such as, of course, other computers.
  • the computer system can be programmed to provide a graphical user interface through which computer programs interact with users.
  • the processor optionally can be coupled to a computer or telecommunications network, for example, an Internet network, or an intranet network, using a network connection, through which the processor can receive information from the network, or might output information to the network in the course of performing the above-described method steps.
  • a computer or telecommunications network for example, an Internet network, or an intranet network
  • Such information which is often represented as a sequence of instructions to be executed using the processor, can be received from and outputted to the network, for example, in the form of a computer data signal embodied in a carrier wave.
  • the present invention employs various computer-implemented operations involving data stored in computer systems. These operations include, but are not limited to, those requiring physical manipulation of physical quantities. Usually, though not necessarily, these quantities take the form of electrical or magnetic signals capable of being stored, transferred, combined, compared, and otherwise manipulated.
  • the operations described herein that form part of the invention are useful machine operations.
  • the manipulations performed are often referred to in terms, such as, producing, identifying, running, determining, comparing, executing, downloading, or detecting. It is sometimes convenient, principally for reasons of common usage, to refer to these electrical or magnetic signals as bits, values, elements, variables, characters, data, or the like. It should remembered however, that all of these and similar terms are to be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities.
  • the present invention also relates to a device, system or apparatus for performing the aforementioned operations.
  • the system can be specially constructed for the required purposes, or it can be a general-purpose computer selectively activated or configured by a computer program stored in the computer system.
  • the processes presented above are not inherently related to any particular computer system or other computing apparatus.
  • various general-purpose computer systems can be used with programs written in accordance with the teachings herein, or, alternatively, it can be more convenient to construct a more specialized computer system to perform the required operations.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computational Linguistics (AREA)
  • Data Mining & Analysis (AREA)
  • Databases & Information Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Library & Information Science (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Storage Device Security (AREA)
  • Debugging And Monitoring (AREA)
US12/130,569 2007-05-31 2008-05-30 Distributed system for monitoring information events Abandoned US20080301175A1 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US12/130,569 US20080301175A1 (en) 2007-05-31 2008-05-30 Distributed system for monitoring information events

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US92480107P 2007-05-31 2007-05-31
US12/130,569 US20080301175A1 (en) 2007-05-31 2008-05-30 Distributed system for monitoring information events

Publications (1)

Publication Number Publication Date
US20080301175A1 true US20080301175A1 (en) 2008-12-04

Family

ID=40075763

Family Applications (3)

Application Number Title Priority Date Filing Date
US12/130,569 Abandoned US20080301175A1 (en) 2007-05-31 2008-05-30 Distributed system for monitoring information events
US12/130,654 Active 2031-07-17 US8453159B2 (en) 2007-05-31 2008-05-30 Workspace system and method for monitoring information events
US12/130,688 Abandoned US20090048994A1 (en) 2007-05-31 2008-05-30 Portable Rule Specification System and Method for Monitoring Information Events

Family Applications After (2)

Application Number Title Priority Date Filing Date
US12/130,654 Active 2031-07-17 US8453159B2 (en) 2007-05-31 2008-05-30 Workspace system and method for monitoring information events
US12/130,688 Abandoned US20090048994A1 (en) 2007-05-31 2008-05-30 Portable Rule Specification System and Method for Monitoring Information Events

Country Status (5)

Country Link
US (3) US20080301175A1 (de)
EP (1) EP2168039A4 (de)
AU (1) AU2008256623B2 (de)
CA (1) CA2688509C (de)
WO (1) WO2008148130A2 (de)

