WO2020066785A1

WO2020066785A1 - Analysis device, terminal device, analysis system, analysis method and program

Info

Publication number: WO2020066785A1
Application number: PCT/JP2019/036536
Authority: WO
Inventors: 康博井原; 康弘長倉; 阿部　正道
Original assignee: 株式会社ラック
Priority date: 2018-09-26
Filing date: 2019-09-18
Publication date: 2020-04-02
Also published as: JP2020052688A; JP6517416B1

Abstract

This analysis device is provided with an acquisition unit which acquires target information relating to a first terminal device, an analysis execution unit which determines whether or not the aforementioned target information acquired by the acquisition unit satisfies a first condition, a notification unit which notifies the first terminal device of the first information if the target information was determined by the analysis execution unit to satisfy the first condition, an information receiving unit which receives second information from the first terminal device for the first information notified by the notification unit, and a notification suppression unit which, if the second information has been received from the first terminal device for the first information, suppresses the notification of first information to the first terminal device. For a prescribed period, the notification suppression unit stops notification, to the first terminal device of the first information, that is triggered by the first condition, and, after the aforementioned prescribed period has elapsed, restarts notification of the first information that is triggered by the first condition.

Description

Analysis device, terminal device, analysis system, analysis method, and program

The present invention relates to an analysis device, a terminal device, an analysis system, an analysis method, and a program.
This application claims priority based on Japanese Patent Application No. 2018-180914 for which it applied to Japan on September 26, 2018, and uses the content here.

For example, there is known an analysis system in which an analysis device analyzes security logs for organizations of a plurality of different customers.
In such an analysis system, a rule for detecting a characteristic of a malicious log is created and used as a rule used for automatic analysis of a security log. As such a rule, a rule common to a plurality of different customer organizations is often used.

However, according to such a common rule, for example, when the name of a non-malicious device in a specific organization coincides with the name of a malicious server, an error in the determination of the log of the specific organization (eg, For the sake of convenience, “false detection” may occur. In other words, erroneous detection that the device that is not malicious is determined to be malicious may occur.
In such a case, for example, it may be necessary to create a custom rule for the specific organization in which false detection occurs.

Patent Document 1 discloses a web access monitoring method in a computer system having a centralized management server for managing client computers in a private network (see Patent Document 1). In the web access monitoring method, the central management server sets a monitoring rule including a warning condition and a processing mode at the time of warning for web access that is unnecessary or unjust for business or education.

International Publication No. 2007/069338

However, when a false detection occurs in a specific organization among a plurality of different customer organizations, it may not be efficient to simply perform custom rules as in the past.

The embodiment of the present invention, in view of such circumstances, when an erroneous detection occurs in a specific organization of a plurality of different customer organizations, an analyzer that can efficiently deal with, a terminal device, An analysis system, an analysis method, and a program are provided.

One aspect of the present invention is an acquisition unit that acquires target information related to a first terminal device; an analysis execution unit that determines whether the target information acquired by the acquisition unit satisfies a first condition; When the execution unit determines that the target information satisfies the first condition, the notification unit that notifies the first terminal device of the first information, and the first information notified by the notification unit is An information receiving unit that receives the second information from the first terminal device, and, when the second information is received from the first terminal device with respect to the first information, the information receiving unit receives the second information from the first terminal device. A notification suppressing unit that suppresses notification, wherein the notification suppressing unit stops the notification of the first information according to the first condition for the first terminal device for a predetermined period, and the predetermined period has elapsed. Later the first Resuming the notification of the first information by the matter, an analytical instrument.
One aspect of the present invention is an acquisition unit that acquires target information related to a first terminal device; an analysis execution unit that determines whether the target information acquired by the acquisition unit satisfies a first condition; When the execution unit determines that the target information satisfies the first condition, the notification unit that notifies the first terminal device of the first information, and the first information notified by the notification unit is An information receiving unit that receives the second information from the first terminal device, and, when the second information is received from the first terminal device with respect to the first information, the information receiving unit receives the second information from the first terminal device. A notification suppression unit that suppresses a notification; and a management unit that manages a status of notification of the first information based on the first condition, wherein the status includes at least a status of being suppressed, and The information is It can be searched using the status of knowledge, an analytical instrument.
One aspect of the present invention is an acquisition unit that acquires target information related to a first terminal device; an analysis execution unit that determines whether the target information acquired by the acquisition unit satisfies a first condition; When the execution unit determines that the target information satisfies the first condition, the notification unit that notifies the first terminal device of the first information, and the first information notified by the notification unit is An information receiving unit that receives the second information from the first terminal device, and, when the second information is received from the first terminal device with respect to the first information, the information receiving unit receives the second information from the first terminal device. A notification suppression unit that suppresses a notification, wherein the notification suppression unit is configured to control the first terminal device based on a second condition specifying that the notification of the first information to the first terminal device is suppressed. The first information Suppressing notification, an analytical instrument.
One aspect of the present invention is an acquisition unit that acquires target information related to a first terminal device, an analysis execution unit that determines whether the target information acquired by the acquisition unit satisfies a first condition, When the execution unit determines that the target information satisfies the first condition, the notification unit that notifies the first terminal device of the first information, and the first information notified by the notification unit is An information receiving unit that receives the second information from the first terminal device, and, when the second information is received from the first terminal device with respect to the first information, the information receiving unit receives the second information from the first terminal device. A notification suppressing unit that suppresses a notification, wherein the target information is a log related to security.
In the analysis device according to one aspect of the present invention, the first condition is a rule for detecting a problem, the first information is information on an alert corresponding to the problem, and the second information is a rule on the alert. Is information indicating that there is an error in.
The analyzer according to an aspect of the present invention includes a changing unit that changes the first condition. One aspect of the present invention is that the target information relating to the terminal device having a detection device that detects the target information related to the terminal device and transmits the target information to the analysis device by using a log related to security as target information is transmitted by the analysis device. A notification reception control unit that receives a notification of the first information relating to the security notified from the analysis device when it is determined that the first condition is satisfied, and a first reception unit that receives the first information received by the notification reception control unit. An instruction receiving unit that receives a predetermined instruction related to the security, and an instruction to suppress notification of the first information related to the security to the terminal device when the instruction is received with respect to the first information. And an instruction transmission control unit that transmits two pieces of information to the analysis device.
In the terminal device according to an aspect of the present invention, the first condition is a rule for detecting a problem, the first information is information on an alert corresponding to the problem, and the second information is a message on the alert. Is information indicating that there is an error in.

One embodiment of the present invention is an analysis system including a first terminal device and an analysis device, wherein the analysis device obtains target information regarding the first terminal device, and obtains the target information by the obtaining unit. An analysis execution unit that determines whether the obtained target information satisfies a first condition, and when the analysis execution unit determines that the target information satisfies the first condition, the first information is converted to the first information. A notification unit for notifying a terminal device, an information reception unit for receiving second information from the first terminal device with respect to the first information notified by the notification unit, and a first terminal for the first information And a notification suppressing unit that suppresses notification of the first information to the first terminal device when the second information is received from the device, wherein the first terminal device is notified from the analysis device. Of the first information A notification reception control unit that receives information, an instruction reception unit that receives a predetermined instruction for the first information received by the notification reception control unit, and a case where the instruction is received for the first information An instruction transmission control unit that transmits the second information to the analysis device, wherein the notification suppression unit transmits a notification of the first information according to the first condition to the first terminal device for a predetermined period. An analysis system for stopping and resuming the notification of the first information under the first condition after the predetermined period has elapsed.
One embodiment of the present invention is an analysis system including a first terminal device and an analysis device, wherein the analysis device obtains target information regarding the first terminal device, and obtains the target information by the obtaining unit. An analysis execution unit that determines whether the obtained target information satisfies a first condition, and when the analysis execution unit determines that the target information satisfies the first condition, the first information is converted to the first information. A notification unit for notifying a terminal device, an information reception unit for receiving second information from the first terminal device with respect to the first information notified by the notification unit, and a first terminal for the first information A notification suppression unit that suppresses notification of the first information to the first terminal device when the second information is received from a device, and management that manages a status of notification of the first information based on the first condition. And a part The first terminal device receives a notification of the first information notified from the analysis device, and receives a predetermined instruction for the first information received by the notification reception control unit. An instruction receiving unit, and an instruction transmission control unit that transmits the second information to the analyzer when the instruction is received for the first information, wherein the situation is at least suppressed. An analysis system, wherein the first information can be searched using the status of the notification.
One embodiment of the present invention is an analysis system including a first terminal device and an analysis device, wherein the analysis device obtains target information regarding the first terminal device, and obtains the target information by the obtaining unit. An analysis execution unit that determines whether the obtained target information satisfies a first condition, and when the analysis execution unit determines that the target information satisfies the first condition, the first information is converted to the first information. A notification unit for notifying a terminal device, an information reception unit for receiving second information from the first terminal device with respect to the first information notified by the notification unit, and a first terminal for the first information And a notification suppressing unit that suppresses notification of the first information to the first terminal device when the second information is received from the device, wherein the first terminal device is notified from the analysis device. Of the first information A notification reception control unit that receives information, an instruction reception unit that receives a predetermined instruction for the first information received by the notification reception control unit, and a case where the instruction is received for the first information An instruction transmission control unit that transmits the second information to the analysis device, wherein the notification suppression unit determines that the notification of the first information to the first terminal device is to be suppressed. An analysis system for suppressing notification of the first information to the first terminal device based on the first information.
One embodiment of the present invention is an analysis system including a first terminal device and an analysis device, wherein the analysis device obtains target information regarding the first terminal device, and obtains the target information by the obtaining unit. An analysis execution unit that determines whether the obtained target information satisfies a first condition, and when the analysis execution unit determines that the target information satisfies the first condition, the first information is converted to the first information. A notification unit for notifying a terminal device, an information reception unit for receiving second information from the first terminal device with respect to the first information notified by the notification unit, and a first terminal for the first information And a notification suppressing unit that suppresses notification of the first information to the first terminal device when the second information is received from the device, wherein the first terminal device is notified from the analysis device. Of the first information A notification reception control unit that receives information, an instruction reception unit that receives a predetermined instruction for the first information received by the notification reception control unit, and a case where the instruction is received for the first information And an instruction transmission control unit that transmits the second information to the analysis device, wherein the target information is a log related to security.
In the analysis system according to an aspect of the present invention, the first condition is a rule for detecting a problem, the first information is information on an alert corresponding to the problem, and the second information is a message on the alert. Is information indicating that there is an error in.
In the analysis system according to an aspect of the present invention, the analysis device includes a changing unit that changes the first condition.

