Efficient management of analytics in analytics management service

1 . A computer-implemented method, comprising:

obtaining, by a first computer system, data representing an event associated with a tenant;

identifying an analytics pipeline corresponding to the tenant from among a set of analytics pipelines, each analytics pipeline of the set of analytics pipelines corresponding with a particular tenant of a plurality of tenants;

accessing, by the first computer system, the analytics pipeline corresponding to the tenant, the analytics pipeline including a sequence of analytic indicators referencing a set of cybersecurity analytics, from among cybersecurity analytics in an analytics pool, desired for use in analyzing the data representing the event, wherein the cybersecurity analytics in the analytics pool are available for use by the plurality of tenants;

applying, by the first computer system, the set of cybersecurity analytics from the analytics pool available to the plurality of tenants, referenced by the analytic indicators in the analytics pipeline, to the data to produce an analytic result, wherein each cybersecurity analytic in the analytics pool is configured to detect a cybersecurity-related anomaly or threat; and

providing, by the first computer system, the analytic result, or first data associated therewith, to an external user computer system.

2 . The computer-implemented method of claim 1 , wherein the data is obtained via a distributed messaging system.

3 . The computer-implemented method of claim 1 , wherein the analytics pipeline is identified based on identifying the tenant associated with the data representing the event.

4 . The computer-implemented method of claim 1 , wherein the cybersecurity analytics in the analytics pool comprise each analytic available for use by the plurality of tenants.

5 . The computer-implemented method of claim 1 further comprising:

obtaining, by the first computer system, new data representing a new event associated with a second tenant;

accessing, by the first computer system, a second analytics pipeline corresponding to the second tenant, the second analytics pipeline including a second sequence of analytic indicators referencing a second set of cybersecurity analytics, from among the cybersecurity analytics in the analytics pool, desired for use in analyzing the new data representing the new event;

applying, by the first computer system, the second set of cybersecurity analytics, referenced by the second sequence of analytic indicators in the second analytics pipeline, to the new data representing the new event to produce a second analytic result; and

providing, by the first computer system, the second analytic result, or second data associated therewith, to a second external user computer system.

6 . The computer-implemented method of claim 1 , wherein

a first thread associated with a pod of a container-orchestration environment includes the set of analytics pipelines corresponding to the plurality of tenants, wherein the set of analytics pipelines includes the analytics pipeline corresponding to the tenant, and the first thread further includes the analytics pool including the cybersecurity analytics available for use in association with any of the plurality of tenants.

7 . The computer-implemented method of claim 6 , wherein

a second thread associated with the pod of the container-orchestration environment includes the set of analytics pipelines corresponding to the plurality of tenants, and the second thread further includes the analytics pool including the cybersecurity analytics available for use in association with any of the plurality of tenants.

8 . The computer-implemented method of claim 1 further comprising generating the analytics pipeline corresponding to the tenant by:

obtaining analytic settings associated with the tenant, the analytic settings indicating enabled analytic indicators and disabled analytic indicators; and

using the analytic settings associated with the tenant to generate the analytics pipeline corresponding to the tenant.

9 . The computer-implemented method of claim 1 further comprising generating the analytics pool by:

obtaining analytic sources corresponding with the cybersecurity analytics;

using the analytic sources to generate the cybersecurity analytics by compiling source code of the analytic sources.

10 . The computer-implemented method of claim 1 further comprising updating the analytics pipeline corresponding to the tenant by:

obtaining at least one updated analytic setting associated with the tenant; and

using the at least one updated analytic setting associated with the tenant to update the analytics pipeline corresponding to the tenant.

11 . The computer-implemented method of claim 10 , wherein updating the analytics pipeline comprises adding a new analytic, deleting an existing analytic, or modifying the existing analytic.

12 . The computer-implemented method of claim 10 , wherein the at least one updated analytic setting is obtained from a tenant management service that manages analytic settings.

13 . The computer-implemented method of claim 12 , wherein the at least one updated analytic setting is provided by the tenant management service upon a lapse of a time duration.

14 . The computer-implemented method of claim 1 further comprising updating the analytics pool by:

obtaining at least one updated analytic source; and

using the at least one updated analytic source to update the analytics pool.

15 . The computer-implemented method of claim 14 , wherein the at least one updated analytic source is obtained from a tenant management service upon a lapse of a time duration.

16 . A computing device, comprising:

a processor; and

a non-transitory computer-readable medium having instructions stored thereon that, when executed by the processor, cause the processor to perform operations including:

obtaining, by a first computer system, data representing an event associated with a tenant;

identifying an analytics pipeline corresponding to the tenant from among a set of analytics pipelines, each analytics pipeline of the set of analytics pipelines corresponding with a particular tenant of a plurality of tenants;

accessing, by the first computer system, the analytics pipeline corresponding to the tenant, the analytics pipeline including a sequence of analytic indicators referencing a set of cybersecurity analytics, from among cybersecurity analytics in an analytics pool, desired for use in analyzing the data representing the event, wherein the cybersecurity analytics in the analytics pool are available for use by the plurality of tenants;

applying, by the first computer system, the set of cybersecurity analytics from the analytics pool available to the plurality of tenants, referenced by the analytic indicators in the analytics pipeline, to the data to produce an analytic result, wherein each cybersecurity analytic in the analytics pool is configured to detect a cybersecurity-related anomaly or threat; and

providing, by the first computer system, the analytic result, or first data associated therewith, to an external user computer system.

17 . The computing device of claim 16 , wherein the operations further comprise:

obtaining analytic settings associated with the tenant, the analytic settings indicating enabled analytic indicators and disabled analytic indicators; and

using the analytic settings associated with the tenant to generate the analytics pipeline corresponding to the tenant.

18 . A non-transitory computer-readable medium having stored instructions thereon that, when executed by one or more processors, cause the one or more processors to perform operations including:

obtaining, by a first computer system, data representing an event associated with a tenant;

identifying an analytics pipeline corresponding to the tenant from among a set of analytics pipelines, each analytics pipeline of the set of analytics pipelines corresponding with a particular tenant of a plurality of tenants;

accessing, by the first computer system, the analytics pipeline corresponding to the tenant, the analytics pipeline including a sequence of analytic indicators referencing a set of cybersecurity analytics, from among cybersecurity analytics in an analytics pool, desired for use in analyzing the data representing the event, wherein the cybersecurity analytics in the analytics pool are available for use by the plurality of tenants;

applying, by the first computer system, the set of cybersecurity analytics from the analytics pool available to the plurality of tenants, referenced by the analytic indicators in the analytics pipeline, to the data to produce an analytic result, wherein each cybersecurity analytic in the analytics pool is configured to detect a cybersecurity-related anomaly or threat; and

providing, by the first computer system, the analytic result, or first data associated therewith, to an external user computer system.

19 . The medium of claim 18 , wherein the operations further comprise:

obtaining at least one updated analytic source or at least one updated analytic setting; and

using the at least one updated analytic source to update the analytics pool or the at least one updated analytic setting to update the analytics pipeline.

20 . The medium of claim 19 , wherein only the at least one updated analytic source or the at least one updated analytic setting is obtained from a tenant management service upon a lapse of a time duration or based on a timestamp indicating a time associated with a previous update.