Cited By (124)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060074714A1 (en) * 2004-10-01 2006-04-06 Microsoft Corporation Workflow tracking based on profiles
US20060190433A1 (en) * 2005-02-23 2006-08-24 Microsoft Corporation Distributed navigation business activities data
US20060241959A1 (en) * 2005-04-26 2006-10-26 Microsoft Corporation Business alerts on process instances based on defined conditions
US20060294197A1 (en) * 2005-06-28 2006-12-28 Microsoft Corporation Schematization of establishing relationships between applications
US20090024622A1 (en) * 2007-07-18 2009-01-22 Microsoft Corporation Implementation of stream algebra over class instances
US20090055409A1 (en) * 2007-08-21 2009-02-26 International Business Machines Corporation Apparatus, system, and method for customized event processing using a jdbc resource adapter
US20090259769A1 (en) * 2008-04-10 2009-10-15 International Business Machines Corporation Dynamic Component Placement in an Event-Driven Component-Oriented Network Data Processing System
US20100057680A1 (en) * 2008-08-28 2010-03-04 Mark Cameron Little Dynamic configuration of services using a syndication feed
US20100125477A1 (en) * 2008-11-14 2010-05-20 Oracle International Corporation Operation control for deploying and managing software service in a virtual environment
US20100151885A1 (en) * 2008-12-17 2010-06-17 Avaya Inc. Location Privacy Enforcement in a Location-Based Services Platform
US20100198903A1 (en) * 2009-01-31 2010-08-05 Brady Corey E Network-supported experiment data collection in an instructional setting
US20100318588A1 (en) * 2009-06-12 2010-12-16 Avaya Inc. Spatial-Temporal Event Correlation for Location-Based Services
US20110113058A1 (en) * 2009-11-12 2011-05-12 salesforce.com,inc. Implementing enterprise level business information networking
US20110113379A1 (en) * 2009-11-10 2011-05-12 Research In Motion Limited Multi-source picture viewer for portable electronic device
US20110145192A1 (en) * 2009-12-15 2011-06-16 Xobni Corporation Systems and Methods to Provide Server Side Profile Information
US20110191337A1 (en) * 2010-02-03 2011-08-04 Xobni Corporation Providing User Input Suggestions for Conflicting Data Using Rank Determinations
US20110258628A1 (en) * 2010-04-15 2011-10-20 Salesforce.Com, Inc. System, method and computer program product for transporting a task to a handler, utilizing a queue
US20120005542A1 (en) * 2010-07-01 2012-01-05 LogRhythm Inc. Log collection, structuring and processing
EP2383666A3 (de) * 2010-04-23 2012-01-18 Research In Motion Limited Verfahren und Vorrichtung für den Empfang von Daten aus mehreren Versorgungsquellen
US20120042326A1 (en) * 2010-08-16 2012-02-16 Fujitsu Limited Identifying An Event Occurrence From Sensor Data Streams
US20120065958A1 (en) * 2009-10-26 2012-03-15 Joachim Schurig Methods and systems for providing anonymous and traceable external access to internal linguistic assets
US20120089572A1 (en) * 2010-10-06 2012-04-12 International Business Machines Corporation Automated and self-adjusting data protection driven by business and data activity events
US20120102402A1 (en) * 2010-10-20 2012-04-26 Salesforce.Com, Inc. Framework for Custom Actions on an Information Feed
US20120271921A1 (en) * 2010-10-15 2012-10-25 Telefonaktiebolaget L M Ericsson (Publ) Arrangement and Method for Providing Data to a User
WO2013066651A1 (en) * 2011-11-04 2013-05-10 Ipc Systems, Inc. User interface displaying filtered information
US20130159926A1 (en) * 2011-12-20 2013-06-20 Sap Portals Israel Ltd Annotating Contextual Workspaces
US20130173337A1 (en) * 2011-12-30 2013-07-04 Verizon Patent And Licensing Inc. Lifestyle application for enterprises
US8489476B1 (en) * 2008-06-30 2013-07-16 United States Automobile Association (USAA) Data manager for suspicious activity monitor
US8560554B2 (en) 2010-09-23 2013-10-15 Salesforce.Com, Inc. Methods and apparatus for selecting updates to associated records to publish on an information feed using importance weights in an on-demand database service environment
US8560575B2 (en) 2009-11-12 2013-10-15 Salesforce.Com, Inc. Methods and apparatus for selecting updates to associated records to publish on an information feed in an on-demand database service environment
US20130275987A1 (en) * 2012-04-13 2013-10-17 Theplatform For Media, Inc. Methods and systems for queuing events
US20130290385A1 (en) * 2012-04-30 2013-10-31 Charles B. Morrey, III Durably recording events for performing file system operations
US20140040920A1 (en) * 2012-08-06 2014-02-06 Alcatel-Lucent Canada, Inc. Strategy based event notification chain
US20140143018A1 (en) * 2012-11-21 2014-05-22 Verint Americas Inc. Predictive Modeling from Customer Interaction Analysis
US20140172668A1 (en) * 2012-12-17 2014-06-19 Salesforce.Com, Inc. System, method and computer program product for performing an action in response to an event
US8805875B1 (en) * 2008-10-04 2014-08-12 Reflex Systems Llc Systems and methods for information retrieval
US8832259B1 (en) * 2009-10-30 2014-09-09 Hewlett-Packard Development Company, L.P. Virtual service mode methods for network remote monitoring and managing system
US20140310225A1 (en) * 2013-04-15 2014-10-16 Vmware, Inc. Efficient data pattern matching
US8924956B2 (en) 2010-02-03 2014-12-30 Yahoo! Inc. Systems and methods to identify users using an automated learning process
US8984074B2 (en) 2009-07-08 2015-03-17 Yahoo! Inc. Sender-based ranking of person profiles and multi-person automatic suggestions
US8982053B2 (en) 2010-05-27 2015-03-17 Yahoo! Inc. Presenting a new user screen in response to detection of a user motion
US8990323B2 (en) 2009-07-08 2015-03-24 Yahoo! Inc. Defining a social network model implied by communications data
US9058366B2 (en) 2007-07-25 2015-06-16 Yahoo! Inc. Indexing and searching content behind links presented in a communication
WO2013071305A3 (en) * 2011-11-10 2015-06-18 Inventime Usa, Inc. Systems and methods for manipulating data using natural language commands
US9081873B1 (en) 2009-10-05 2015-07-14 Stratacloud, Inc. Method and system for information retrieval in response to a query
US9087323B2 (en) 2009-10-14 2015-07-21 Yahoo! Inc. Systems and methods to automatically generate a signature block
US9154605B2 (en) 2010-04-23 2015-10-06 Blackberry Limited Method and apparatus for posting data to a plurality of accounts
US9158816B2 (en) 2009-10-21 2015-10-13 Microsoft Technology Licensing, Llc Event processing with XML query based on reusable XML query template
US9229986B2 (en) 2008-10-07 2016-01-05 Microsoft Technology Licensing, Llc Recursive processing in streaming queries
US20160034361A1 (en) * 2013-04-16 2016-02-04 Hewlett-Packard Development Company, L.P. Distributed event correlation system
US20160043984A1 (en) * 2014-08-07 2016-02-11 International Business Machines Corporation Redirecting notifications to an alternative computing device and allowing subsequent sms interactions to address the notifications via that alternative computing device
US9275126B2 (en) 2009-06-02 2016-03-01 Yahoo! Inc. Self populating address book
US20160140200A1 (en) * 2012-04-17 2016-05-19 Salesforce.Com, Inc. Dynamic integration of disparate database architectures for efficient management of resources in an on-demand services environment
US9355110B1 (en) * 2011-07-14 2016-05-31 Google Inc. Dynamic presentation of data items based on prioritized associations
US9383831B1 (en) 2010-12-23 2016-07-05 Amazon Technologies, Inc. Powered augmented reality projection accessory display device
US9411855B2 (en) 2010-10-25 2016-08-09 Salesforce.Com, Inc. Triggering actions in an information feed system
US9443225B2 (en) 2011-07-18 2016-09-13 Salesforce.Com, Inc. Computer implemented methods and apparatus for presentation of feed items in an information feed to be displayed on a display device
US20160307173A1 (en) * 2015-04-20 2016-10-20 Splunk Inc. Display of data ingestion information based on counting generated events
US20160337301A1 (en) * 2015-05-13 2016-11-17 The Travelers Indemnity Company Predictive electronic message management systems and controllers
US9501561B2 (en) 2010-06-02 2016-11-22 Yahoo! Inc. Personalizing an online service based on data collected for a user of a computing device
US9508194B1 (en) 2010-12-30 2016-11-29 Amazon Technologies, Inc. Utilizing content output devices in an augmented reality environment
US9514466B2 (en) 2009-11-16 2016-12-06 Yahoo! Inc. Collecting and presenting data including links from communications sent to or from a user
US20170003857A1 (en) * 2015-06-30 2017-01-05 Bank Of America Corporation Automated device assistance
US9584343B2 (en) 2008-01-03 2017-02-28 Yahoo! Inc. Presentation of organized personal and public data using communication mediums
US9589070B2 (en) 2011-10-10 2017-03-07 Salesforce.Com, Inc. Method and system for updating a filter logic expression representing a boolean filter
US9607315B1 (en) 2010-12-30 2017-03-28 Amazon Technologies, Inc. Complementing operation of display devices in an augmented reality environment
US20170093651A1 (en) * 2015-09-30 2017-03-30 Bank Of America Corporation Channel accessible single function micro service data collection process for light analytics
US20170111432A1 (en) * 2015-10-19 2017-04-20 Adobe Systems Incorporated Identifying sources of anomalies in multi-variable metrics using linearization
US9685158B2 (en) 2010-06-02 2017-06-20 Yahoo! Inc. Systems and methods to present voice message information to a user of a computing device
US9692675B1 (en) 2012-06-21 2017-06-27 Open Text Corporation Activity stream based collaboration
US9715325B1 (en) * 2012-06-21 2017-07-25 Open Text Corporation Activity stream based interaction
US9721386B1 (en) * 2010-12-27 2017-08-01 Amazon Technologies, Inc. Integrated augmented reality environment
US9721228B2 (en) 2009-07-08 2017-08-01 Yahoo! Inc. Locally hosting a social network using social data stored on a user's computer
US9747175B2 (en) 2015-09-30 2017-08-29 Bank Of America Corporation System for aggregation and transformation of real-time data
US9747583B2 (en) 2011-06-30 2017-08-29 Yahoo Holdings, Inc. Presenting entity profile information to a user of a computing device
US9766057B1 (en) 2010-12-23 2017-09-19 Amazon Technologies, Inc. Characterization of a scene with structured light
US9772812B1 (en) * 2016-03-28 2017-09-26 Amazon Technologies, Inc. Device-layout determinations
US20170308421A1 (en) * 2016-04-26 2017-10-26 International Business Machines Corporation Predictive disaster recovery system
US9819765B2 (en) 2009-07-08 2017-11-14 Yahoo Holdings, Inc. Systems and methods to provide assistance during user input
US9860339B2 (en) 2015-06-23 2018-01-02 At&T Intellectual Property I, L.P. Determining a custom content delivery network via an intelligent software-defined network
US9916592B2 (en) 2012-05-18 2018-03-13 Oracle International Corporation Method and system for implementing implicit follow and automatic unfollow
US20180091528A1 (en) * 2016-09-26 2018-03-29 Splunk Inc. Configuring modular alert actions and reporting action performance information
US10013672B2 (en) 2012-11-02 2018-07-03 Oath Inc. Address extraction from a communication
US10031335B1 (en) 2010-12-23 2018-07-24 Amazon Technologies, Inc. Unpowered augmented reality projection accessory display device
US10078819B2 (en) 2011-06-21 2018-09-18 Oath Inc. Presenting favorite contacts information to a user of a computing device
US10121125B2 (en) 2015-06-30 2018-11-06 Bank Of America Corporation Automated device assistance
US10148675B1 (en) 2016-03-30 2018-12-04 Amazon Technologies, Inc. Block-level forensics for distributed computing systems
US10152606B2 (en) 2012-04-04 2018-12-11 Varonis Systems, Inc. Enterprise level data element review systems and methodologies
US10165056B2 (en) 2015-06-30 2018-12-25 Bank Of America Corporation Automated device assistance
US10178119B1 (en) 2016-03-30 2019-01-08 Amazon Technologies, Inc. Correlating threat information across multiple levels of distributed computing systems
US20190012218A1 (en) * 2017-07-10 2019-01-10 Nokia Solutions And Networks Oy Event handling in distributed event handling systems
US10192200B2 (en) 2012-12-04 2019-01-29 Oath Inc. Classifying a portion of user contact data into local contacts
WO2019055845A1 (en) * 2017-09-15 2019-03-21 Walmart Apollo, Llc FRAMEWORK FOR CONTROLLING EVENTS IN DISTRIBUTED ASYNCHRONOUS SYSTEMS
US20190108083A1 (en) * 2017-10-10 2019-04-11 Fujitsu Limited Information processing system and cluster system construction method
US10318397B2 (en) 2013-04-15 2019-06-11 Vmware, Inc. Efficient data pattern matching
US10333962B1 (en) * 2016-03-30 2019-06-25 Amazon Technologies, Inc. Correlating threat information across sources of distributed computing systems
CN110189039A (zh) * 2019-06-04 2019-08-30 湖南智慧畅行交通科技有限公司 基于分布式的充电桩事件处理引擎
US20190303874A1 (en) * 2018-03-30 2019-10-03 Microsoft Technology Licensing, Llc Determining metrics for electronic communications to improve engagement
CN110636095A (zh) * 2018-06-25 2019-12-31 北京京东尚科信息技术有限公司 设备管控系统及其工作方法
CN110795322A (zh) * 2019-10-28 2020-02-14 深圳前海环融联易信息科技服务有限公司 服务监控方法、装置、计算机设备及存储介质
US10664457B2 (en) 2015-09-30 2020-05-26 Bank Of America Corporation System for real-time data structuring and storage
CN111508214A (zh) * 2020-04-22 2020-08-07 杭州电子科技大学 报警控制方法及控制设备
US20200257989A1 (en) * 2019-02-11 2020-08-13 Beijing Baidu Netcom Science And Technology Co., Ltd. Method and apparatus for managing knowledge base, device and medium
US10755344B2 (en) 2015-09-30 2020-08-25 Bank Of America Corporation System framework processor for channel contacts
US10796229B1 (en) * 2016-02-01 2020-10-06 InsideView Technologies, Inc. Building an interactive knowledge list for business ontologies
US10817544B2 (en) 2015-04-20 2020-10-27 Splunk Inc. Scaling available storage based on counting generated events
US10887130B2 (en) 2017-06-15 2021-01-05 At&T Intellectual Property I, L.P. Dynamic intelligent analytics VPN instantiation and/or aggregation employing secured access to the cloud network device
US10977285B2 (en) 2012-03-28 2021-04-13 Verizon Media Inc. Using observations of a person to determine if data corresponds to the person
US11075982B2 (en) 2017-07-10 2021-07-27 Nokia Solutions And Networks Oy Scaling hosts in distributed event handling systems
US20210264333A1 (en) * 2020-02-24 2021-08-26 International Business Machines Corporation Providing customized integration flow templates
US20210312392A1 (en) * 2020-04-01 2021-10-07 Vmware, Inc. Namespace Management Techniques for Facilitating Multi-Cluster Application Development
US20210314362A1 (en) * 2020-04-06 2021-10-07 Exonym GmbH Cross-service rulebook management in a dynamic and adversarial environment
US20220027387A1 (en) * 2020-07-27 2022-01-27 S&P Global Automated event processing system
US11385608B2 (en) * 2013-03-04 2022-07-12 Fisher-Rosemount Systems, Inc. Big data in process control systems
US11393036B2 (en) 2019-10-11 2022-07-19 S&P Global Inc. Deep learning-based two-phase clustering algorithm
US11438390B2 (en) * 2016-12-30 2022-09-06 Motorola Mobility Llc Automatic call forwarding during system updates
US11620166B2 (en) 2020-04-14 2023-04-04 Vmware, Inc. Communications framework for multi-cluster management systems
US11726982B1 (en) * 2021-09-30 2023-08-15 Amazon Technologies, Inc. Continuous execution engine algorithm
US11727330B2 (en) * 2016-10-10 2023-08-15 Cch Australia Limited Systems and methods for efficiently distributing alert messages
US11797352B2 (en) 2020-04-14 2023-10-24 Vmware, Inc. SAAS infrastructure for flexible multi-tenancy
US11886155B2 (en) 2015-10-09 2024-01-30 Fisher-Rosemount Systems, Inc. Distributed industrial performance monitoring and analytics
US20240061729A1 (en) * 2022-08-19 2024-02-22 Sap Se Multitenancy cross-tenant collaboration driven by event proxy
US11934410B2 (en) * 2014-12-19 2024-03-19 Conduent Business Services, Llc Computer-implemented system and method for generating recurring events
US11936664B2 (en) * 2020-03-14 2024-03-19 Microsoft Technology Licensing, Llc Identity attack detection and blocking