One aspect of the present invention is an analysis method in an analysis system including a first terminal device and an analysis device, wherein the analysis device acquires target information on the first terminal device, and acquires the target information. It is determined whether or not the information satisfies a first condition, and when it is determined that the target information satisfies the first condition, the first information is notified to the first terminal device, and the first terminal device Receiving a notification of the first information from the analyzer, transmitting a second information to the analyzer when a predetermined instruction is received for the received first information, When the second information is received from the first terminal device, the device suppresses the notification of the first information to the first terminal device, and the analysis device determines that the first terminal device For the device, according to the first condition The notification of the first information is stopped for a predetermined period of time, said predetermined period of time to resume the notification of the first information by the first condition after a lapse of an analytical method.
One aspect of the present invention is an analysis method in an analysis system including a first terminal device and an analysis device, wherein the analysis device acquires target information on the first terminal device, and acquires the target information. It is determined whether or not the information satisfies a first condition, and when it is determined that the target information satisfies the first condition, the first information is notified to the first terminal device, and the first terminal device is Receiving a notification of the first information from the analyzer, transmitting a second information to the analyzer when a predetermined instruction is received for the received first information, The device, when the second information is received from the first terminal device, suppresses the notification of the first information to the first terminal device, and the analysis device is configured to transmit the first information according to the first condition. Manage the status of the notification, said status Even without including the situation has been suppressed, the first information may be retrieved by using the status of the notification, an analytical method.
One aspect of the present invention is an analysis method in an analysis system including a first terminal device and an analysis device, wherein the analysis device acquires target information on the first terminal device, and acquires the target information. It is determined whether or not the information satisfies a first condition, and when it is determined that the target information satisfies the first condition, the first information is notified to the first terminal device, and the first terminal device Receiving a notification of the first information from the analyzer, transmitting a second information to the analyzer when a predetermined instruction is received for the received first information, When the second information is received from the first terminal device, the device suppresses the notification of the first information to the first terminal device, and the analysis device determines that the first terminal device Notification of the first information to the device Based on the second condition for specifying a suppressing, inhibiting the notification of the first information for the first terminal device, an analytical method.
One aspect of the present invention is an analysis method in an analysis system including a first terminal device and an analysis device, wherein the analysis device acquires target information on the first terminal device, and acquires the target information. It is determined whether or not the information satisfies a first condition, and when it is determined that the target information satisfies the first condition, the first information is notified to the first terminal device, and the first terminal device Receiving a notification of the first information from the analyzer, transmitting a second information to the analyzer when a predetermined instruction is received for the received first information, The apparatus is an analysis method, wherein when the second information is received from the first terminal device, the device suppresses notification of the first information to the first terminal device, and the target information is a log related to security. .
In the analysis method according to an aspect of the present invention, the first condition is a rule for detecting a problem, the first information is information on an alert corresponding to the problem, and the second information is a rule on the alert. Is information indicating that there is an error in.
In the analysis method according to one aspect of the present invention, the analyzer changes the first condition.

One aspect of the present invention provides a computer that constitutes an analyzer, a function of acquiring target information regarding a first terminal device, a function of determining whether the acquired target information satisfies a first condition, When it is determined that the target information satisfies the first condition, a function of notifying the first terminal device of the first information and a second information from the first terminal device with respect to the notified first information are provided. To realize a function of receiving the first information and a function of suppressing notification of the first information to the first terminal device when the second information is received from the first terminal device for the first information. Wherein the function of suppressing the notification stops the notification of the first information under the first condition for the first terminal device for a predetermined period, and the first terminal device stops the notification of the first information after the predetermined period has elapsed. Depending on conditions Resuming the notification of the first information, a program. One aspect of the present invention provides a computer that constitutes an analyzer, a function of acquiring target information regarding a first terminal device, a function of determining whether the acquired target information satisfies a first condition, When it is determined that the target information satisfies the first condition, a function of notifying the first terminal device of the first information and a second information from the first terminal device with respect to the notified first information are provided. An accepting function, a function of suppressing notification of the first information to the first terminal device when the second information is accepted from the first terminal device for the first information, and a first condition A program for realizing a function of managing the status of notification of the first information according to the above, wherein the status includes at least a status of being suppressed, and the first information includes a status of the notification. Using It can be searched, a program.
One aspect of the present invention provides a computer that constitutes an analyzer, a function of acquiring target information regarding a first terminal device, a function of determining whether the acquired target information satisfies a first condition, When it is determined that the target information satisfies the first condition, a function of notifying the first terminal device of the first information and a second information from the first terminal device with respect to the notified first information are provided. To realize a function of receiving the first information and a function of suppressing notification of the first information to the first terminal device when the second information is received from the first terminal device for the first information. Wherein the function of suppressing the notification is based on a second condition specifying that the notification of the first information to the first terminal device is to be suppressed. Notifications Suppress, it is a program.
One aspect of the present invention provides a computer that constitutes an analyzer, a function of acquiring target information regarding a first terminal device, a function of determining whether the acquired target information satisfies a first condition, When it is determined that the target information satisfies the first condition, a function of notifying the first terminal device of the first information and a second information from the first terminal device with respect to the notified first information are provided. To realize a function of receiving the first information and a function of suppressing notification of the first information to the first terminal device when the second information is received from the first terminal device for the first information. Wherein the target information is a log related to security.
In the program according to an aspect of the present invention, the first condition is a rule for detecting a problem, the first information is information on an alert corresponding to the problem, and the second information is a This information indicates that there is an error.
The program according to one embodiment of the present invention is a program for realizing a function of changing the first condition.
One aspect of the present invention relates to a computer that constitutes the terminal device having a detection device that detects the target information related to the terminal device using a log related to security as target information and transmits the target information to an analysis device. A function of receiving a notification of the first information relating to the security notified from the analysis device when the analysis device determines that the target information satisfies a first condition; And a second information including a function of receiving a predetermined instruction related to the security and an instruction to suppress notification of the first information related to the security to the terminal device when the instruction is received for the first information. And a function of transmitting the data to the analyzer.
In the program according to an aspect of the present invention, the first condition is a rule for detecting a problem, the first information is information on an alert corresponding to the problem, and the second information is a This information indicates that there is an error.

According to the analysis device, the terminal device, the analysis system, the analysis method, and the program described above, it is possible to efficiently cope with a case where a false detection occurs in a specific organization among a plurality of different customer organizations. .

1 is a diagram illustrating a schematic configuration example of an analysis system according to an embodiment of the present invention. It is a figure showing the example of schematic composition of the terminal unit concerning one embodiment of the present invention. It is a figure showing an example of display contents of an alert list concerning one embodiment of the present invention. It is a figure showing an example of display contents of alert details concerning one embodiment of the present invention. It is a figure showing an example of display contents of alert search concerning one embodiment of the present invention. It is a figure showing an example of a procedure of processing performed in a terminal unit concerning one embodiment of the present invention. FIG. 7 is a diagram illustrating an example of a procedure of a process performed in the analyzer according to the embodiment of the present invention. FIG. 7 is a diagram illustrating an example of a procedure of a process performed in the analyzer according to the embodiment of the present invention. FIG. 7 is a diagram illustrating an example of a procedure of a process performed in the analyzer according to the embodiment of the present invention. FIG. 1 is a diagram illustrating an example of a hardware configuration of an information processing apparatus according to an embodiment of the present invention.

An embodiment of the present invention will be described in detail with reference to the drawings.

[Analysis system]
FIG. 1 is a diagram illustrating a schematic configuration example of an analysis system 1 according to an embodiment of the present invention. The configuration of the functional blocks illustrated in FIG. 1 is an example, and another configuration may be used.
The analysis system 1 includes an analysis unit 11, a plurality of terminals 21 to 23, and a network 31.
The terminals 21 to 23 and the analyzer 11 are communicably connected via a network 31.

Here, each of the terminal units 21 to 23 is managed by a different management entity. The management entity may be, for example, an organization such as a company or a school, or may be an individual. When the management subject is an organization, a person belonging to the organization manages the terminal units 21 to 23. When the management subject is an individual, a person corresponding to the individual manages the terminal units 21 to 23. In the present embodiment, a person who manages each of the terminal units 21 to 23 may be called a user.
Note that two or more terminal units among the plurality of terminal units 21 to 23 may be managed by the same management entity. The two or more terminal units may be a part of the plurality of terminal units 21 to 23, or may be all.

The number of the terminal units 21 to 23 may be any number equal to or more than one.
In this embodiment, for convenience of explanation, the configurations and operations of the plurality of terminals 21 to 23 are the same except that the management entities of the terminals 21 to 23 may be different. For this reason, in the present embodiment, one terminal unit 21 will be described as a representative.
Note that a mode in which the configurations or operations of the terminal units 21 to 23 are different may be used.

In the present embodiment, the analysis unit 11 performs the same operation for each of the plurality of terminals 21 to 23 except that the management entity of each of the terminals 21 to 23 may be different.
Note that the analysis unit 11 may be configured to perform different operations on each of the plurality of terminal units 21 to 23.

In the present embodiment, the analysis unit 11 is common to the plurality of terminals 21 to 23. Note that the analysis system 1 may include a plurality of analysis units 11. In this case, the plurality of analyzers 11 operate by sharing the plurality of terminals 21 to 23.
Here, the analysis unit 11 may be regarded as, for example, an apparatus or a system. Further, the terminal unit 21 may be regarded as, for example, an apparatus or a system.

The network 31 may be any network. The network 31 may be, for example, the Internet or a dedicated network. The communication between the terminal units 21 to 23 and the analysis unit 11 may be, for example, wired communication, wireless communication, or both wired communication and wireless communication. May be included in combination.

[Overview of Terminal]
The terminal unit 21 will be described as a representative.
The terminal unit 21 includes a log detection device 51 and a terminal device 52.
Although the example of FIG. 1 shows a configuration in which each of the log detection device 51 and the terminal device 52 is connected to the network 31, the configuration is not limited to this.

The log detection device 51 detects information to be detected (also referred to as “target information” for convenience of description). In the present embodiment, the target information is a predetermined log. In the present embodiment, the log detection device 51 constantly monitors a predetermined target and detects a log of the target. In the present embodiment, the log is a log related to security (security log), for example, a log targeted for communication via the network 31.
The log detection device 51 may be configured using, for example, a sensor that detects a predetermined log. In the present embodiment, the log detection device 51 detects a log related to communication performed by the terminal device 52. The log detection device 51 outputs the detected log. In the present embodiment, the log detection device 51 transmits the detected log to the analysis unit 11. The transmission of the log may be performed, for example, for each predetermined log unit. The unit may be a unit for each predetermined period. The predetermined period may be, for example, one day.
In the present embodiment, the log detecting device 51 does not store the detected log. As another example, the log detection device 51 may include a storage unit that stores the detected log.

