Event source management using a metadata-driven framework

Abstract

The system and method described herein relates to managing multiple network device connections, collecting event source data from one or more network devices with one or more collectors, filtering the event source data, continuously monitoring the network device connections, controlling raw data collection from the one or more network devices, parsing the event source data into normalized data structures, and managing configurations for the collectors, among other things. Event sources may be physical or logical network devices distributed across a network, including but not limited to, firewalls, routers, biometric devices, mainframes, databases, and applications. The network devices may be sources from which the collectors may receive or request the event source data.

What is claimed is: 
     
         1 . A collector framework system including at least one collector for collecting event data from one or more network devices, the system comprising:
 a collector manager for storing a collector script;   configuring means for configuring a collector based on the collector script;   a proxy manager for determining one or more network devices to connect to the collector based on the collector script, wherein the collector collects event data from the one or more network devices; and   receiving means for receiving the collected event data from the collector manager.   
     
     
         2 . The system of  claim 1 , wherein the configuring means further includes one or more user interfaces enabling a user to view collected event data. 
     
     
         3 . The system of  claim 1 , wherein the collector script is device specific. 
     
     
         4 . The system of  claim 1 , wherein the event data comprises security events, compliance events, or network traffic events. 
     
     
         5 . A computer based method including at least one collector for collecting event data from one or more network devices, comprising:
 configuring a collector process based on the collector script;   determining one or more network devices to connect to the collector based on the collector script, wherein the collector process collects event data from the one or more network devices; and   receiving the collected event data from a collector manager.   
     
     
         6 . The method of  claim 5 , wherein the configuring further includes one or more user interfaces enabling a user to view collected event data. 
     
     
         7 . The method of  claim 5 , wherein the collector script is device type specific. 
     
     
         8 . The method of  claim 5 , wherein the event data comprises security events, compliance events, or network traffic events.