Families Citing this family (68)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8448186B2 (en) * 2007-07-13 2013-05-21 Oracle International Corporation Parallel event processing in a database system
US9756004B2 (en) 2007-11-08 2017-09-05 Skype Message delivery system and method
US8086905B2 (en) 2008-05-27 2011-12-27 Hitachi, Ltd. Method of collecting information in system network
US8538981B2 (en) * 2008-11-20 2013-09-17 Sap Ag Stream sharing for event data within an enterprise network
US8589502B2 (en) * 2008-12-31 2013-11-19 International Business Machines Corporation System and method for allowing access to content
US8386573B2 (en) * 2008-12-31 2013-02-26 International Business Machines Corporation System and method for caching linked email data for offline use
US8886586B2 (en) * 2009-05-24 2014-11-11 Pi-Coral, Inc. Method for making optimal selections based on multiple objective and subjective criteria
US8886804B2 (en) * 2009-05-26 2014-11-11 Pi-Coral, Inc. Method for making intelligent data placement decisions in a computer network
US9209992B2 (en) * 2009-12-28 2015-12-08 International Business Machines Corporation Method, data processing program, and computer program product for handling instant messaging sessions and corresponding instant messaging environment
US8949210B2 (en) 2010-05-13 2015-02-03 Microsoft Corporation Analysis stack for complex event flows
US8918467B2 (en) 2010-10-01 2014-12-23 Clover Leaf Environmental Solutions, Inc. Generation and retrieval of report information
US8380845B2 (en) 2010-10-08 2013-02-19 Microsoft Corporation Providing a monitoring service in a cloud-based computing environment
US8843632B2 (en) 2010-10-11 2014-09-23 Microsoft Corporation Allocation of resources between web services in a composite service
US8959219B2 (en) 2010-10-18 2015-02-17 Microsoft Technology Licensing, Llc Dynamic rerouting of service requests between service endpoints for web services in a composite service
US20120102484A1 (en) * 2010-10-20 2012-04-26 Microsoft Corporation Installing software remotely using a high privilege process
US8874787B2 (en) 2010-10-20 2014-10-28 Microsoft Corporation Optimized consumption of third-party web services in a composite service
US8510426B2 (en) * 2010-10-20 2013-08-13 Microsoft Corporation Communication and coordination between web services in a cloud-based computing environment
US8886766B2 (en) 2010-10-25 2014-11-11 Salesforce.Com, Inc. Systems and methods for tracking responses on an online social network
US9183045B2 (en) 2010-12-21 2015-11-10 Mo-Dv, Inc. System and method for data collection and exchange with protected memory devices
US8615773B2 (en) * 2011-03-31 2013-12-24 Honeywell International Inc. Systems and methods for coordinating computing functions to accomplish a task using a configuration file and standardized executable application modules
US9372739B2 (en) 2011-04-20 2016-06-21 International Business Machines Corporation Monitoring of subscriber message processing in a publish/subscribe messaging environment
US20120311562A1 (en) * 2011-06-01 2012-12-06 Yanlin Wang Extendable event processing
US20120317500A1 (en) * 2011-06-07 2012-12-13 At&T Intellectual Property I, L.P. System and method for data visualization and user collaboration
US9870296B1 (en) * 2011-06-17 2018-01-16 Mark A. Parenti Evaluating system performance
GB2497793A (en) * 2011-12-21 2013-06-26 Ninian Solutions Ltd Pre-emptive caching of potentially relevant content from a collaborative workspace at a client device
US9020973B2 (en) * 2011-12-27 2015-04-28 Sap Se User interface model driven data access control
US9195631B1 (en) * 2012-03-26 2015-11-24 Emc Corporation Providing historical data to an event-based analysis engine
US9354762B1 (en) 2012-06-26 2016-05-31 Emc International Company Simplifying rules generation for an event-based analysis engine by allowing a user to combine related objects in a rule
US9430125B1 (en) 2012-06-27 2016-08-30 Emc International Company Simplifying rules generation for an event-based analysis engine
US8949168B1 (en) 2012-06-27 2015-02-03 Emc International Company Managing a memory of an event-based analysis engine
US9015721B2 (en) 2012-07-30 2015-04-21 Hewlett-Packard Development Company, L. P. Managing array computations during programmatic run-time in a distributed computing environment
US9135093B2 (en) * 2012-08-31 2015-09-15 Sap Se Event-driven approach for collecting monitoring data of messaging systems
FR3000341A1 (fr) * 2012-12-21 2014-06-27 France Telecom Systeme de traitement de donnees dans un environnement ubiquitaire
EP2746932B1 (de) * 2012-12-21 2020-04-08 BlackBerry Limited Verfahren, System und Vorrichtung zur Bereitstellung von Benachrichtigungen für unterschiedliche Arbeitsplätze
US9098804B1 (en) 2012-12-27 2015-08-04 Emc International Company Using data aggregation to manage a memory for an event-based analysis engine
US9898339B2 (en) * 2013-03-12 2018-02-20 Itron, Inc. Meter reading data validation
US20140280157A1 (en) * 2013-03-13 2014-09-18 Aeris Communications, Inc. Management of data feeds from devices and publishing and consumption of data
US20220225079A1 (en) * 2013-03-13 2022-07-14 Aeris Communications, Inc. METHOD AND SYSTEM FOR COLLECTION AND TRANSFORMATION OF DEVICE DATA FROM IoT DEVICES FOR CONSUMPTION BY DIFFERENT ENTITIES
CN105659242A (zh) 2013-09-23 2016-06-08 慧与发展有限责任合伙企业 工作流和用户证书
US10089362B2 (en) 2014-08-13 2018-10-02 Software Ag Systems and/or methods for investigating event streams in complex event processing (CEP) applications
US10387263B2 (en) 2014-12-31 2019-08-20 Netapp, Inc. Centralized management center for managing storage services
KR102336033B1 (ko) * 2015-04-22 2021-12-08 에스케이하이닉스 주식회사 매립금속게이트구조를 구비한 반도체장치 및 그 제조 방법, 그를 구비한 메모리셀, 그를 구비한 전자장치
US11468053B2 (en) 2015-12-30 2022-10-11 Dropbox, Inc. Servicing queries of a hybrid event index
US10546257B2 (en) * 2016-05-09 2020-01-28 International Business Machines Corporation Optimizing event aggregation in an event-driven system
US10755553B2 (en) 2016-06-30 2020-08-25 Carrier Corporation Collaborative alarm monitoring system and method
US10191930B2 (en) * 2016-08-12 2019-01-29 Sap Se Priority queuing for updates in a database system
US11232516B1 (en) * 2017-02-22 2022-01-25 United Services Automobile Association (Usaa) Systems and methods for generating account forecast alerts
US10558533B2 (en) 2017-12-07 2020-02-11 Red Hat, Inc. Reducing service disruptions in a micro-service environment
WO2019186231A1 (en) * 2018-03-27 2019-10-03 Pratik Sharma Events manager for a machine
US11609934B2 (en) * 2018-04-24 2023-03-21 Sap Se Notification framework for document store
CN109299136B (zh) * 2018-11-27 2021-11-09 佛山科学技术学院 一种智能制造的数据库资源池的实时同步方法及装置
US10938743B1 (en) 2019-10-31 2021-03-02 Dell Products, L.P. Systems and methods for continuous evaluation of workspace definitions using endpoint context
US11316902B2 (en) * 2019-10-31 2022-04-26 Dell Products, L.P. Systems and methods for securing a dynamic workspace in an enterprise productivity ecosystem
US11657126B2 (en) 2019-10-31 2023-05-23 Dell Products, L.P. Systems and methods for dynamic workspace targeting with crowdsourced user context
US11240109B2 (en) 2019-10-31 2022-02-01 Dell Products, L.P. Systems and methods for workspace continuity and remediation
US11487881B2 (en) 2019-10-31 2022-11-01 Dell Products, L.P. Systems and methods for endpoint context-driven, dynamic workspaces
US11475126B2 (en) * 2019-10-31 2022-10-18 Dell Products, L.P. Systems and methods for modernizing workspace and hardware lifecycle management in an enterprise productivity ecosystem
US11334675B2 (en) 2019-10-31 2022-05-17 Dell Products, L.P. Systems and methods for supporting secure transfer of data between workspaces
US10855619B1 (en) 2019-10-31 2020-12-01 Dell Products, L.P. Systems and methods for dynamic adjustment of workspaces based on available local hardware
US11336655B2 (en) 2019-10-31 2022-05-17 Dell Products, L.P. Multilevel authorization of workspaces using certificates
US11727283B2 (en) * 2020-05-19 2023-08-15 International Business Machines Corporation Rule distribution across instances of rules engine
US11928498B2 (en) * 2021-03-23 2024-03-12 Dell Products, L.P. Workspace migration system and method of using the same
KR20220170151A (ko) * 2021-06-22 2022-12-29 현대자동차주식회사 차량 내부 네트워크에 대한 침입 대응 방법 및 장치
US11722451B2 (en) * 2021-12-07 2023-08-08 Dell Products L.P. Distributing event messages from a first service to additional services using a message store
US20230222200A1 (en) * 2022-01-12 2023-07-13 Dell Products, L.P. Systems and methods for transfer of workspace orchestration
US20230229461A1 (en) * 2022-01-14 2023-07-20 Rakuten Mobile, Inc. Correlation engine and policy manager (cpe), method and computer program product
US11994409B2 (en) * 2022-03-07 2024-05-28 The Boeing Company Enriched aviation information notice
FI130612B (en) * 2022-06-09 2023-12-13 Modirum Security Tech Oy Creation of task-specific analytics data

Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5870605A (en) * 1996-01-18 1999-02-09 Sun Microsystems, Inc. Middleware for enterprise information distribution
US6353851B1 (en) * 1998-12-28 2002-03-05 Lucent Technologies Inc. Method and apparatus for sharing asymmetric information and services in simultaneously viewed documents on a communication system
US6490574B1 (en) * 1997-12-17 2002-12-03 International Business Machines Corporation Method and system for managing rules and events in a multi-user intelligent agent environment
US6564246B1 (en) * 1999-02-02 2003-05-13 International Business Machines Corporation Shared and independent views of shared workspace for real-time collaboration
US20040204906A1 (en) * 2003-03-31 2004-10-14 Diane Lambert Method and apparatus for event monitoring in an information processing system
US20040250261A1 (en) * 2003-06-05 2004-12-09 Huibregtse Thomas P. Method and system for displaying event information correlated with a performance parameter of a managed system
US7020869B2 (en) * 2000-12-01 2006-03-28 Corticon Technologies, Inc. Business rules user interface for development of adaptable enterprise applications
US20060150022A1 (en) * 2004-11-19 2006-07-06 Omar Malik Event analysis system, method and software
US7290278B2 (en) * 2003-10-02 2007-10-30 Aol Llc, A Delaware Limited Liability Company Identity based service system

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6289385B1 (en) * 1998-06-05 2001-09-11 I2 Technologies, Inc. Computer workspace providing event management based on a permissibility framework
US6941465B1 (en) 1999-07-26 2005-09-06 Microsoft Corporation Method of enforcing a policy on a computer network
US6922685B2 (en) * 2000-05-22 2005-07-26 Mci, Inc. Method and system for managing partitioned data resources
US7634726B2 (en) 2001-01-05 2009-12-15 International Business Machines Corporation Technique for automated e-business services
US20030154090A1 (en) * 2001-08-08 2003-08-14 Bernstein Steve L. Dynamically generating and delivering information in response to the occurrence of an event
US7027463B2 (en) * 2003-07-11 2006-04-11 Sonolink Communications Systems, Llc System and method for multi-tiered rule filtering
JP2007510198A (ja) * 2003-10-08 2007-04-19 ユニシス コーポレーション ホストシステムのパーティション内に実装されているハイパーバイザを使用したコンピュータシステムの準仮想化
SG119242A1 (en) * 2004-07-30 2006-02-28 Third Sight Pte Ltd Method of populating a collaborative workspace anda system for providing the same
US7634539B2 (en) * 2004-08-02 2009-12-15 Sap Ag Relations between collaboration workspaces

Patent Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5870605A (en) * 1996-01-18 1999-02-09 Sun Microsystems, Inc. Middleware for enterprise information distribution
US6490574B1 (en) * 1997-12-17 2002-12-03 International Business Machines Corporation Method and system for managing rules and events in a multi-user intelligent agent environment
US6353851B1 (en) * 1998-12-28 2002-03-05 Lucent Technologies Inc. Method and apparatus for sharing asymmetric information and services in simultaneously viewed documents on a communication system
US6564246B1 (en) * 1999-02-02 2003-05-13 International Business Machines Corporation Shared and independent views of shared workspace for real-time collaboration
US7020869B2 (en) * 2000-12-01 2006-03-28 Corticon Technologies, Inc. Business rules user interface for development of adaptable enterprise applications
US20040204906A1 (en) * 2003-03-31 2004-10-14 Diane Lambert Method and apparatus for event monitoring in an information processing system
US20040250261A1 (en) * 2003-06-05 2004-12-09 Huibregtse Thomas P. Method and system for displaying event information correlated with a performance parameter of a managed system
US7290278B2 (en) * 2003-10-02 2007-10-30 Aol Llc, A Delaware Limited Liability Company Identity based service system
US20060150022A1 (en) * 2004-11-19 2006-07-06 Omar Malik Event analysis system, method and software

