System and method for ensuring and managing situation awareness

Abstract

Disclosed is a method and apparatus in which one or more data streams are sent to a computer and the data streams are sorted using a rule base into streams representative of events. The incoming data streams can be sent by hunter agents which search for specified types of data and forward the data to the computer. The incoming data stream can also be sent by a gatherer agent. The incoming data stream can also be incoming message traffic such as e-mail and other types of message traffic data. The incoming message traffic data is then sorted into event streams and can be displayed as event streams on a time line. Actions can be taken based upon specified events. Thus, events from disjointed sources can be sorted and displayed in a unified manner in which a user can readily and quickly know which events have occurred for a particular issue, such as a forest fire, hospital patient, etc.

What is claimed is:  
     
         1 . A method for monitoring an incoming data stream for specified events, comprising: 
 receiving at least one data stream at a computer, the data stream including data representative of events; and    applying rules to the data stream for sorting data representative of events and for taking an action based on a specified event.    
     
     
         2 . The method of  claim 1 , comprising displaying events associated with a selected data stream on a time line.  
     
     
         3 . The method of  claim 1 , comprising gathering data at a remote location and placing the gathered data in a data stream and forwarding the data stream to the computer.  
     
     
         4 . The method of  claim 3 , wherein said gathering step is performed by an agent.  
     
     
         5 . The method of  claim 1 , comprising hunting for predetermined data at a remote location and placing the hunted data in a data stream and forwarding the data stream to the computer.  
     
     
         6 . The method of  claim 5 , wherein said hunting step is performed by an agent.  
     
     
         7 . The method of  claim 5 , comprising normalizing the data before the data is placed in the data stream.  
     
     
         8 . The method of  claim 1 , wherein the at least one data stream includes message traffic.  
     
     
         9 . The method of  claim 5 , comprising linking the hunted data with a location where the hunted data was located.  
     
     
         10 . The method of  claim 9 , comprising updating the received hunted data with new hunted data as new data is received at the hunted data location.  
     
     
         11 . The method of  claim 6 , comprising constructing an event stream object which is forwarded to the computer by the agent.  
     
     
         12 . The method of  claim 11 , wherein the event stream object includes information descriptive of an event.  
     
     
         13 . The method of  claim 12 , wherein the information includes at least one of the following: the time that the event occurred; the duration that event covered; and key words that describe the event.  
     
     
         14 . The method of  claim 1 , comprising filing the sorted information in separate data stream files.  
     
     
         15 . The method of  claim 1 , wherein an event is comprised of at least one of the following elements: type, title, datetime, keywords, summary, priority and duration.  
     
     
         16 . The method of  claim 1 , wherein a rule includes a criteria component and an action component.  
     
     
         17 . The method of  claim 16 , wherein the criteria component includes at least one criteria statement and to satisfy a rule either all, any or none of the at least one criteria statements need to be satisfied.  
     
     
         18 . The method of  claim 17 , wherein at least one action is taken if the at least one rule is satisfied.  
     
     
         19 . The method of  claim 1 , wherein the data in the event data stream is received in a standardized format.  
     
     
         20 . The method of  claim 14 , comprising displaying an event stream using information stored in stored data stream files.  
     
     
         21 . The method of  claim 20 , comprising displaying an event stream using a received sorted data stream.  
     
     
         22 . An article comprising: 
 at least one sequence of machine executable instructions;    a medium bearing the executable instructions in machine readable form, wherein execution of the instructions by one or more processors causes the one or more processors to: 
 receive at least one data stream at a computer, the data stream including data representative of events; and  
 apply rules to the data stream for sorting data representative of events and for taking an action based on a specified event.  
   
     
     
         23 . The article of  claim 22 , comprising causing the processor to display events associated with a selected data stream on a time line.  
     
     
         24 . A computer architecture for monitoring an incoming data stream for specified events, comprising: 
 receiving means for receiving at least one data stream at a computer, the data stream including data representative of events; and    applying means for applying rules to the data stream for sorting data representative of events and for taking an action based on a specified event.    
     
     
         25 . The computer architecture of  claim 24 , comprising displaying means for displaying events associated with a selected data stream on a time line.  
     
     
         26 . A computer system, comprising: 
 a processor; and    a memory coupled to said processor, the memory having stored therein sequences of instructions, which, when executed by said processor, causes said processor to perform the steps of: 
 receiving at least one data stream at a computer, the data stream including data representative of events; and  
 applying rules to the data stream for sorting data representative of events and for taking an action based on a specified event.  
   
     
     
         27 . The computer system of  claim 26 , comprising causing the processor to display events associated with a selected data stream on a time line.