Universal actor correlator
View Patent ↗Precorrelation of data applied to use cases by a module intermediate to the data and use cases provides normalized data across multiple sources for more effective analysis. For example, network sensors provide network telemetry to a precorrelation core, which extracts and normalizes the data to correlate actors to events. Universal actor correlation improves visualizations by creating a mesh of events tied to each other through a common actor.
1. A network security system comprising:
non-transitory memory storing:
plural use cases operable to identify predetermined conditions in data from plural sources, the predetermined conditions including indications of unauthorized network accesses;
a streaming data source having network telemetry from plural sensors, at least some of the network telemetry including one or more events and one or more actors, the network telemetry associated with authorized and unauthorized network accesses, the streaming data source storing the network telemetry in one of three entity tables including an IP address entity table, an IP address/hostname table, and an IP address/hostname and user name table;
a precorrelation core interfaced with the data source and operable to associate events and actors, each event defined as a type selected from the group of flow, authenticate, access, security and policy event types, the precorrelation core associating entities of the entity tables as plural nodes in a node table, each node having a merged group of entities linked to each other with events in a links table to relate entities from different entity tables as the same actor; and
a fan out graphical user interface depicting events associated by actor.
2. A method for monitoring network security, the method comprising:
retrieving network telemetry from plural sensors as streaming data, the streaming data having plural events, each event having one or more of IP address, hostname and user name information;
storing the network telemetry at a data source in at least three entity tables having an IP address table, IP address/hostname table, and IP address/hostname/user name table;
precorrelating the network sensor information by associating the plural events of the data source with a common actor, the common actor defined from nodes, each node having an entity table entry as an anchor, the anchor merged with entities that share at least one of the IP address, hostname or user name of the anchor; and
presenting a visualization of the plural events at a display, the visualization depicting a relationship with the common actor, the visualization depicting nodes related by events in a defined time period, the visualization having at least a fan out graphical user interface depicting events associated by the common actor.
3. The method of claim 2 wherein the events are flow, authentication, accesses, policy and security notifications from a network sensor.