Cited By (239)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060074714A1 (en) * 2004-10-01 2006-04-06 Microsoft Corporation Workflow tracking based on profiles
US20060190433A1 (en) * 2005-02-23 2006-08-24 Microsoft Corporation Distributed navigation business activities data
US20060241959A1 (en) * 2005-04-26 2006-10-26 Microsoft Corporation Business alerts on process instances based on defined conditions
US7774359B2 (en) 2005-04-26 2010-08-10 Microsoft Corporation Business alerts on process instances based on defined conditions
US20060294197A1 (en) * 2005-06-28 2006-12-28 Microsoft Corporation Schematization of establishing relationships between applications
US7693861B2 (en) 2005-06-28 2010-04-06 Microsoft Corporation Schematization of establishing relationships between applications
US8775482B2 (en) 2007-07-18 2014-07-08 Microsoft Corporation Implementation of stream algebra over class instances
US20100131543A1 (en) * 2007-07-18 2010-05-27 Microsoft Corporation Implementation of stream algebra over class instances
US7676461B2 (en) * 2007-07-18 2010-03-09 Microsoft Corporation Implementation of stream algebra over class instances
US8296331B2 (en) * 2007-07-18 2012-10-23 Microsoft Corporation Implementation of stream algebra over class instances
US20090024622A1 (en) * 2007-07-18 2009-01-22 Microsoft Corporation Implementation of stream algebra over class instances
US10623510B2 (en) 2007-07-25 2020-04-14 Oath Inc. Display of person based information including person notes
US9591086B2 (en) 2007-07-25 2017-03-07 Yahoo! Inc. Display of information in electronic communications
US9058366B2 (en) 2007-07-25 2015-06-16 Yahoo! Inc. Indexing and searching content behind links presented in a communication
US10069924B2 (en) 2007-07-25 2018-09-04 Oath Inc. Application programming interfaces for communication systems
US10356193B2 (en) 2007-07-25 2019-07-16 Oath Inc. Indexing and searching content behind links presented in a communication
US10554769B2 (en) 2007-07-25 2020-02-04 Oath Inc. Method and system for collecting and presenting historical communication data for a mobile device
US9954963B2 (en) 2007-07-25 2018-04-24 Oath Inc. Indexing and searching content behind links presented in a communication
US11552916B2 (en) 2007-07-25 2023-01-10 Verizon Patent And Licensing Inc. Indexing and searching content behind links presented in a communication
US9596308B2 (en) 2007-07-25 2017-03-14 Yahoo! Inc. Display of person based information including person notes
US10958741B2 (en) 2007-07-25 2021-03-23 Verizon Media Inc. Method and system for collecting and presenting historical communication data
US9716764B2 (en) 2007-07-25 2017-07-25 Yahoo! Inc. Display of communication system usage statistics
US9699258B2 (en) 2007-07-25 2017-07-04 Yahoo! Inc. Method and system for collecting and presenting historical communication data for a mobile device
US9298783B2 (en) 2007-07-25 2016-03-29 Yahoo! Inc. Display of attachment based information within a messaging system
US11394679B2 (en) 2007-07-25 2022-07-19 Verizon Patent And Licensing Inc Display of communication system usage statistics
US9275118B2 (en) 2007-07-25 2016-03-01 Yahoo! Inc. Method and system for collecting and presenting historical communication data
US20090055409A1 (en) * 2007-08-21 2009-02-26 International Business Machines Corporation Apparatus, system, and method for customized event processing using a jdbc resource adapter
US9584343B2 (en) 2008-01-03 2017-02-28 Yahoo! Inc. Presentation of organized personal and public data using communication mediums
US10200321B2 (en) 2008-01-03 2019-02-05 Oath Inc. Presentation of organized personal and public data using communication mediums
US7962650B2 (en) * 2008-04-10 2011-06-14 International Business Machines Corporation Dynamic component placement in an event-driven component-oriented network data processing system
US20090259769A1 (en) * 2008-04-10 2009-10-15 International Business Machines Corporation Dynamic Component Placement in an Event-Driven Component-Oriented Network Data Processing System
US8489476B1 (en) * 2008-06-30 2013-07-16 United States Automobile Association (USAA) Data manager for suspicious activity monitor
US8620965B2 (en) * 2008-08-28 2013-12-31 Red Hat, Inc. Dynamic configuration of services using a syndication feed
US20100057680A1 (en) * 2008-08-28 2010-03-04 Mark Cameron Little Dynamic configuration of services using a syndication feed
US8805875B1 (en) * 2008-10-04 2014-08-12 Reflex Systems Llc Systems and methods for information retrieval
US9229986B2 (en) 2008-10-07 2016-01-05 Microsoft Technology Licensing, Llc Recursive processing in streaming queries
US8627328B2 (en) * 2008-11-14 2014-01-07 Oracle International Corporation Operation control for deploying and managing software service in a virtual environment
US8832710B2 (en) * 2008-11-14 2014-09-09 Oracle International Corporation Operation control for deploying and managing software service in a virtual environment
US20100125477A1 (en) * 2008-11-14 2010-05-20 Oracle International Corporation Operation control for deploying and managing software service in a virtual environment
US20100151885A1 (en) * 2008-12-17 2010-06-17 Avaya Inc. Location Privacy Enforcement in a Location-Based Services Platform
US8855665B2 (en) 2008-12-17 2014-10-07 Avaya Inc. Location privacy enforcement in a location-based services platform
US20100198903A1 (en) * 2009-01-31 2010-08-05 Brady Corey E Network-supported experiment data collection in an instructional setting
US9275126B2 (en) 2009-06-02 2016-03-01 Yahoo! Inc. Self populating address book
US10963524B2 (en) 2009-06-02 2021-03-30 Verizon Media Inc. Self populating address book
US20100318588A1 (en) * 2009-06-12 2010-12-16 Avaya Inc. Spatial-Temporal Event Correlation for Location-Based Services
US8990323B2 (en) 2009-07-08 2015-03-24 Yahoo! Inc. Defining a social network model implied by communications data
US9819765B2 (en) 2009-07-08 2017-11-14 Yahoo Holdings, Inc. Systems and methods to provide assistance during user input
US11755995B2 (en) 2009-07-08 2023-09-12 Yahoo Assets Llc Locally hosting a social network using social data stored on a user's computer
US9721228B2 (en) 2009-07-08 2017-08-01 Yahoo! Inc. Locally hosting a social network using social data stored on a user's computer
US9800679B2 (en) 2009-07-08 2017-10-24 Yahoo Holdings, Inc. Defining a social network model implied by communications data
US9159057B2 (en) 2009-07-08 2015-10-13 Yahoo! Inc. Sender-based ranking of person profiles and multi-person automatic suggestions
US8984074B2 (en) 2009-07-08 2015-03-17 Yahoo! Inc. Sender-based ranking of person profiles and multi-person automatic suggestions
US9081873B1 (en) 2009-10-05 2015-07-14 Stratacloud, Inc. Method and system for information retrieval in response to a query
US9087323B2 (en) 2009-10-14 2015-07-21 Yahoo! Inc. Systems and methods to automatically generate a signature block
US9158816B2 (en) 2009-10-21 2015-10-13 Microsoft Technology Licensing, Llc Event processing with XML query based on reusable XML query template
US9348868B2 (en) 2009-10-21 2016-05-24 Microsoft Technology Licensing, Llc Event processing with XML query based on reusable XML query template
US9058502B2 (en) * 2009-10-26 2015-06-16 Lionbridge Technologies, Inc. Methods and systems for providing anonymous and traceable external access to internal linguistic assets
US20120065958A1 (en) * 2009-10-26 2012-03-15 Joachim Schurig Methods and systems for providing anonymous and traceable external access to internal linguistic assets
US8832259B1 (en) * 2009-10-30 2014-09-09 Hewlett-Packard Development Company, L.P. Virtual service mode methods for network remote monitoring and managing system
US8910083B2 (en) 2009-11-10 2014-12-09 Blackberry Limited Multi-source picture viewer for portable electronic device
US20110113379A1 (en) * 2009-11-10 2011-05-12 Research In Motion Limited Multi-source picture viewer for portable electronic device
US8738620B2 (en) 2009-11-12 2014-05-27 Salesforce.Com, Inc. Implementing enterprise level business information networking
US9275094B2 (en) 2009-11-12 2016-03-01 Salesforce.Com, Inc. Security in enterprise level business information networking
US8478722B2 (en) 2009-11-12 2013-07-02 Salesforce.Com, Inc. Enterprise level business information networking for changes in a database
US20110113058A1 (en) * 2009-11-12 2011-05-12 salesforce.com,inc. Implementing enterprise level business information networking
US20110113059A1 (en) * 2009-11-12 2011-05-12 Salesforce.Com, Inc. Security in enterprise level business information networking
WO2011060306A2 (en) * 2009-11-12 2011-05-19 Salesforce.Com, Inc. Enterprise level business information networking for changes in a database
US8560575B2 (en) 2009-11-12 2013-10-15 Salesforce.Com, Inc. Methods and apparatus for selecting updates to associated records to publish on an information feed in an on-demand database service environment
US9864770B2 (en) 2009-11-12 2018-01-09 Salesforce.Com, Inc. Customizing enterprise level business information networking
WO2011060306A3 (en) * 2009-11-12 2012-01-12 Salesforce.Com, Inc. Enterprise level business information networking for changes in a database
US10768787B2 (en) 2009-11-16 2020-09-08 Oath Inc. Collecting and presenting data including links from communications sent to or from a user
US9514466B2 (en) 2009-11-16 2016-12-06 Yahoo! Inc. Collecting and presenting data including links from communications sent to or from a user
US9760866B2 (en) * 2009-12-15 2017-09-12 Yahoo Holdings, Inc. Systems and methods to provide server side profile information
US20110145192A1 (en) * 2009-12-15 2011-06-16 Xobni Corporation Systems and Methods to Provide Server Side Profile Information
US11037106B2 (en) 2009-12-15 2021-06-15 Verizon Media Inc. Systems and methods to provide server side profile information
US20140095433A1 (en) * 2010-02-03 2014-04-03 Yahoo! Inc. Providing profile information using servers
US20110191337A1 (en) * 2010-02-03 2011-08-04 Xobni Corporation Providing User Input Suggestions for Conflicting Data Using Rank Determinations
US9842144B2 (en) 2010-02-03 2017-12-12 Yahoo Holdings, Inc. Presenting suggestions for user input based on client device characteristics