The terminal device 52 is configured using, for example, an information processing device operated by a user. The information processing device is, for example, a computer. The computer may be, for example, a desktop computer, a notebook computer, a mobile phone computer, or a smartphone computer.
The terminal device 52 receives the e-mail transmitted from the analysis unit 11 via the network 31.
In addition, the terminal device 52 acquires the information of the Web page provided by the analysis unit 11. The terminal device 52 transmits information to the analysis unit 11 via the network 31. In the present embodiment, for example, the terminal device 52 transmits to the analysis unit 11 information on erroneous detection (erroneous detection) of the analysis result performed by the analysis unit 11.

[Overview of Analysis Department]
The analyzer 11 includes an analyzer 41, a Web server 42, and a mail server 43.
In the example of FIG. 1, a configuration is shown in which each of the analysis device 41, the Web server device 42, and the mail server device 43 is connected to the network 31, but is not limited thereto.

The analysis device 41 includes a storage unit 111, an acquisition unit 112, an analysis execution unit 113, a notification unit 114, an erroneous detection control unit 115, and a management unit 116.
The acquisition unit 112 includes a reception unit 131.
The management unit 116 includes a search processing unit 151.

The outline of the operation performed in the analyzer 41 will be described.
The storage unit 111 stores various information.
The acquisition unit 112 receives the log transmitted from the log detection device 51 to the analysis unit 11 via the network 31 by the reception unit 131. Then, the acquiring unit 112 acquires the received log. In the present embodiment, the acquisition unit 112 collects various logs by acquiring various logs. The acquisition unit 112 outputs the received log to the analysis execution unit 113. In the present embodiment, the log detection device 51 transmits the log to the analysis device 41.

Here, the log detection device 51 may compress the log information and transmit the compressed log information to the analysis device 41. In this case, in the analyzer 41, the analysis executing unit 113 decompresses the received information and obtains the information of the original log. It should be noted that “decompression” may be called “extension” or the like.
In addition, the log detection device 51 may encrypt the information to be transmitted, and transmit the encrypted information to the analysis device 41. In this case, in the analyzer 41, the analysis executing unit 113 decodes the received information to obtain the original information.

The analysis execution unit 113 inputs the log output from the acquisition unit 112. The analysis executing unit 113 analyzes the input log based on predetermined conditions (for convenience of explanation, also referred to as “analysis conditions”). The analysis executing unit 113 outputs to the notifying unit 114 predetermined information on the result of analyzing the input log (also referred to as “analysis result information” for convenience of explanation).
In the present embodiment, the storage unit 111 stores information specifying analysis conditions. The analysis execution unit 113 acquires an analysis condition based on the information.

Arbitrary conditions may be used as analysis conditions.
As the analysis condition, for example, a condition for determining whether or not there is a problem with the log to be analyzed may be used. The problem may be, for example, a computer virus or another event.
As the analysis condition, for example, “one or more of the information identifying the transmission source included in the log, the information identifying the transmission destination included in the log, or other information included in the log, If they match, a condition for determining that there is a problem may be used. As the analysis condition, for example, a condition described in a blacklist in which a condition of a log to be determined as having a problem is listed may be used.

In addition, the condition that should be determined to have a problem may be referred to as, for example, a “rule”. In the present embodiment, the condition will be referred to as a “detection rule” for convenience of description. The detection rule may be regarded as, for example, a condition for detecting a problem based on a log. That is, when it is determined that a situation corresponding to a certain detection rule has occurred for a certain log, it is determined that a problem associated with the detection rule has occurred. One or more detection rules are created, and in the present embodiment, a plurality of different detection rules are created and used.
In this case, each detection rule includes information for specifying a rule for determining whether or not the detection rule is applicable. Each detection rule is associated with information that specifies a problem that has occurred when the detection rule is satisfied. It should be noted that information that specifies a problem that has occurred when a detection rule is satisfied may be considered to be included in the detection rule.
Each problem is associated with the content of an alert to be notified when the problem occurs.

Thereby, in the present embodiment, the detection rule, the problem, and the alert (contents of the alert) are associated with each other. In the present embodiment, such association information is stored in, for example, the storage unit 111 and managed by the management unit 116.
The problem and the content of the alert may be configured as, for example, common information. In other words, when a problem is presented in the content of the alert, the problem can also be notified by the content of the alert.

Further, in the present embodiment, for convenience of explanation, a case is shown in which each detection rule is initially created as a detection rule common to all terminal devices 52. As another example, one or more terminal devices 52 to which the detection rule is applied may be initially set for each detection rule. The contents of such a setting may be considered to be included in the detection rule.
As a specific example of the detection rule, as for a received signal, a problem that information communication from a suspicious source has occurred when the identification information of the transmission source device of the reception signal matches predetermined identification information has occurred. It is assumed that a problem has occurred that, when the identification information of the transmission destination device of the transmission signal matches the predetermined identification information, the information transmission to the suspicious transmission destination occurs. A “detection rule” or the like may be used.

Here, in the present embodiment, when the detection rule is satisfied, there is a case where notification of an alert corresponding to the detection rule is performed and a case where notification of an alert corresponding to the detection rule is not performed. In the present embodiment, for each detection rule, a rule that specifies whether to notify an alert when the detection rule is satisfied (in the present embodiment, also referred to as an “alert rule” for convenience of explanation). ) Is used.
In the present embodiment, an alert rule is associated with a detection rule. In the alert rule, information that specifies the terminal device 52 to be notified of an alert when the detection rule associated with the alert rule is satisfied, or the detection rule associated with the alert rule is satisfied. Sometimes, information for specifying the terminal device 52 that does not perform alert notification is included. In the alert rule, for example, it is initially set that an alert should be notified to all the terminal devices 52 when the detection rule associated with the alert rule is satisfied.

As another example, an alert rule may be provided for each terminal device 52. In this case, in the alert rules of the respective terminal devices 52, information that specifies a detection rule that should notify the terminal device 52 of an alert, or a detection rule that does not notify the terminal device 52 of an alert. Is included.

Here, in the present embodiment, the detection rule and the alert rule are combined, for example, for the terminal device 52, when a predetermined problem is detected and an alert is notified, and when a predetermined problem is detected, the alert is generated. The case where notification is not performed is identified.
As a mode in which the alert is not notified, for example, a mode in which the notification of the alert is stopped for a predetermined period may be included, or a mode in which the notification of the alert is permanently stopped may be included.
As another example, a rule in which a detection rule and an alert rule are integrated may be used.

In the present embodiment, when a certain detection rule is satisfied, the analysis execution unit 113 sends the analysis result information to the notification unit 114 when an alert should be notified based on the alert rule corresponding to the detection rule. If the notification is not performed, the analysis result information is not output to the notification unit 114.
In the present embodiment, a case is shown in which whether or not to notify an alert is controlled by the analysis execution unit 113. As another example, analysis result information is output from the analysis execution unit 113 to the notification unit 114. Alternatively, a configuration may be used in which the notification unit 114 controls whether to notify an alert based on the contents of the alert rule.

In the case where a plurality of types of logs can be included in the log to be analyzed, for example, the analysis execution unit 113 determines the type of each log. In this case, the information of each log includes information specifying the type of the log.

Further, for example, a configuration may be used in which the sensor of the log detection device 51 transmits the alert information to the analysis device 41 together with the log detection result.
In this case, in the analysis device 41, the analysis execution unit 113 determines, for example, whether or not the alert information attached to the log detection result is correct. In this case, for example, a condition for determining whether the information of the alert added to the log detection result is correct is used as the analysis condition.
Generally, in the sensor of the log detection device 51, the accuracy of the alert notified from the sensor that notifies the alert is often not high. The alert may include, for example, the name of the signature.

In the present embodiment, the detection rule includes at least one of an alert name (also referred to as an “alert name” for convenience of description), a degree of importance, and the like, together with a condition for determining that the log has a problem. May be stored in association with each other. The alert corresponds to, for example, a problem that occurs.
The alert name indicates the name of the alert. The alert name is predetermined for each type of alert, for example.
Information for identifying each type of the content of the alert may be added to each alert.
The importance indicates the importance of the alert. The importance may be expressed at any stage. In the present embodiment, the importance is expressed in three stages.

When the analysis result information is input from the analysis execution unit 113, the notification unit 114 notifies the terminal device 52 of predetermined information based on the analysis result information. As the predetermined information, information for notifying the terminal device 52 of information on the analysis result is used, and arbitrary information may be used.

Here, an arbitrary method may be used as a method of notifying the information from the notification unit 114 to the terminal device 52.
In the present embodiment, when information to be notified to the terminal device 52 occurs, the notification unit 114 creates an e-mail addressed to the terminal device 52 and sends the created e-mail to the mail server device 43. In this case, the notification unit 114 includes information of an access destination accessible from the terminal device 52 in the electronic mail. The information may be, for example, a URL (Uniform Resource Locator).
The notifying unit 114 generates a Web page corresponding to the access destination information included in the e-mail, and transmits the generated Web page information to the Web server device 42. The notification unit 114 includes information to be notified to the terminal device 52 in the Web page.

The mail server device 43 receives the electronic mail transmitted from the notification unit 114. The mail server device 43 transmits the received electronic mail to the destination of the electronic mail. In the present embodiment, an e-mail addressed to the terminal device 52 is transmitted from the mail server device 43 to the terminal device 52 via the network 31.
The Web server device 42 receives the Web page information transmitted from the notification unit 114. The Web server device 42 provides the Web page in a viewable manner based on the received information. In the present embodiment, in response to access from the terminal device 52, the Web server device 42 provides the Web page to the terminal device 52 in a viewable manner.

The erroneous detection control unit 115 performs control related to erroneous detection on the result of the analysis performed by the analysis execution unit 113.
For example, the erroneous detection control unit 115 performs a process of receiving a notification of erroneous detection from the terminal device 52 for each alert, and a notification source when receiving a notification of erroneous detection from the terminal device 52 for each alert. For the terminal device 52, the process of stopping the notification of the alert by the detection rule corresponding to the alert, the process of restarting the notification of the alert by the detection rule to the notification source, and the like are performed.
In the present embodiment, the erroneous detection control unit 115 controls the stop of the notification of the alert or the restart of the notification of the alert by rewriting the content of the alert rule corresponding to the detection rule.

The management unit 116 performs various types of management on the terminal device 52.
In the management unit 116, for example, the search processing unit 151 performs a process of searching for information. The search processing unit 151 may perform a process of executing the search performed in the terminal device 52 instead of the terminal device 52, or a process of assisting the search performed in the terminal device 52. The search processing unit 151 performs a search process using, for example, information stored in the storage unit 111.
In addition, the management unit 116 rewrites and changes the detection rules and the like stored in the storage unit 111, for example. Such rewriting may include, for example, new registration, overwriting, and erasing.

