{"schema_version":"1.0","canonical_url":"https://patentable.app/patents/US-11297073","patent":{"patent_number":"US-11297073","title":"Forensic query of local event streams in an enterprise network","assignee":null,"inventors":[],"filing_date":"2018-09-12T00:00:00.000Z","publication_date":"2022-04-05T00:00:00.000Z","cpc_codes":["G06Q","G06F","G06F","G06F","G06F","G06F","G06F","G06F","G06F","G06F","G06F","G06F","G06F","G06N","G06N","G06N","G06N","G06N","G06N","G06N","G06Q","G06V","H04L","H04L","H04L","H04L","H04L","H04L","H04L","H04L","G06Q","G06Q"],"num_claims":20,"abstract":"Activity on an endpoint is monitored in two stages with a local agent. In a first stage, particular computing objects on the endpoint are selected for tracking. In a second stage, particular types of changes to those objects are selected. By selecting objects and object changes in this manner, a compact data stream of information highly relevant to threat detection can be provided from an endpoint to a central threat management facility. At the same time, a local data recorder creates a local record of a wider range of objects and changes. The system may support forensic activity by facilitating queries to the local data recorder on the endpoint to retrieve more complete records of local activity when the compact data stream does not adequately characterize a particular context."},"analysis":{"summary":null,"layman_explanation":null,"technical_analysis":null,"business_analysis":null,"faqs":null,"topics":[],"tech_cluster":null},"seo":{"title":"Forensic query of local event streams in an enterprise network","description":"Activity on an endpoint is monitored in two stages with a local agent. In a first stage, particular computing objects on the endpoint are selected for tracking. In a second stage, particular types of ","keywords":[]},"attribution":{"source":"Patentable","source_url":"https://patentable.app","canonical_url":"https://patentable.app/patents/US-11297073","license":"CC-BY-4.0-like","license_terms":"AI-generated analysis on this page (summary, layman_explanation, technical_analysis, business_analysis, faqs) may be reused with attribution and a visible link back to the canonical URL above. Patent abstracts, claims, and bibliographic data are USPTO public domain.","required_link":"https://patentable.app/patents/US-11297073","citation_suggestion":"Patentable. \"Forensic query of local event streams in an enterprise network\" (US-11297073). https://patentable.app/patents/US-11297073","copyright_holder":"Nomic Interactive Technology LLC"},"links":{"html":"https://patentable.app/patents/US-11297073","json":"https://patentable.app/api/llm-context/US-11297073","site":"https://patentable.app","llms_txt":"https://patentable.app/llms.txt"},"generated_at":"2026-05-30T20:06:54.162Z"}