US8924956B2 (en) 2010-02-03 2014-12-30 Yahoo! Inc. Systems and methods to identify users using an automated learning process
US8423545B2 (en) 2010-02-03 2013-04-16 Xobni Corporation Providing user input suggestions for conflicting data using rank determinations
US9020938B2 (en) 2010-02-03 2015-04-28 Yahoo! Inc. Providing profile information using servers
US9842145B2 (en) * 2010-02-03 2017-12-12 Yahoo Holdings, Inc. Providing profile information using servers
US8793691B2 (en) * 2010-04-15 2014-07-29 Salesforce.Com, Inc. Managing and forwarding tasks to handler for processing using a message queue
US20110258628A1 (en) * 2010-04-15 2011-10-20 Salesforce.Com, Inc. System, method and computer program product for transporting a task to a handler, utilizing a queue
US9154605B2 (en) 2010-04-23 2015-10-06 Blackberry Limited Method and apparatus for posting data to a plurality of accounts
EP2383666A3 (de) * 2010-04-23 2012-01-18 Research In Motion Limited Verfahren und Vorrichtung für den Empfang von Daten aus mehreren Versorgungsquellen
US8880624B2 (en) 2010-04-23 2014-11-04 Blackberry Limited Method and apparatus for receiving data from a plurality of feed sources
US8982053B2 (en) 2010-05-27 2015-03-17 Yahoo! Inc. Presenting a new user screen in response to detection of a user motion
US9594832B2 (en) 2010-06-02 2017-03-14 Yahoo! Inc. Personalizing an online service based on data collected for a user of a computing device
US9501561B2 (en) 2010-06-02 2016-11-22 Yahoo! Inc. Personalizing an online service based on data collected for a user of a computing device
US9569529B2 (en) 2010-06-02 2017-02-14 Yahoo! Inc. Personalizing an online service based on data collected for a user of a computing device
US9685158B2 (en) 2010-06-02 2017-06-20 Yahoo! Inc. Systems and methods to present voice message information to a user of a computing device
US10685072B2 (en) 2010-06-02 2020-06-16 Oath Inc. Personalizing an online service based on data collected for a user of a computing device
US20120005542A1 (en) * 2010-07-01 2012-01-05 LogRhythm Inc. Log collection, structuring and processing
US9384112B2 (en) * 2010-07-01 2016-07-05 Logrhythm, Inc. Log collection, structuring and processing
US10122575B2 (en) 2010-07-01 2018-11-06 LogRhythm Inc. Log collection, structuring and processing
US9107565B2 (en) * 2010-08-16 2015-08-18 Fujitsu Limited Identifying an event occurrence from sensor data streams
US20120042326A1 (en) * 2010-08-16 2012-02-16 Fujitsu Limited Identifying An Event Occurrence From Sensor Data Streams
US8892573B2 (en) 2010-09-23 2014-11-18 Salesforce.Com, Inc. Methods and apparatus for selecting updates to associated records to publish on an information feed in an on-demand database service environment
US8560554B2 (en) 2010-09-23 2013-10-15 Salesforce.Com, Inc. Methods and apparatus for selecting updates to associated records to publish on an information feed using importance weights in an on-demand database service environment
US20120089572A1 (en) * 2010-10-06 2012-04-12 International Business Machines Corporation Automated and self-adjusting data protection driven by business and data activity events
TWI505092B (zh) * 2010-10-06 2015-10-21 Ibm 由商業及資料活動事件驅動之自動及自我調整之資料保護之方法
US9632875B2 (en) * 2010-10-06 2017-04-25 International Business Machines Corporation Automated and self-adjusting data protection driven by business and data activity events
US20120271921A1 (en) * 2010-10-15 2012-10-25 Telefonaktiebolaget L M Ericsson (Publ) Arrangement and Method for Providing Data to a User
WO2012054309A1 (en) * 2010-10-20 2012-04-26 Salesforce.Com, Inc. Framework for custom actions on an information feed
US10528370B2 (en) 2010-10-20 2020-01-07 Salesforce.Com.Inc. Framework for custom actions on an information feed
US11372660B2 (en) 2010-10-20 2022-06-28 Salesforce.Com, Inc. Framework for custom actions on an information feed
US9304614B2 (en) * 2010-10-20 2016-04-05 Salesforce.Com, Inc. Framework for custom actions on an information feed
US20120102402A1 (en) * 2010-10-20 2012-04-26 Salesforce.Com, Inc. Framework for Custom Actions on an Information Feed
US9411855B2 (en) 2010-10-25 2016-08-09 Salesforce.Com, Inc. Triggering actions in an information feed system
US9383831B1 (en) 2010-12-23 2016-07-05 Amazon Technologies, Inc. Powered augmented reality projection accessory display device
US9766057B1 (en) 2010-12-23 2017-09-19 Amazon Technologies, Inc. Characterization of a scene with structured light
US10031335B1 (en) 2010-12-23 2018-07-24 Amazon Technologies, Inc. Unpowered augmented reality projection accessory display device
US9721386B1 (en) * 2010-12-27 2017-08-01 Amazon Technologies, Inc. Integrated augmented reality environment
US9508194B1 (en) 2010-12-30 2016-11-29 Amazon Technologies, Inc. Utilizing content output devices in an augmented reality environment
US9607315B1 (en) 2010-12-30 2017-03-28 Amazon Technologies, Inc. Complementing operation of display devices in an augmented reality environment
US10714091B2 (en) 2011-06-21 2020-07-14 Oath Inc. Systems and methods to present voice message information to a user of a computing device
US10078819B2 (en) 2011-06-21 2018-09-18 Oath Inc. Presenting favorite contacts information to a user of a computing device
US10089986B2 (en) 2011-06-21 2018-10-02 Oath Inc. Systems and methods to present voice message information to a user of a computing device
US11232409B2 (en) 2011-06-30 2022-01-25 Verizon Media Inc. Presenting entity profile information to a user of a computing device
US9747583B2 (en) 2011-06-30 2017-08-29 Yahoo Holdings, Inc. Presenting entity profile information to a user of a computing device
US9355110B1 (en) * 2011-07-14 2016-05-31 Google Inc. Dynamic presentation of data items based on prioritized associations
US9443225B2 (en) 2011-07-18 2016-09-13 Salesforce.Com, Inc. Computer implemented methods and apparatus for presentation of feed items in an information feed to be displayed on a display device
US9589070B2 (en) 2011-10-10 2017-03-07 Salesforce.Com, Inc. Method and system for updating a filter logic expression representing a boolean filter
GB2512514A (en) * 2011-11-04 2014-10-01 Ipc Systems Inc User interface displaying filtered information
US11275745B2 (en) * 2011-11-04 2022-03-15 Ipc Systems, Inc. User interface displaying filtered information
US9805094B2 (en) 2011-11-04 2017-10-31 Ipc Systems, Inc. User interface displaying filtered information
US10719518B2 (en) 2011-11-04 2020-07-21 Ipc Systems, Inc. User interface displaying filtered information
WO2013066651A1 (en) * 2011-11-04 2013-05-10 Ipc Systems, Inc. User interface displaying filtered information
WO2013071305A3 (en) * 2011-11-10 2015-06-18 Inventime Usa, Inc. Systems and methods for manipulating data using natural language commands
US20130159926A1 (en) * 2011-12-20 2013-06-20 Sap Portals Israel Ltd Annotating Contextual Workspaces
US9164990B2 (en) * 2011-12-20 2015-10-20 Sap Portals Israel Ltd Annotating contextual workspaces
US20130173337A1 (en) * 2011-12-30 2013-07-04 Verizon Patent And Licensing Inc. Lifestyle application for enterprises
US10977285B2 (en) 2012-03-28 2021-04-13 Verizon Media Inc. Using observations of a person to determine if data corresponds to the person
US10152606B2 (en) 2012-04-04 2018-12-11 Varonis Systems, Inc. Enterprise level data element review systems and methodologies
US10181046B2 (en) * 2012-04-04 2019-01-15 Varonis Systems, Inc. Enterprise level data element review systems and methodologies
US9678789B2 (en) 2012-04-13 2017-06-13 Theplatform, Llc Methods and systems for prioritizing events using time and availability
US20170364385A1 (en) * 2012-04-13 2017-12-21 Theplatform, Llc Methods And Systems For Queuing Events
US20130275987A1 (en) * 2012-04-13 2013-10-17 Theplatform For Media, Inc. Methods and systems for queuing events
US8904451B2 (en) * 2012-04-13 2014-12-02 Theplatform, Llc Systems for prioritizing video processing events based on availability of media file and agent to process the event type
US20160140200A1 (en) * 2012-04-17 2016-05-19 Salesforce.Com, Inc. Dynamic integration of disparate database architectures for efficient management of resources in an on-demand services environment
US10127297B2 (en) * 2012-04-17 2018-11-13 Salesforce.Com, Inc. Dynamic integration of disparate database architectures for efficient management of resources in an on-demand services environment
US20130290385A1 (en) * 2012-04-30 2013-10-31 Charles B. Morrey, III Durably recording events for performing file system operations
US9916592B2 (en) 2012-05-18 2018-03-13 Oracle International Corporation Method and system for implementing implicit follow and automatic unfollow
US11062269B2 (en) 2012-06-21 2021-07-13 Open Text Corporation Activity stream based interaction
US11416824B2 (en) 2012-06-21 2022-08-16 Open Text Corporation Activity stream based interaction
US11252069B2 (en) 2012-06-21 2022-02-15 Open Text Corporation Activity stream based collaboration
US10447568B2 (en) 2012-06-21 2019-10-15 Open Text Corporation Activity stream based collaboration
US9935860B2 (en) 2012-06-21 2018-04-03 Open Text Corporation Activity stream based collaboration
US9715325B1 (en) * 2012-06-21 2017-07-25 Open Text Corporation Activity stream based interaction
US9692675B1 (en) 2012-06-21 2017-06-27 Open Text Corporation Activity stream based collaboration
US10510048B2 (en) 2012-06-21 2019-12-17 Open Text Corporation Activity stream based interaction
US20140040920A1 (en) * 2012-08-06 2014-02-06 Alcatel-Lucent Canada, Inc. Strategy based event notification chain
US9223640B2 (en) * 2012-08-06 2015-12-29 Alcatel Lucent Strategy based event notification chain
US11157875B2 (en) 2012-11-02 2021-10-26 Verizon Media Inc. Address extraction from a communication
US10013672B2 (en) 2012-11-02 2018-07-03 Oath Inc. Address extraction from a communication
US20140143018A1 (en) * 2012-11-21 2014-05-22 Verint Americas Inc. Predictive Modeling from Customer Interaction Analysis
US10192200B2 (en) 2012-12-04 2019-01-29 Oath Inc. Classifying a portion of user contact data into local contacts
US20140172668A1 (en) * 2012-12-17 2014-06-19 Salesforce.Com, Inc. System, method and computer program product for performing an action in response to an event