In the present embodiment, a case where the information of the terminal device 52 is known in the analysis unit 11 will be described.
In the present embodiment, when a contract regarding the service is concluded between the management entity of the terminal device 52 and the management entity providing the analysis service by the analysis unit 11, information of the terminal device 52 regarding the contract is provided. Is set in the analysis unit 11. The information may be stored in the storage unit 111, for example. The information may include, for example, information specifying the terminal device 52. The information may include an e-mail address of the terminal device 52.

Here, the information of the terminal device 52 set with respect to the contract includes, for example, information for specifying a range of analysis that can receive a service, or information on a fee required for receiving a service (for convenience of explanation, "Charging information").
The range of analysis that can receive the service may be set using, for example, one or more of the data amount, the number of times, the period, and the like.
The management unit 116 may store information for specifying the fee currently charged for the terminal device 52 in the storage unit 111 and manage the information.
From the viewpoint of the management entity that provides the analysis service by the analysis unit 11, the management entity of the terminal device 52 with which the contract regarding the service is concluded is the customer. The management entities of the plurality of terminal units 21 to 23 may be different customers.

[Details of terminal device]
FIG. 2 is a diagram illustrating a schematic configuration example of the terminal device 52 according to an embodiment of the present invention. The configuration of the functional blocks shown in FIG. 2 is an example, and another configuration may be used.
The terminal device 52 includes an input unit 211, an output unit 212, an operation unit 213, a display unit 214, a communication unit 215, a storage unit 216, and a control unit 217.
The control unit 217 includes a notification reception control unit 231, an instruction transmission control unit 232, and a search control unit 233.

The input unit 211 inputs information output from an external device.
The output unit 212 outputs information to an external device.
Here, the external device may be any device. The external device may be, for example, a portable recording medium. The external device may be, for example, a printing device.
The operation unit 213 inputs information corresponding to an operation performed by the user. The operation unit 213 may include, for example, a keyboard or a mouse.
The display unit 214 has a screen and outputs information to the screen. Thereby, the information is displayed on the screen.
The communication unit 215 performs communication via the network 31.
The storage unit 216 stores various types of information.
The control unit 217 performs various controls in the terminal device 52.

The notification reception control unit 231 performs a process for receiving the content of the notification performed by the notification unit 114 of the analyzer 41.
In the present embodiment, the notification reception control unit 231 receives, by the communication unit 215, an electronic mail transmitted from the mail server device 43 to the terminal device 52 via the network 31. Further, the notification reception control unit 231 accesses the access destination Web page described in the received e-mail, and acquires information on the Web page provided by the Web server device 42. This access may be performed, for example, in response to an operation of the operation unit 213 performed by the user.

The notification reception control unit 231 displays the acquired information of the e-mail or the acquired information of the Web page on the screen of the display unit 214.
The contents of the notification of the log analysis result include, for example, information for notifying that a problem has occurred as a log analysis result. Such a notification is an alert (warning) notification.
The “problem” in the result of the analysis may be called, for example, “incident” or “abnormal”.

The instruction transmission control unit 232 transmits an instruction corresponding to the operation of the operation unit 213 performed by the user to the analysis device 41 via the communication unit 215.
In the present embodiment, on the Web page displayed on the screen of the display unit 214, the user can perform an operation for giving a predetermined instruction.
In the present embodiment, as such an instruction, an instruction for notifying that an erroneous detection (erroneous detection) has been detected for a case where it has been determined that a problem has occurred in the log analysis result is used.

The search control unit 233 performs various search processes on the contents of the notification of the analysis result.
The search control unit 233 may receive and present the result of the search process performed by the search processing unit 151 of the analysis device 41, for example. Further, the search control unit 233 may perform a search process, for example, with the assistance of the search processing unit 151 of the analyzer 41. Further, the search control unit 233 may perform a search process, for example, independently of the analysis device 41.

[Alert List]
FIG. 3 is a diagram showing an example of the display content 2011 of the alert list according to the embodiment of the present invention.
The display content 2011 shows a list of alerts. The display content 2011 is displayed on the screen of the display unit 214 in the terminal device 52. The display content 2011 may be different for each terminal device 52, for example. In the example of FIG. 3, the list of alerts is a list of alerts performed in the past.

The display content 2011 is based on information provided from the analyzer 41 to the terminal device 52, for example.
As an example, the display content 2011 may be generated on the analysis device 41 side and provided from the analysis device 41 to the terminal device 52. As another example, the display content 2011 is generated based on the information stored in the storage unit 216 in the terminal device 52 after the information provided from the analysis device 41 to the terminal device 52 is stored in the storage unit 216. Is also good. Note that the display content 2011 may include other information.

では In the example of FIG. 3, the date and time, the alert name, the importance, and the status are displayed in association with each other. The display color of the information may be switched according to one or more of the degree of importance or the situation.

The date and time indicates the date and time when the alert occurred. In the example of FIG. 3, for example, “2018/1/2” indicates January 2, 2018, and so on.
In the example of FIG. 3, the alert names include “suspicious transmission” and “suspicious reception”. Note that these alert names are examples for convenience of explanation, and arbitrary names may be used as the alert names.
In the example of FIG. 3, there are three levels of importance, large, medium, and small, from large to small.
The status represents the status in which the alert is being handled. In the present embodiment, conditions such as “not responded”, “under investigation”, “response”, “pending”, “under treatment”, and “inhibited” are used. Note that an arbitrary situation may be used as the situation.

“Unsupported” indicates that the alert has not been handled yet.
“Under investigation” indicates that an investigation is being performed on the alert.
“Responded” indicates that the alert has been responded. In other words, it indicates that the problem has been solved for the alert.
"Pending" indicates that the response is pending for the alert.
“Under handling” indicates that the alert is being handled.
“Suppression” indicates that the notification of the alert is suppressed for the alert. In the present embodiment, when an erroneous detection is pointed out in the terminal device 52 with respect to the alert, a state of “inhibited” is set in the analyzer 41. Such a setting is performed, for example, for an alert rule.
Note that each word indicating the status of the alert may be expressed using any other word.

Here, the date and time of the alert, the alert name, and the importance are determined by, for example, the analysis execution unit 113 of the analyzer 41, and the analysis result information including the information is output from the analysis execution unit 113 to the notification unit 114. . The notifying unit 114 includes the date and time of the alert, the alert name, and the importance in the content to be notified to the terminal device 52 based on the analysis result information.
The status of the alert is set, for example, in accordance with an operation of the operation unit 213 performed by the user on the terminal device 52. The set status of the alert is notified from the terminal device 52 to the notification unit 114 of the analysis device 41, and is managed by the management unit 116. The management unit 116 stores and manages information that associates an alert with a situation in the storage unit 111 based on information received from the terminal device 52 by the notification unit 114, for example.

Here, in the present embodiment, the case where the information of the alert in the “suppressed” status is also displayed in the alert list, but as another example, the information of the alert in the “suppressed” status is not displayed. Aspects may be used.

FIG. 4 is a diagram showing an example of the display content 2111 of the alert details according to the embodiment of the present invention.
The display content 2111 indicates details of the alert. The display content 2111 is displayed on the screen of the display unit 214 in the terminal device 52. The display content 2111 may be different for each terminal device 52, for example.

The display content 2111 is based on information provided from the analyzer 41 to the terminal device 52, for example.
As an example, the display content 2111 may be generated on the side of the analyzer 41 and provided from the analyzer 41 to the terminal device 52. As another example, the display content 2111 is generated by using the information stored in the storage unit 216 in the terminal device 52 after the information provided from the analysis device 41 to the terminal device 52 is stored in the storage unit 216. Is also good. Note that the display content 2111 may include other information.

As the details of the alert, for example, when one alert is designated by the user in the list of alerts, the details of the alert are indicated for the designated alert.
In the example of FIG. 4, a frame of the attribute area 2121, a frame of the correspondence status area 2122, and a frame of the content area 2123 are displayed on one screen. The names, arrangements, and the like of these areas may be arbitrary.

On the alert details screen, information about one alert is displayed.
The attribute area 2121 shows the attribute of one alert to be displayed. In the example of FIG. 4, the attribute area 2121 indicates the date and time, the alert name, the importance, and the status. The display color of the information may be switched according to one or more of the degree of importance or the situation.
In the response status area 2122, information that allows an arbitrary response status to be selected from a plurality of response statuses is shown.
In the content area 2123, detailed information on the alert or the log that generated the alert is shown.

In the example of FIG. 4, the selectable response statuses include “not responded”, “under investigation”, “responded”, “pending”, “under response”, “false detection”, and “out of target”. A button that can be switched between a selected state and a non-selected state is displayed for each corresponding state. The button is switched between a selected black state and a non-selected white state, for example, in response to an operation of the operation unit 213 performed by the user. The button may be, for example, a radio button.

Here, “unsupported”, “under investigation”, “completed”, “pending”, and “under processing” are the same as described with reference to FIG.
The “erroneous detection” is an item for receiving an instruction for notifying the analyzer 41 from the terminal device 52 that the displayed alert is an erroneous detection.
“Not applicable” is an item for receiving an instruction for notifying the analyzer 41 from the terminal device 52 that the displayed alert is not a detection target.
In the present embodiment, the status of “inhibition” is automatically set in the analyzer 41 for an alert for which “false detection” is selected. For this reason, in this embodiment, the user cannot select the state of “inhibition”. As another example, in the terminal device 52, a configuration in which the user can select the state of “inhibition” may be used.
In the present embodiment, the status of “inhibited” is automatically set in the analyzer 41 for an alert for which “not applicable” is selected.
In the present embodiment, “false detection” and “out of target” are similar in some respects, but are provided as different things. It should be noted that “out of target” may not be provided.

In the display content 2111 shown in FIG. 4, the user operates the operation unit 213 to select a response status suitable for the displayed alert from among the response statuses that can be selected.
Note that in the present embodiment, “unsupported” is selected as the initial default in the support status area 2122, but another support status may be selected.
A decision button 2131 is also displayed in the correspondence status area 2122. When the button 2131 is pressed based on the operation of the operation unit 213 performed by the user, information for specifying the selected correspondence status is transmitted from the terminal device 52 to the analysis device 41 by the instruction transmission control unit 232. You.

In this case, the terminal device 52 transmits, to the analyzer 41, information for specifying the alert and information for specifying the response status of the alert selected by the user.
In the analyzer 41, the notification unit 114 receives the information transmitted from the terminal device 52, and the management unit 116 manages the received information.

<Selection of "false detection">
In the analysis device 41, when the information received from the terminal device 52 indicates “false detection”, the false detection control unit 115 stops notification of an alert by a detection rule that generates an alert related to the false detection for a certain period. . The certain period may be an arbitrary period, for example, one month.
In the present embodiment, in the analyzer 41, such a stop of the notification of the alert is performed for the terminal device 52 for which “false detection” is selected by the user, and is not performed for the other terminal devices. . That is, even for the same detection rule, the notification of the alert by the detection rule is stopped only for the terminal device 52 for which the detection rule is erroneously detected.

