Approaches to ingesting information regarding digital activities performed across different services and using the same for detecting threats
Introduced here is a network-accessible platform (or simply “platform”) that is designed to monitor digital activities that are performed across different services to ascertain, in real time, threats to the security of an enterprise. In order to surface insights into the threats posed to an enterprise, the platform can apply machine learning models to data that is representative of digital activities performed on different services with respective accounts. Each model may be trained to understand what constitutes normal behavior for a corresponding employee with respect to a single service or multiple services. Not only can these models be autonomously trained for the employees of the enterprise, but they can also be autonomously applied to detect, characterize, and catalog those digital activities that are indicative of a threat.
1 . A method performed by a threat detection platform for standardizing data relating to digital activities performed across multiple Software-as-a-Service (SaaS) services, the method comprising:
for each of the multiple SaaS services,
acquiring, via a corresponding one of multiple application programming interfaces (APIs), the data relating to the digital activities that are performed with a set of accounts associated with an enterprise,
wherein the set of accounts is one of multiple sets of accounts, each of which is associated with a corresponding one of the multiple SaaS services, and
wherein the enterprise has multiple employees, each of whom is associated with an account in each of the multiple sets of accounts, such that each employee is associated with multiple accounts;
canonicalizing the data such that multiple data structures are produced for the multiple SaaS services,
wherein each of the multiple data structures specifies, for a corresponding one of the multiple SaaS services,
(i) the corresponding set of accounts,
(ii) digital activities that were performed with the corresponding set of accounts, and
(iii) information regarding the corresponding set of accounts and/or the digital activities that were performed with the corresponding set of accounts; and
establishing a likelihood of compromise by:
for each of the multiple employees,
identifying the multiple accounts that are associated with that employee,
establishing entries across the multiple data structures that are associated with the multiple accounts,
applying, to the entries, a machine learnt model that is trained to understand what constitutes normal behavior of that employee with respect to the multiple SaaS services, and
determining the likelihood of compromise based on an output produced by the machine learnt model.
2 . The method of claim 1 , wherein said canonicalizing comprises:
for each of the multiple SaaS services,
implementing a corresponding one of multiple machine learnt models that act as standardization mechanisms for the multiple SaaS services,
wherein each machine learnt model produces, as output, a corresponding one of the multiple data structures.
3 . The method of claim 2 , wherein each of the multiple machine learnt models is designed and trained to act as a standardization mechanism for a specific one of the multiple SaaS services.
4 . The method of claim 1 , wherein each of the multiple data structures further specifies, for the corresponding one of the multiple SaaS services, (iv) an indication as to whether action should be taken by the threat detection platform on behalf of the enterprise.
5 . The method of claim 1 , wherein at least one of the multiple SaaS services is a communication SaaS service and at least one of the multiple SaaS services is a non-communication SaaS service.
6 . The method of claim 1 , further comprising:
in response to a determination that the likelihood of compromise for a given account among the multiple sets of accounts exceeds a threshold, performing a remediation action on behalf of the enterprise.
7 . The method of claim 6 , wherein said performing comprises:
transmitting an instruction to a given one of the multiple SaaS services that is associated with the given account.
8 . The method of claim 7 , wherein the instruction is representative of a request to (i) reset a password of the given account, (ii) terminate active sessions, if any, of the given account, or (iii) reset connections, if any, of the given account with a network associated with the enterprise.
9 . A method comprising:
for each of multiple Software-as-a-Service (SaaS) services that are accessible to employees of an enterprise,
acquiring data that is related to digital activities that are performed with one of multiple sets of accounts associated with the enterprise,
wherein each of the multiple sets of accounts is associated with a different one of the multiple SaaS services;
providing the data, as input, to a standardization mechanism that canonicalizes the data into a data structure having predetermined fields, so as to produce multiple data structures for the multiple SaaS services,
wherein the predetermined fields include—
(i) a first field or a first set of fields in which a corresponding set of accounts is specified,
(ii) a second field or a second set of fields in which digital activities that were performed with the corresponding set of accounts are specified,)
(iii) a third field or a third set of fields in which contextual information regarding the digital activities and/or the corresponding set of accounts is specified, and
(iv) a fourth field or a fourth set of fields in which indications whether remediation action should be taken are specified; and
determining a likelihood of compromise based on an analysis of the multiple data structures.
10 . The method of claim 9 , wherein the standardization mechanism is an application programming interface (API).
11 . The method of claim 9 , wherein the standardization mechanism is a machine learnt model.
12 . The method of claim 11 , further comprising:
for each of the multiple SaaS services accessible to the employees of the enterprise,
establishing, via an application programming interface (API), a connection with that SaaS service from which the data is acquired; and
downloading, from that SaaS service via the API, the data into a local processing environment.
13 . A non-transitory medium with instructions stored thereon that, when executed by a processor of a computing device, cause the processor to perform operations comprising:
establishing a separate connection with each of multiple Software-as-a-Service (SaaS) services that are accessible to employees of an enterprise via a corresponding one of multiple application programming interfaces (APIs),
wherein the multiple SaaS services include (i) a first SaaS service associated with a first set of accounts associated with the employees of the enterprise and (ii) a second SaaS service associated with a second set of accounts associated with the employees of the enterprise, and
wherein each of the employees is associated with an account in the first set of accounts and another account in the second set of accounts;
canonicalizing data received via the multiple APIs by populating the data, or analyses of the data, into at least one data structure having predetermined fields; and
determining, in real time, whether action is needed to address a threat to the enterprise by continually analyzing the at least one data structure.
14 . The non-transitory medium of claim 13 , wherein as part of said canonicalizing, the data acquired via each of the multiple APIs is populated into a different one of multiple data structures.
15 . The non-transitory medium of claim 13 , wherein said determining comprises:
for each of the employees,
applying a machine learnt model to entries in the at least one data structure that correspond to digital activities with accounts associated with that employee,
wherein the machine learnt model is trained to understand what constitutes normal behavior of that employee with respect to the multiple SaaS services.
16 . The non-transitory medium of claim 13 , wherein the operations further comprise:
receiving input that is indicative of an instruction to initiate a connection with a new SaaS service that is accessible to the employees of the enterprise;
establishing, in response to said receiving, the connection with the new SaaS service via an API; and
canonicalizing data received from the new SaaS service via the API by populating the data, or analyses of the data, into the at least one data structure having the predetermined fields.