US11385608B2 (en) * 2013-03-04 2022-07-12 Fisher-Rosemount Systems, Inc. Big data in process control systems
US10318397B2 (en) 2013-04-15 2019-06-11 Vmware, Inc. Efficient data pattern matching
US9460074B2 (en) 2013-04-15 2016-10-04 Vmware, Inc. Efficient data pattern matching
US9244903B2 (en) * 2013-04-15 2016-01-26 Vmware, Inc. Efficient data pattern matching
US20140310225A1 (en) * 2013-04-15 2014-10-16 Vmware, Inc. Efficient data pattern matching
US10013318B2 (en) * 2013-04-16 2018-07-03 Entit Software Llc Distributed event correlation system
US20160034361A1 (en) * 2013-04-16 2016-02-04 Hewlett-Packard Development Company, L.P. Distributed event correlation system
US9628425B2 (en) * 2014-08-07 2017-04-18 International Business Machines Corporation Redirecting notifications to an alternative computing device and allowing subsequent SMS interactions to address the notifications via that alternative computing device
US20160043984A1 (en) * 2014-08-07 2016-02-11 International Business Machines Corporation Redirecting notifications to an alternative computing device and allowing subsequent sms interactions to address the notifications via that alternative computing device
US11934410B2 (en) * 2014-12-19 2024-03-19 Conduent Business Services, Llc Computer-implemented system and method for generating recurring events
US10282455B2 (en) * 2015-04-20 2019-05-07 Splunk Inc. Display of data ingestion information based on counting generated events
US10817544B2 (en) 2015-04-20 2020-10-27 Splunk Inc. Scaling available storage based on counting generated events
US20160307173A1 (en) * 2015-04-20 2016-10-20 Splunk Inc. Display of data ingestion information based on counting generated events
US11288283B2 (en) * 2015-04-20 2022-03-29 Splunk Inc. Identifying metrics related to data ingestion associated with a defined time period
US10193845B2 (en) 2015-05-13 2019-01-29 The Travelers Indemnity Company Predictive electronic message management systems and controllers
US20160337301A1 (en) * 2015-05-13 2016-11-17 The Travelers Indemnity Company Predictive electronic message management systems and controllers
US9906482B2 (en) * 2015-05-13 2018-02-27 The Travelers Indemnity Company Predictive electronic message management systems and controllers
US9860339B2 (en) 2015-06-23 2018-01-02 At&T Intellectual Property I, L.P. Determining a custom content delivery network via an intelligent software-defined network
US20170003857A1 (en) * 2015-06-30 2017-01-05 Bank Of America Corporation Automated device assistance
US10165056B2 (en) 2015-06-30 2018-12-25 Bank Of America Corporation Automated device assistance
US10121125B2 (en) 2015-06-30 2018-11-06 Bank Of America Corporation Automated device assistance
US10365805B2 (en) * 2015-06-30 2019-07-30 Bank Of America Corporation Automated device assistance
US10778782B2 (en) 2015-06-30 2020-09-15 Bank Of America Corporation Automated device assistance
US9747175B2 (en) 2015-09-30 2017-08-29 Bank Of America Corporation System for aggregation and transformation of real-time data
US20170093651A1 (en) * 2015-09-30 2017-03-30 Bank Of America Corporation Channel accessible single function micro service data collection process for light analytics
US10664457B2 (en) 2015-09-30 2020-05-26 Bank Of America Corporation System for real-time data structuring and storage
US10069891B2 (en) * 2015-09-30 2018-09-04 Bank Of America Corporation Channel accessible single function micro service data collection process for light analytics
US10755344B2 (en) 2015-09-30 2020-08-25 Bank Of America Corporation System framework processor for channel contacts
US11886155B2 (en) 2015-10-09 2024-01-30 Fisher-Rosemount Systems, Inc. Distributed industrial performance monitoring and analytics
US10404777B2 (en) * 2015-10-19 2019-09-03 Adobe Inc. Identifying sources of anomalies in multi-variable metrics using linearization
US20170111432A1 (en) * 2015-10-19 2017-04-20 Adobe Systems Incorporated Identifying sources of anomalies in multi-variable metrics using linearization
US10796229B1 (en) * 2016-02-01 2020-10-06 InsideView Technologies, Inc. Building an interactive knowledge list for business ontologies
US10838677B1 (en) 2016-03-28 2020-11-17 Amazon Technologies, Inc. Device-layout determinations
US9772812B1 (en) * 2016-03-28 2017-09-26 Amazon Technologies, Inc. Device-layout determinations
US10333962B1 (en) * 2016-03-30 2019-06-25 Amazon Technologies, Inc. Correlating threat information across sources of distributed computing systems
US10178119B1 (en) 2016-03-30 2019-01-08 Amazon Technologies, Inc. Correlating threat information across multiple levels of distributed computing systems
US10148675B1 (en) 2016-03-30 2018-12-04 Amazon Technologies, Inc. Block-level forensics for distributed computing systems
US11159554B2 (en) 2016-03-30 2021-10-26 Amazon Technologies, Inc. Correlating threat information across sources of distributed computing systems
US10613921B2 (en) 2016-04-26 2020-04-07 International Business Machines Corporation Predictive disaster recovery system
US9898359B2 (en) * 2016-04-26 2018-02-20 International Business Machines Corporation Predictive disaster recovery system
US20170308421A1 (en) * 2016-04-26 2017-10-26 International Business Machines Corporation Predictive disaster recovery system
US20180091528A1 (en) * 2016-09-26 2018-03-29 Splunk Inc. Configuring modular alert actions and reporting action performance information
US10771479B2 (en) * 2016-09-26 2020-09-08 Splunk Inc. Configuring modular alert actions and reporting action performance information
US11677760B2 (en) 2016-09-26 2023-06-13 Splunk Inc. Executing modular alerts and associated security actions
US11727330B2 (en) * 2016-10-10 2023-08-15 Cch Australia Limited Systems and methods for efficiently distributing alert messages
US20230359960A1 (en) * 2016-10-10 2023-11-09 Cch Australia Limited Systems and methods for efficiently distributing alert messages
US11438390B2 (en) * 2016-12-30 2022-09-06 Motorola Mobility Llc Automatic call forwarding during system updates
US11483177B2 (en) 2017-06-15 2022-10-25 At&T Intellectual Property I, L.P. Dynamic intelligent analytics VPN instantiation and/or aggregation employing secured access to the cloud network device
US10887130B2 (en) 2017-06-15 2021-01-05 At&T Intellectual Property I, L.P. Dynamic intelligent analytics VPN instantiation and/or aggregation employing secured access to the cloud network device
US20190012218A1 (en) * 2017-07-10 2019-01-10 Nokia Solutions And Networks Oy Event handling in distributed event handling systems
US11075982B2 (en) 2017-07-10 2021-07-27 Nokia Solutions And Networks Oy Scaling hosts in distributed event handling systems
US12073265B2 (en) * 2017-07-10 2024-08-27 Nokia Solutions And Networks Oy Event handling in distributed event handling systems
US11385944B2 (en) * 2017-07-10 2022-07-12 Nokia Solutions And Networks Oy Event handling in distributed event handling systems
US10644931B2 (en) 2017-09-15 2020-05-05 Walmart Apollo, Llc Event ordering framework in distributed asynchronous systems
WO2019055845A1 (en) * 2017-09-15 2019-03-21 Walmart Apollo, Llc FRAMEWORK FOR CONTROLLING EVENTS IN DISTRIBUTED ASYNCHRONOUS SYSTEMS
US20190089575A1 (en) * 2017-09-15 2019-03-21 Walmart Apollo, Llc Event Ordering Framework in Distributed Asynchronous Systems
US20190108083A1 (en) * 2017-10-10 2019-04-11 Fujitsu Limited Information processing system and cluster system construction method
US11003519B2 (en) * 2017-10-10 2021-05-11 Fujitsu Limited Information processing system, cluster system construction method, and non-transitory computer-readable storage medium for storing cluster construction program
US20190303874A1 (en) * 2018-03-30 2019-10-03 Microsoft Technology Licensing, Llc Determining metrics for electronic communications to improve engagement
CN110636095A (zh) * 2018-06-25 2019-12-31 北京京东尚科信息技术有限公司 设备管控系统及其工作方法
US20200257989A1 (en) * 2019-02-11 2020-08-13 Beijing Baidu Netcom Science And Technology Co., Ltd. Method and apparatus for managing knowledge base, device and medium
US11900269B2 (en) * 2019-02-11 2024-02-13 Beijing Baidu Netcom Science And Technology Co., Ltd. Method and apparatus for managing knowledge base, device and medium
CN110189039A (zh) * 2019-06-04 2019-08-30 湖南智慧畅行交通科技有限公司 基于分布式的充电桩事件处理引擎
US11430065B2 (en) 2019-10-11 2022-08-30 S&P Global Inc. Subscription-enabled news recommendation system
US11393036B2 (en) 2019-10-11 2022-07-19 S&P Global Inc. Deep learning-based two-phase clustering algorithm
CN110795322A (zh) * 2019-10-28 2020-02-14 深圳前海环融联易信息科技服务有限公司 服务监控方法、装置、计算机设备及存储介质
US11514381B2 (en) * 2020-02-24 2022-11-29 International Business Machines Corporation Providing customized integration flow templates
US20210264333A1 (en) * 2020-02-24 2021-08-26 International Business Machines Corporation Providing customized integration flow templates
US11936664B2 (en) * 2020-03-14 2024-03-19 Microsoft Technology Licensing, Llc Identity attack detection and blocking
US11907905B2 (en) * 2020-04-01 2024-02-20 VMware LLC Namespace management techniques for facilitating multi-cluster application development
US20210312392A1 (en) * 2020-04-01 2021-10-07 Vmware, Inc. Namespace Management Techniques for Facilitating Multi-Cluster Application Development
US20210314362A1 (en) * 2020-04-06 2021-10-07 Exonym GmbH Cross-service rulebook management in a dynamic and adversarial environment
US11824896B2 (en) * 2020-04-06 2023-11-21 Exonym GmbH Cross-service rulebook management in a dynamic and adversarial environment
US11797352B2 (en) 2020-04-14 2023-10-24 Vmware, Inc. SAAS infrastructure for flexible multi-tenancy
US11620166B2 (en) 2020-04-14 2023-04-04 Vmware, Inc. Communications framework for multi-cluster management systems
CN111508214A (zh) * 2020-04-22 2020-08-07 杭州电子科技大学 报警控制方法及控制设备
US11494416B2 (en) * 2020-07-27 2022-11-08 S&P Global Inc. Automated event processing system
US20220027387A1 (en) * 2020-07-27 2022-01-27 S&P Global Automated event processing system
US11726982B1 (en) * 2021-09-30 2023-08-15 Amazon Technologies, Inc. Continuous execution engine algorithm
US20240061729A1 (en) * 2022-08-19 2024-02-22 Sap Se Multitenancy cross-tenant collaboration driven by event proxy