In the present embodiment, “false detection” can be selected for each customer and each alert. For example, when a certain detection rule is erroneously detected only in a specific customer organization, it can be determined that only a specific customer organization is erroneously detected. In the organization of the specific customer, once “false detection” is selected for a certain alert, it is possible to prevent an alert based on the same detection rule from being notified for a certain period.

In the present embodiment, the suspension of the notification of the alert is temporarily performed. However, as another example, the suspension of the notification of the alert may be permanently performed. The detection rule for the terminal device 52 may be permanently invalidated. The method of invalidating the detection rule may be arbitrary. As a method of invalidating the detection rule, for example, the management unit 116 may manage information indicating whether each detection rule is valid or invalid for each terminal device 52. In the present embodiment, for example, alert rule information is used as the information.

In the analysis device 41, the erroneous detection control unit 115 stores, in the storage unit 111, information specifying whether the notification is valid or invalid for each terminal device 52 with respect to the notification of the alert according to the detection rule stored in the storage unit 111. Remember. In the present embodiment, the information is included in the alert rule, and may be, for example, flag information. Further, in the analyzer 41, the erroneous detection control unit 115 stores information specifying an invalid period of an alert that has been disabled and stopped for a certain period in an alert rule stored in the storage unit 111.
In the present embodiment, a state in which the notification of the alert is invalid is also referred to as a “suppressed” state.

In the analyzer 41, the erroneous detection control unit 115 determines, based on the information stored in the storage unit 111, a notification of an alert that is invalid and stopped for a certain period of time has passed. The erroneous detection control unit 115 performs such a determination at, for example, a fixed time interval.
Then, in the analysis device 41, when the erroneous detection control unit 115 determines that there is a notification of an alert whose invalid suspension period has elapsed, the erroneous detection control unit 115 re-enables the notification of the alert and suspends the application. The notification of the alert is applied to the terminal device 52 again.

Here, as the detection rule applied when the notification of the alert corresponding to the detection rule for which the false detection is pointed out is restarted, for example, the same detection rule as before the notification of the alert is stopped is used.
As another example, the detection rule applied when the notification of the alert corresponding to the detection rule in which the false detection was pointed out is restarted is an improvement over the detection rule before the notification of the alert was stopped. A detection rule modified so as to be used may be used. Such a change of the detection rule may be manually performed on the side of the analysis device 41 based on the thinking of a human such as an analyst, or an AI (Artificial Intelligence) such as a machine learning (Machine Learning). ), Or may be automatically performed in the analyzer 41 based on a predetermined change rule. For example, when “erroneous detection” is selected in the terminal device 52, the erroneous detection control unit 115 may notify a predetermined person of the fact. Such notification may be performed by any method, and for example, one or more methods of screen display, audio output, printing on paper, transmission of e-mail, and the like may be used.

When machine learning is used as the AI, for example, techniques such as logistic regression, Bayesian filter, SVM (Support Vector Machine) and Deep Learning may be used.
The analysis device 41 or another device may be provided with a function unit (in this embodiment, also referred to as a “rule processing unit” for convenience of description) that performs a process related to the change of the detection rule.
For example, based on data obtained in large quantities from a detection rule determined to be a false detection and a change result of the detection rule by an analyst, the rule processing unit combines the data with the customer information and uses the AI. Get the result of learning. Then, the rule processing unit may automatically perform detection rule change processing similar to that of an analyst using the result of such learning.
For example, an analyst may check the detection rule changed by the AI.
For example, the rule processing unit may confirm, by the AI, a detection rule newly created or changed by the analyst.

As an example of the erroneous detection, the analysis device 41 correctly detects an attack on the terminal device 52 based on the detection rule, but a tool targeted by the attack is not used in a customer environment such as the terminal device 52. There are cases. In other words, there is a case where an attack for exploiting a vulnerability of a tool not used in the customer environment comes to the terminal device 52 in the customer environment. In this case, for example, the analyzer 41 may automatically determine “false detection” for the generated alert. Here, the customer environment includes not only the terminal device 52 but also devices other than the terminal device 52, such as a server device.
Alternatively, the analysis device 41 correctly detects an attack on the terminal device 52 based on the detection rule, but if the tool targeted by the attack is not used in a customer environment such as the terminal device 52, an alert is issued. When notifying the terminal device 52 of this information, the terminal device 52 may be notified that the selection of “false detection” is recommended and the reason for recommending the selection of “false detection”. In this case, in the terminal device 52, the user looks at the content of such a notification and determines whether or not to select “false detection”.
Here, the analysis device 41 correctly detects an attack based on the detection rule, but the target tool targeted by the attack is not used in the customer environment such as the terminal device 52. For example, in the customer environment, When the SQL server is not used, there is a case where an SQL injection attack is made and an SQL injection alert is sent from the log detection device 51 to the analysis device 41.

<Selection of "Not applicable">
In the analysis device 41, when the information received from the terminal device 52 indicates “out of target”, the erroneous detection control unit 115 stops notification of an alert by a detection rule that generates an alert related to the out of target.
In the present embodiment, in the analyzer 41, such a stop of the notification of the alert is performed for the terminal device 52 for which “out of target” is selected, and is not performed for the other terminal devices. That is, even for the same detection rule, the notification of the alert is stopped for the terminal device 52 for which the notification of the alert by the detection rule is not a target.
In the analysis device 41, the erroneous detection control unit 115 may store, in the storage unit 111, information for specifying whether or not the detection rule stored in the storage unit 111 is not a target for each terminal device 52. . As the information, for example, information on an alert rule may be used.

Although the analyzer 41 correctly detects an attack based on the detection rule, if the target tool targeted by the attack is not used in a customer environment such as the terminal device 52, the analyzer 41 may, for example, generate an attack. For the alert that has been set, the selection of “not applicable” may be automatically determined.
Alternatively, when notifying the terminal device 52 of the alert information, the analysis device 41 may notify the terminal device 52 that “out of target” is recommended and the reason for recommending “out of target”. In this case, in the terminal device 52, the user looks at the content of such a notification and determines whether or not to select “not applicable”.

Further, although the analysis device 41 correctly detects an attack based on the detection rule, if the target tool targeted by the attack is not used in a customer environment such as the terminal device 52, the user at the terminal device 52 When “erroneous detection” is selected, the analyzer 41 may automatically confirm the selection of “out of target” for the generated alert, for example. In such a configuration, in the analysis device 41, the management unit 116 stores information for specifying whether the tool is used in the terminal device 52 in the storage unit 111 and manages the information. Then, in the analysis device 41, for the terminal device 52 in which the alert has occurred, the “false detection” by the user is performed based on the information that specifies whether the tool is used and the detection rule that caused the alert. It is determined whether or not the designation is changed to “out of target”, and in a predetermined case, the change is performed.
As another example, the analysis device 41 or a person such as an analyst determines that a certain alert has been designated as “false detection” by the user of the terminal device 52 but may fall under “not applicable” ( If the determination is made, the analysis device 41 confirms whether or not to change the "false detection" to "not applicable" for the user, and then makes the change in response to the permission of the user. , A configuration may be used.

In the present embodiment, “false detection” and “out of target” are provided. For example, “false detection” and “out of target” both stop notification of an alert by a detection rule. It may be. For example, the difference between the “false detection” and the “non-target” may differ only in the period in which the notification of the alert is stopped. As an example, the suspension period of the alert notification due to “false detection” may be a finite value (for example, one month) and the suspension period of the alert notification due to “not applicable” may be permanent.

Here, in the present embodiment, in the alert details, the case where the alert information about the log in the “suppressed” status is also displayed, but as another example, the information of the alert in the “suppressed” status is displayed. A mode that is not displayed may be used.

FIG. 5 is a diagram illustrating an example of the display content 2211 of the alert search according to the embodiment of the present invention.
The display content 2211 is the content of a screen for searching for an alert. The display content 2211 is displayed on the screen of the display unit 214 in the terminal device 52. The display content 2211 may differ for each terminal device 52, for example.

The display content 2211 is based on information provided from the analyzer 41 to the terminal device 52, for example.
As an example, the display content 2211 may be generated on the analysis device 41 side and provided from the analysis device 41 to the terminal device 52. As another example, the display content 2211 is generated based on the information stored in the storage unit 216 in the terminal device 52 after the information provided from the analysis device 41 to the terminal device 52 is stored in the storage unit 216. Is also good. Note that the display content 2211 may include other information.

(5) In the example of FIG. 5, it is possible to select a range of date and time, a range of importance, a type of sensor, and a range of correspondence status as search conditions.

The date and time range is specified at the start and end times. The start time and the end time are each specified by, for example, a date. In the example of FIG. 5, a range from “April 1, 2018 to May 1, 2018” is specified.
The importance is designated in three stages from large to small, large, medium, and small. A plurality of different degrees of importance may be specified.
The type of sensor is specified using the name of an individual sensor or the like. A plurality of different sensors may be specified.
The response status is specified from among a plurality of items. Two or more different items may be specified. In the example of FIG. 5, the response status includes “not responded”, “under investigation”, “responded”, “pending”, “under response”, “false detection”, “suppression”, and “not applicable”.

In the terminal device 52, search conditions are set on the alert search screen according to the operation of the operation unit 213 performed by the user.
The display content 2211 also displays a search button 2221. When the button 2221 is pressed based on the operation of the operation unit 213 performed by the user, information specifying the selected search condition is transmitted from the terminal device 52 to the analysis device 41.
In the present embodiment, in the terminal device 52, the search control unit 233 performs overall control for alert search.

The analysis device 41 receives the information that specifies the search condition transmitted from the terminal device 52. In the analyzer 41, the management unit 116 refers to the information on the alert stored in the storage unit 111 based on the search condition specified by the received information, and matches the search condition with the search processing unit 151. Search for alerts that have been sent. Then, the management unit 116 generates information indicating a result of the search by the search processing unit 151, and notifies the terminal device 52 of the information by the notification unit 114. In the present embodiment, when searching for an alert, the management unit 116 may use the search processing unit 151 to determine the status of “inhibited” or the status of “not applicable” by referring to the contents of the alert rule.

[Communication between terminal device and analyzer]
In the present embodiment, in the log analysis service, the terminal device 52 and the analysis device 41 may execute processing on demand. For example, in response to a request issued from the terminal device 52, a process for satisfying the request may be executed by the analyzer 41.

[Special tool]
In the present embodiment, a dedicated tool (also referred to as a “dedicated tool” for convenience of description) may be used in the terminal device 52. That is, some or all of the functions of the terminal device 52 may be configured using the dedicated tool. The dedicated tool may be, for example, software such as a program.
For example, in the terminal device 52, one or more functions of the notification reception control unit 231, the instruction transmission control unit 232, and the search control unit 233 may be configured as functions of a dedicated tool. The dedicated tool may be distributed, for example, for a fee or free of charge by a management entity of the analysis unit 11 or the like. The management tool, for example, is installed in the terminal device 52 and performs its function.

[Process Performed in Analysis System]
FIG. 6 is a diagram illustrating an example of a procedure of a process performed in the terminal device 52 according to an embodiment of the present invention.
In the example of FIG. 6, when the terminal device 52 receives the notification of the alert, the corresponding status is selected.

(Step S1)
In the terminal device 52, the notification reception control unit 231 receives the notification of the alert transmitted from the analysis device 41. Then, the process proceeds to the process in step S2.

(Step S2)
In the terminal device 52, the notification reception control unit 231 displays the received notification of the alert. In this example, it is assumed that, after the display content 2011 of the alert list is displayed on the terminal device 52, the display content 2111 of the alert details is displayed by a user operation. Then, the process proceeds to the process in step S3.

(Step S3)
In the terminal device 52, the instruction transmission control unit 232 determines whether or not the user has performed an operation of selecting a corresponding state. In the example of FIG. 4, the operation is pressing of the determination button 2131 in a state where the correspondence status is specified.
As a result, in the terminal device 52, when the instruction transmission control unit 232 determines that the user has performed an operation of selecting a corresponding state (Step S3: YES), the process proceeds to Step S4.
On the other hand, in the terminal device 52, when the instruction transmission control unit 232 determines that the user has not performed the operation of selecting the corresponding state (step S3: NO), the processing of this flow is ended.

(Step S4)
In the terminal device 52, the instruction transmission control unit 232 transmits, to the analysis device 41, information that specifies an instruction to select a response status accepted by an operation performed by the user. Then, the processing of this flow ends.

FIG. 7 is a diagram illustrating an example of a procedure of a process performed in the analyzer 41 according to an embodiment of the present invention.
In the example of FIG. 7, the analysis device 41 analyzes the log.

(Step S21)
In the analyzing device 41, the acquiring unit 112 receives and acquires the log transmitted from the log detecting device 51 by the receiving unit 131. In the present embodiment, such a log is always received. Then, the process proceeds to the process in step S22.

(Step S22)
In the analyzer 41, the analysis executing unit 113 analyzes the received log based on the analysis conditions. The analysis executing unit 113 determines, for example, a log that meets a predetermined detection rule as a log having a problem. Then, the process proceeds to the process in step S23.

(Step S23)
In the analysis device 41, the notification unit 114 notifies the terminal device 52 of information on the result of the analysis performed by the analysis execution unit 113. Then, the processing of this flow ends.
In the present embodiment, based on the alert rule, an alert requiring notification is notified from the notification unit 114 to the terminal device 52, and an alert not requiring notification is not notified from the notification unit 114 to the terminal device 52.

FIG. 8 is a diagram illustrating an example of a procedure of a process performed in the analyzer 41 according to the embodiment of the present invention.
In the example of FIG. 8, the analysis device 41 performs a process related to selection of “false detection”. In the present embodiment, the process related to the selection of “out of target” may be the same as the process related to the selection of “false detection”.

(Step S41)
In the analysis device 41, the management unit 116 receives a notification that “false detection” has been selected for the alert in the terminal device 52. Then, the process proceeds to the process of step S42.

(Step S42)
In the analysis device 41, the erroneous detection control unit 115 stops the notification of the alert according to the detection rule that generates the alert in which “false detection” is selected, for the notification source that is the terminal device 52 in which “false detection” is selected. . In this example, it is assumed that a suspension period of the alert is set. Then, the process proceeds to the process of step S43.
In the present embodiment, for example, among the detection rules common to many terminal devices 52, notification of an alert by the detection rule is stopped for the terminal device 52 for which “false detection” is selected.

(Step S43)
In the analyzer 41, the erroneous detection control unit 115 determines whether or not the suspension period has elapsed with respect to the notification of the suspended alert.
As a result, in the analyzer 41, when the erroneous detection control unit 115 determines that the suspension period has elapsed with respect to the notification of the alert during suspension (step S43: YES), the processing proceeds to step S44.
On the other hand, in the analyzer 41, when the erroneous detection control unit 115 determines that the suspension period has not elapsed for the notification of the suspended alert (step S43: NO), the processing of step S43 is repeated.

(Step S44)
In the analyzer 41, when the erroneous detection control unit 115 determines that the suspension period has elapsed for the notification of the suspended alert, the erroneous detection control unit 115 restarts the notification of the alert for the corresponding terminal device 52. Then, the processing of this flow ends.

FIG. 9 is a diagram illustrating an example of a procedure of a process performed in the analyzer 41 according to an embodiment of the present invention.
In the example of FIG. 9, the analysis device 41 performs a process related to the change of the detection rule.
In the present embodiment, a case will be described in which the management unit 116 can change the detection rule stored in the storage unit 111 in accordance with an instruction from an analyst or the like in the analyzer 41. As another example, a configuration in which the change of the detection rule stored in the storage unit 111 of the analysis device 41 is performed by access from a device different from the analysis device 41 may be used.

(Step S61)
In the analysis device 41, the management unit 116 determines whether or not an instruction to change the corresponding detection rule has been received for the alert for which the notification of “false detection” has been received from the terminal device 52. In the present example, the instruction may be, for example, an instruction given to the analyzer 41 by a person such as an analyst or an instruction automatically given by a device such as the analyzer 41.
As a result, in the analysis device 41, when the management unit 116 determines that the instruction to change the detection rule has been received (step S61: YES), the process proceeds to step S62.
On the other hand, in the analyzer 41, when the management unit 116 determines that the instruction to change the detection rule has not been received (step S61: NO), the processing of this flow ends.

(Step S62)
In the analyzer 41, the management unit 116 changes the corresponding detection rule according to the received instruction. Then, the processing of this flow ends.

Here, in the present embodiment, the detection rule for generating an alert indicating “false detection” in a certain terminal device 52 is changed in common for a plurality of terminal devices including the terminal device 52 and other terminal devices. Is also good. The plurality of terminal devices may be, for example, all terminal devices to which the detection rule before the change is applied, or may be some terminal devices.
As another example, the detection rule for generating an alert indicating “false detection” in a certain terminal device 52 may be changed only for the terminal device 52.

[Alerts and detection rules and status]
In the present embodiment, it has been described that the alert and the detection rule correspond one-to-one. The description has been made assuming that the detection rule, the alert, and the alert rule correspond one-to-one. In this case, based on the correspondence between the alert and the alert rule and the correspondence between the alert and the detection rule, the correspondence between the detection rule and the valid / invalid status of the notification (contents of the alert rule) is specified. Similarly, based on the correspondence between the detection rule and the alert rule, and the correspondence between the detection rule and the alert, the correspondence between the alert and the valid / invalid status of the notification (contents of the alert rule) is specified. In the analysis system 1 according to the present embodiment, the correspondence between the detection rule, the alert, and the alert rule is managed, so that the status of the notification of the alert corresponding to the detection rule is enabled / disabled.

として As another example, a plurality of different detection rules may be associated with one alert. In this case, in order to manage the situation selected for the alert, the analysis system 1 manages information that specifies the correspondence between the alert and the situation. Each alert is identified based on, for example, identification information given to each alert. When “false detection” is selected for a certain alert, for example, the notification of the alert may be set to “suppress” for the detection rule that generated the alert at that time. In other words, there may be a plurality of detection rules that generate the alert. For example, even if one of the detection rules that generated the alert at that time is set to the “suppressed” state. Good. Note that “out of target” may be the same as in the case of “false detection”.

[Example of Hardware Configuration of Information Processing Device]
FIG. 10 is a diagram illustrating an example of a hardware configuration of an information processing device 4001 according to an embodiment of the present invention.
An information processing device 4001 having a hardware configuration as shown in FIG. 10 may be used as the terminal device 52 or the analysis device 41 in the present embodiment.

In the example of FIG. 10, the information processing apparatus 4001 connects the processor 4011, the operation unit 4012, the display unit 4013, the storage device 4014, the memory 4015, the input / output interface 4016, the network interface 4017, and the like. A bus 4021 is provided.

The processor 4011 is configured from a CPU (Central Processing Unit) and the like, and executes a program to execute processing specified by the program.
The operation unit 4012 includes one or more input devices such as a keyboard and a mouse, and receives an operation performed by a user (person).
The display unit 4013 has a screen, and outputs information on the screen.

The storage device 4014 is a non-volatile storage unit, and is configured from, for example, a hard disk, and stores information.
The memory 4015 is a volatile storage unit and is configured from a RAM (Random Access Memory) or the like, and temporarily stores information. As the RAM, for example, a DRAM (Dynamic Random Access Memory) may be used.
The storage device 4014 or the memory 4015 may store, for example, information of a program executed by the processor 4011.

The input / output interface 4016 is an interface connected to an external recording medium or the like.
The network interface 4017 is an interface for connecting to an external network.

Here, the information processing device 4001 may include one processor as the processor 4011, or may include two or more processors. As an example, the information processing apparatus 4001 may include a plurality of CPUs, execute the respective processes by the respective CPUs, and realize the entire process in cooperation with the plurality of CPUs.

[Summary of Embodiment]
As described above, in the analysis system 1 according to the present embodiment, it is possible to efficiently cope with a case where a false detection occurs in a specific organization among a plurality of different customer organizations. In the analysis system 1 according to the present embodiment, the user of the terminal device 52 can prevent erroneous detection from being continued by a simple operation.
For example, the designer of the detection rule can obtain feedback information on false detection given by the user. Then, the designer of the detection rule can review the detection rule, for example, while the notification of the alert is suppressed by the detection rule. For example, a detection rule designer may manually generate improved detection rules based on the fed back information. For example, the designer of the detection rule may generate the improved detection rule by the machine learning device by causing the machine learning device to perform the machine learning of the information fed back. Thereby, for example, erroneous detection is reduced.
In the analysis system 1 according to the present embodiment, it is not always necessary to create a custom rule for each customer. In the analysis system 1 according to the present embodiment, a custom rule may be created for each customer.

Further, in the analysis system 1 according to the present embodiment, a suppressed alert can be searched. Thus, in the analysis system 1 according to the present embodiment, it is possible to grasp the number, frequency, tendency, and the like of cases in which useless notification can be suppressed.
For example, based on the number of suppressed alerts, it is possible to confirm the number of times the useless alert notification has been prevented.
For example, if there are no suppressed alerts, or if there are only a few alerts per month or less, the number of attack traffic that caused the alerts has decreased, or detection rules have been improved. Thus, it can be confirmed that the number of “false detection” alerts has been reduced.

In the present embodiment, the following configuration is used in a system for monitoring logs of customer devices for each of a plurality of customers.
That is, the system acquires a customer log and determines whether or not the customer log satisfies a predetermined condition. The system transmits predetermined information to the customer when it is determined that the log of the customer satisfies the predetermined condition. The predetermined information can receive a predetermined instruction from the customer. Then, in the system, when the predetermined instruction is received from the customer, the notification of the predetermined information for the customer is invalidated (a state of suppression). Note that the system may be called not only the analysis system 1 but also a monitoring system.

<Example of configuration>
As an example of the configuration, an acquisition unit (in the embodiment, the analysis device 41) that acquires target information (a log in the embodiment) related to the first terminal device (the terminal device 52 in the embodiment). In the present embodiment, an analysis execution unit (in the present embodiment, a function of the acquisition unit 112) and an analysis execution unit that determines whether the target information acquired by the acquisition unit satisfies the first condition (the detection rule in the present embodiment). And the function of the analysis execution unit 113), and a notification that notifies the first terminal device of the first information (in this embodiment, alert information) when the analysis execution unit determines that the target information satisfies the first condition. Unit (in the present embodiment, the function of the notifying unit 114), and the first information notified by the notifying unit from the first terminal device to the second information (in this embodiment, information of “false detection” or "Not applicable" information) The information receiving unit (in this embodiment, the function of the notifying unit 114) receives the second information from the first terminal device with respect to the first information, and notifies the first terminal device of the first information. And a notification suppression unit (in the present embodiment, the function of the erroneous detection control unit 115).

As one configuration example, in the analyzer, the first condition is a rule for detecting a problem, the first information is information on an alert corresponding to the problem, and the second information is an error about the alert. Is the information for instructing.
As an example of the configuration, in the analysis device, the notification suppression unit suspends the notification of the first information based on the first condition for the first terminal device for a predetermined period, and waits for the first condition after the predetermined period elapses. In the embodiment, the notification of the first information may be restarted by the same as before the stop or may have been changed.
As one configuration example, the analyzer includes a change unit (in the present embodiment, the management unit 116) that changes the first condition.
As an example of the configuration, the analyzer includes a management unit (the management unit 116 in the present embodiment) that manages the status of the notification of the first information based on the first condition. Including, the first information can be retrieved using the status of the notification.
As an example of the configuration, in the analysis device, the notification suppression unit determines the first terminal based on a second condition (in this embodiment, an alert rule) specifying that the notification of the first information to the first terminal device is suppressed. The notification of the first information to the device is suppressed.
As one configuration example, in the analyzer, the target information is a log related to security.

As an example of the configuration, in the terminal device (the terminal device 52 in the present embodiment), the first information notified from the analysis device when the analysis device determines that the target information regarding the terminal device satisfies the first condition. The notification reception control unit (in the present embodiment, the function of the notification reception control unit 231) that receives the notification of the notification, and a predetermined instruction for the first information received by the notification reception control unit (in the present embodiment, “error An instruction receiving unit (in this embodiment, a function of the operation unit 213 and a function of the instruction transmission control unit 232) that receives an instruction to select “detection” or an instruction to select “out of target”; The instruction transmission control unit (in the present embodiment, the instruction transmission control unit 2 transmits the second information including the instruction to suppress the notification of the first information to the terminal device when the instruction is accepted). It includes a function of 2), a.

Note that the present invention may be embodied in various forms such as a device such as a terminal device or an analysis device, a system such as an analysis system, a method such as an analysis method, a program, and a recording medium on which the program is recorded. The recording medium may be, for example, a temporary recording medium.

[Log Type]
In the present embodiment, the case where the log of the security sensor is used as the log to be analyzed has been described. As a log of a security sensor, for example, FW (FireWall), NGFW (New Generation FireWall), IPS (Intrusion presentation system), IDS (Intrusion Detection System), UTM (UnificationWatation, WAT, WAT, WF, etc.) There is a log.

As an example, the device that detects logs may be an intrusion prevention system (IPS) device that prevents unauthorized intrusion in a computer network. For example, the device may detect a log that may be related to fraud.
As another example, the device that detects the log may be a device of a firewall (FW) that blocks communication that should not be passed. For example, the device may detect both logs that may be related to fraud and logs that are not related to fraud.
In general, when comparing the IPS with the firewall, it is easy to increase the amount of data because there is a log of a signal passed through the firewall, and it can be said that the IPS has a higher density of logs that may have a problem. .

Other logs can be used as logs to be analyzed. Other logs include, for example, an authentication log, an error log, a terminal scan log, a communication log, a program operation log, and an application operation log.
Examples of the authentication log include logs such as Active Directory, BIND (Berkeley Internet Name Domain), and DNS (Domain Name System).
The error log includes, for example, a log such as WinEvt.
Examples of the terminal scan log include logs such as antivirus and EDR (Endpoint Detection and Response).
As communication logs, there are logs such as Proxy, mail, File access, and database (DB: DataBase) access.
Examples of the program operation log include a log such as a boot log and dmesg. Examples of the application operation log include logs such as an event log and a unique log.

In the present embodiment, a case is described in which a log is used as an analysis target. However, information other than a log can be used as an analysis target.
The information other than the log includes, for example, information on the setting of an operating system (OS).
Examples of the OS setting information include registry information.
Further, for example, a web browsing history, an operation history, or a log-in history may be used.

In the present embodiment, a case where one type of log is detected by one log detection device 51 has been described. However, a configuration in which two or more log detection devices are provided and two or more types of logs are detected is used. You may.
The log detection device may be provided, for example, outside the terminal device 52, or may be provided as a function inside the terminal device 52.

For example, information of a plurality of different types of logs may be stored in a form mixed in chronological order. For example, information for identifying a sensor that has detected each log is added to each log. The logs can be distinguished based on the information. This makes it possible to extract information of a predetermined type of log from information in which information of a plurality of different types of logs is mixed.

In the analyzer 41, the analysis of the logs by the analysis executing unit 113 may be performed, for example, for each type of log, or may be performed collectively for two or more types of logs.

As described above, a program for realizing the function of each device (for example, the terminal device 52, the analyzer 41, and the like) according to the embodiment is recorded (stored) in a computer-readable recording medium (storage medium). Processing can be performed by causing a computer system to read and execute the program recorded on the recording medium.
Here, the “computer system” may include an operating system or hardware such as a peripheral device.
The “computer-readable recording medium” includes a flexible disk, a magneto-optical disk, a writable nonvolatile memory such as a ROM (Read Only Memory), a flash memory, a portable medium such as a DVD (Digital Versatile Disc), A storage device such as a hard disk built in a computer system.
Further, a “computer-readable recording medium” refers to a volatile memory (for example, DRAM) in a computer system serving as a server or a client when a program is transmitted through a network such as the Internet or a communication line such as a telephone line. ) As well as those that hold programs for a certain period of time.
Further, the above program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting a program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line.
Further, the above program may be a program for realizing a part of the functions described above. Further, the above program may be a program that can realize the above-described functions in combination with a program already recorded in the computer system, that is, a so-called difference file (difference program).

Although the present invention has been described with reference to the embodiment, the technical scope of the present invention is not limited to the above embodiment. It will be apparent to those skilled in the art that various modifications and alternative embodiments can be made without departing from the spirit and scope of the invention.

DESCRIPTION OF SYMBOLS 1 ... Analysis system 11 ... Analysis part 21-23 ... Terminal part 31 ... Network 41 ... Analysis apparatus 42 ... Web server apparatus 43 ... Mail server apparatus 51 ... Log detection apparatus 52 ...

Terminal apparatus

111, 216 ... Storage part 112 ... Acquisition part 113 analysis execution unit 114 notification unit 115 erroneous detection control unit 116 management unit 131 reception unit 151 search processing unit 211 input unit 212

output units

213 and 4012

operation units

214 and 4013 display unit 215 Communication section 217 Control section 231 Notification reception control section 232 Instruction transmission control section 233

Search control section

2011, 2111, 2211 Display contents 2121 Attribute area 2122 Corresponding status area 2123

Content area

2131, 2221 Button 4001 ... Information processing device 4011 ... Processor 4014 ... Storage device 4015 ... Memory 4016 ... Input / output Interface 4017: Network interface

Claims

An acquisition unit that acquires target information about the first terminal device;
An analysis execution unit that determines whether the target information acquired by the acquisition unit satisfies a first condition;
A notifying unit that notifies the first terminal device of first information when the analysis execution unit determines that the target information satisfies the first condition;
An information receiving unit that receives second information from the first terminal device with respect to the first information notified by the notifying unit;
A notification suppression unit that suppresses notification of the first information to the first terminal device when the second information is received from the first terminal device for the first information;
With
The notification suppressing unit stops the notification of the first information based on the first condition for a predetermined period of time for the first terminal device, and notifies the first information based on the first condition after the predetermined period has elapsed. Resume,
Analysis equipment.
An acquisition unit that acquires target information about the first terminal device;
An analysis execution unit that determines whether the target information acquired by the acquisition unit satisfies a first condition;
A notifying unit that notifies the first terminal device of first information when the analysis execution unit determines that the target information satisfies the first condition;
An information receiving unit that receives second information from the first terminal device with respect to the first information notified by the notifying unit;
A notification suppression unit that suppresses notification of the first information to the first terminal device when the second information is received from the first terminal device for the first information;
A management unit that manages a status of notification of the first information according to the first condition;
With
The situation includes at least a situation of being deterred,
The first information can be searched using the status of the notification,
Analysis equipment.
An acquisition unit that acquires target information about the first terminal device;
An analysis execution unit that determines whether the target information acquired by the acquisition unit satisfies a first condition;
A notifying unit that notifies the first terminal device of first information when the analysis execution unit determines that the target information satisfies the first condition;
An information receiving unit that receives second information from the first terminal device with respect to the first information notified by the notifying unit;
A notification suppression unit that suppresses notification of the first information to the first terminal device when the second information is received from the first terminal device for the first information;
With
The notification suppression unit suppresses the notification of the first information to the first terminal device based on a second condition specifying that the notification of the first information to the first terminal device is suppressed,
Analysis equipment.
An acquisition unit that acquires target information about the first terminal device;
An analysis execution unit that determines whether the target information acquired by the acquisition unit satisfies a first condition;
A notifying unit that notifies the first terminal device of first information when the analysis execution unit determines that the target information satisfies the first condition;
An information receiving unit that receives second information from the first terminal device with respect to the first information notified by the notifying unit;
A notification suppression unit that suppresses notification of the first information to the first terminal device when the second information is received from the first terminal device for the first information;
With
The target information is a log related to security,
Analysis equipment.
The first condition is a rule for detecting a problem,
The first information is information of an alert corresponding to the problem,
The second information is information indicating that there is an error in the alert,
The analyzer according to any one of claims 1 to 4.
A changing unit for changing the first condition,
The analyzer according to any one of claims 1 to 5.
It is determined that the analysis device satisfies the first condition with respect to the target information regarding the terminal device having a detection device that detects the target information regarding the terminal device and uses the log regarding security as the target information and transmits the target information to the analysis device. A notification reception control unit that receives a notification of the first information related to the security notified from the analysis device when the notification is performed;
An instruction receiving unit that receives a predetermined instruction related to the security with respect to the first information received by the notification reception control unit;
An instruction transmission control unit configured to transmit, to the analyzer, second information including an instruction to suppress notification of the first information regarding the security to the terminal device when the instruction is received for the first information; and ,
The terminal device comprising:
The first condition is a rule for detecting a problem,
The first information is information of an alert corresponding to the problem,
The second information is information indicating that there is an error in the alert,
The terminal device according to claim 7.
An analysis system including a first terminal device and an analysis device,
An acquisition unit configured to acquire target information on the first terminal device;
An analysis execution unit that determines whether the target information acquired by the acquisition unit satisfies a first condition;
A notifying unit that notifies the first terminal device of first information when the analysis execution unit determines that the target information satisfies the first condition;
An information receiving unit that receives second information from the first terminal device with respect to the first information notified by the notifying unit;
A notification suppression unit that suppresses notification of the first information to the first terminal device when the second information is received from the first terminal device for the first information;
With
The first terminal device, a notification reception control unit that receives a notification of the first information notified from the analysis device,
An instruction receiving unit that receives a predetermined instruction for the first information received by the notification reception control unit;
An instruction transmission control unit configured to transmit the second information to the analyzer when the instruction is received for the first information;
With
The notification suppressing unit stops the notification of the first information based on the first condition for a predetermined period of time for the first terminal device, and notifies the first information based on the first condition after the predetermined period has elapsed. Resume,
Analysis system.
An analysis system including a first terminal device and an analysis device,
An acquisition unit configured to acquire target information on the first terminal device;
An analysis execution unit that determines whether the target information acquired by the acquisition unit satisfies a first condition;
A notifying unit that notifies the first terminal device of first information when the analysis execution unit determines that the target information satisfies the first condition;
An information receiving unit that receives second information from the first terminal device with respect to the first information notified by the notifying unit;
A notification suppression unit that suppresses notification of the first information to the first terminal device when the second information is received from the first terminal device for the first information;
A management unit that manages a status of notification of the first information according to the first condition;
With
The first terminal device, a notification reception control unit that receives a notification of the first information notified from the analysis device,
An instruction receiving unit that receives a predetermined instruction for the first information received by the notification reception control unit;
An instruction transmission control unit configured to transmit the second information to the analyzer when the instruction is received for the first information;
With
The situation includes at least a situation of being deterred,
The first information can be searched using the status of the notification,
Analysis system.
An analysis system including a first terminal device and an analysis device,
An acquisition unit configured to acquire target information on the first terminal device;
An analysis execution unit that determines whether the target information acquired by the acquisition unit satisfies a first condition;
A notifying unit that notifies the first terminal device of first information when the analysis execution unit determines that the target information satisfies the first condition;
An information receiving unit that receives second information from the first terminal device with respect to the first information notified by the notifying unit;
A notification suppression unit that suppresses notification of the first information to the first terminal device when the second information is received from the first terminal device for the first information;
With
The first terminal device, a notification reception control unit that receives a notification of the first information notified from the analysis device,
An instruction receiving unit that receives a predetermined instruction for the first information received by the notification reception control unit;
An instruction transmission control unit configured to transmit the second information to the analyzer when the instruction is received for the first information;
With
The notification suppression unit suppresses the notification of the first information to the first terminal device based on a second condition specifying that the notification of the first information to the first terminal device is suppressed,
Analysis system.
An analysis system including a first terminal device and an analysis device,
An acquisition unit configured to acquire target information on the first terminal device;
An analysis execution unit that determines whether the target information acquired by the acquisition unit satisfies a first condition;
A notifying unit that notifies the first terminal device of first information when the analysis execution unit determines that the target information satisfies the first condition;
An information receiving unit that receives second information from the first terminal device with respect to the first information notified by the notifying unit;
A notification suppression unit that suppresses notification of the first information to the first terminal device when the second information is received from the first terminal device for the first information;
With
The first terminal device, a notification reception control unit that receives a notification of the first information notified from the analysis device,
An instruction receiving unit that receives a predetermined instruction for the first information received by the notification reception control unit;
An instruction transmission control unit configured to transmit the second information to the analyzer when the instruction is received for the first information;
With
The target information is a log related to security,
Analysis system.
The first condition is a rule for detecting a problem,
The first information is information of an alert corresponding to the problem,
The second information is information indicating that there is an error in the alert,
The analysis system according to any one of claims 9 to 12.
The analyzer includes a changing unit that changes the first condition,
The analysis system according to any one of claims 9 to 13.
An analysis method in an analysis system including a first terminal device and an analysis device,
The analyzer acquires target information regarding the first terminal device, determines whether the obtained target information satisfies a first condition, and determines that the target information satisfies the first condition. In the case, the first information is notified to the first terminal device,
The first terminal device receives the notification of the first information notified from the analysis device, and analyzes the second information when a predetermined instruction is received for the received first information. To the device,
The analyzer, when the second information is received from the first terminal device, suppresses the notification of the first information to the first terminal device,
The analyzer, as the suppression of the notification, stops the notification of the first information according to the first condition for a predetermined period of time for the first terminal device, and executes the first condition after the predetermined period has elapsed according to the first condition. Restart notification of the first information;
Analysis method.
An analysis method in an analysis system including a first terminal device and an analysis device,
The analyzer acquires target information regarding the first terminal device, determines whether the obtained target information satisfies a first condition, and determines that the target information satisfies the first condition. In the case, the first information is notified to the first terminal device,
The first terminal device receives the notification of the first information notified from the analysis device, and analyzes the second information when a predetermined instruction is received for the received first information. To the device,
The analyzer, when the second information is received from the first terminal device, suppresses the notification of the first information to the first terminal device,
The analyzer manages a status of notification of the first information according to the first condition,
The situation includes at least a situation of being deterred,
The first information can be searched using the status of the notification,
Analysis method.
An analysis method in an analysis system including a first terminal device and an analysis device,
The analyzer acquires target information regarding the first terminal device, determines whether the obtained target information satisfies a first condition, and determines that the target information satisfies the first condition. In the case, the first information is notified to the first terminal device,
The first terminal device receives the notification of the first information notified from the analysis device, and analyzes the second information when a predetermined instruction is received for the received first information. To the device,
The analyzer, when the second information is received from the first terminal device, suppresses the notification of the first information to the first terminal device,
The analyzer, as the suppression of the notification, based on a second condition specifying that the notification of the first information to the first terminal device is suppressed, based on a second condition that specifies the notification of the first information to the first terminal device Suppress,
Analysis method.
An analysis method in an analysis system including a first terminal device and an analysis device,
The analyzer acquires target information regarding the first terminal device, determines whether the obtained target information satisfies a first condition, and determines that the target information satisfies the first condition. In the case, the first information is notified to the first terminal device,
The first terminal device receives the notification of the first information notified from the analysis device, and analyzes the second information when a predetermined instruction is received for the received first information. To the device,
The analyzer, when the second information is received from the first terminal device, suppresses the notification of the first information to the first terminal device,
The target information is a log related to security,
Analysis method.
The first condition is a rule for detecting a problem,
The first information is information of an alert corresponding to the problem,
The second information is information indicating that there is an error in the alert,
The analysis method according to any one of claims 15 to 18.
The analyzer changes the first condition;
The analysis method according to any one of claims 15 to 19.
In the computer that constitutes the analyzer,
A function of acquiring target information on the first terminal device;
A function of determining whether or not the acquired target information satisfies a first condition;
A function of notifying the first terminal device of the first information when it is determined that the target information satisfies the first condition;
A function of receiving the second information from the first terminal device with respect to the notified first information, and a process of receiving the second information from the first terminal device with respect to the first information. A function of suppressing notification of the first information to one terminal device;
Is a program for realizing
The function of suppressing the notification is configured to stop the notification of the first information based on the first condition for a predetermined period of time for the first terminal device, and to execute the first information based on the first condition after the predetermined period has elapsed. To resume notifications for,
program.
In the computer that constitutes the analyzer,
A function of acquiring target information on the first terminal device;
A function of determining whether or not the acquired target information satisfies a first condition;
A function of notifying the first terminal device of the first information when it is determined that the target information satisfies the first condition;
A function of receiving the second information from the first terminal device with respect to the notified first information, and a process of receiving the second information from the first terminal device with respect to the first information. A function of suppressing notification of the first information to one terminal device;
A function of managing a status of notification of the first information according to the first condition;
Is a program for realizing
The situation includes at least a situation of being deterred,
The first information can be searched using the status of the notification,
program.
In the computer that constitutes the analyzer,
A function of acquiring target information on the first terminal device;
A function of determining whether or not the acquired target information satisfies a first condition;
A function of notifying the first terminal device of the first information when it is determined that the target information satisfies the first condition;
A function of receiving the second information from the first terminal device with respect to the notified first information, and a process of receiving the second information from the first terminal device with respect to the first information. A function of suppressing notification of the first information to one terminal device;
Is a program for realizing
The function of suppressing the notification suppresses the notification of the first information to the first terminal device based on a second condition specifying that the notification of the first information to the first terminal device is suppressed.
program.
In the computer that constitutes the analyzer,
A function of acquiring target information on the first terminal device;
A function of determining whether or not the acquired target information satisfies a first condition;
A function of notifying the first terminal device of the first information when it is determined that the target information satisfies the first condition;
A function of receiving the second information from the first terminal device with respect to the notified first information, and a process of receiving the second information from the first terminal device with respect to the first information. A function of suppressing notification of the first information to one terminal device;
Is a program for realizing
The target information is a log related to security,
program.
The first condition is a rule for detecting a problem,
The first information is information of an alert corresponding to the problem,
The second information is information indicating that there is an error in the alert,
The program according to any one of claims 21 to 24.
Further, the program is a program for realizing a function of changing the first condition.
The program according to any one of claims 21 to 25.
A computer configuring the terminal device having a detection device that detects the target information related to the terminal device with a log related to security and transmits the target information to the analysis device,
A function of receiving a notification of the first information related to the security notified from the analyzer when the target information regarding the terminal device is determined to satisfy a first condition by the analyzer;
A function of receiving a predetermined instruction related to the security with respect to the received first information,
A function of transmitting, to the analyzer, second information including an instruction to suppress notification of the first information regarding the security to the terminal device when the instruction is received for the first information;
The program to realize.
The first condition is a rule for detecting a problem,
The first information is information of an alert corresponding to the problem,
The second information is information indicating that there is an error in the alert,
A program according to claim 27.