US patent US12748626
Method of handling a failure in a task pipeline between a source of alerts and a security incident and event management (SIEM) system
Abstract
A method of improving efficiency of processing alerts by a Security Incident & Event Management (SIEM) platform using a case creation platform, the method involves based upon contents of a configuration, creating a pipeline, comprising tasks, between a source of alerts and the SIEM platform, wherein, a task of the pipeline fails due to an exception, at least one object, including failed task input data, will be stored in an error log relating to the failure, and associated data will be stored in a task log, based upon additional content in the configuration, determining whether or not a rollback re-run can be attempted for the pipeline using at least a portion of tasks from a prior version/iteration of the pipeline; and if the rollback re-run can be attempted, executing the rollback re-run using the failed task input data.