Also Published As

Publication number Publication date
EP2168039A2 (de) 2010-03-31
WO2008148130A3 (en) 2009-02-12
CA2688509A1 (en) 2008-12-04
US20090048994A1 (en) 2009-02-19
US8453159B2 (en) 2013-05-28
EP2168039A4 (de) 2014-11-05
AU2008256623B2 (en) 2014-01-16
AU2008256623A1 (en) 2008-12-04
US20110167433A1 (en) 2011-07-07
CA2688509C (en) 2017-02-28
WO2008148130A2 (en) 2008-12-04

Similar Documents

Publication Publication Date Title
US8453159B2 (en) Workspace system and method for monitoring information events
US8707336B2 (en) Data event processing and application integration in a network
US20200272622A1 (en) Single click delta analysis
US11411804B1 (en) Actionable event responder
US7617190B2 (en) Data feeds for management systems
KR101161520B1 (ko) 알림 전달 아키텍처를 위한 방법 및 시스템
US20050138081A1 (en) Method and system for reducing information latency in a business enterprise
US6697810B2 (en) Security system for event monitoring, detection and notification system
US20150081701A1 (en) Systems and methods for data flow exploration
US20040162879A1 (en) Method, apparatus, and user interface for managing electronic mail and alert messages
US20020157017A1 (en) Event monitoring, detection and notification system having security functions
US20070011147A1 (en) Systems and methods for retrieving data
US20080046471A1 (en) Calendar Synchronization using Syndicated Data
US10754901B2 (en) Analytics of electronic content management systems using a staging area database
US11106330B2 (en) Self-serve content classification platform
US10986020B2 (en) Reconstructing message flows based on hash values
US11860858B1 (en) Decoding distributed ledger transaction records
US11704219B1 (en) Performance monitoring of distributed ledger nodes
CN113486095A (zh) 一种民航空管跨网安全数据交换管理平台

Legal Events

Date Code Title Description
AS Assignment

Owner name: AGENT LOGIC, INC., VIRGINIA

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:APPELBAUM, MICHAEL S.;GARVETT, JEFFREY H.;BRADLEY, CHRISTOPHER;AND OTHERS;REEL/FRAME:021809/0889;SIGNING DATES FROM 20081016 TO 20081022

AS Assignment

Owner name: INFORMATICA CORPORATION, CALIFORNIA

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:AGENT LOGIC, INC.;REEL/FRAME:023280/0316

Effective date: 20090924

STCB Information on status: application discontinuation

Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION