Learning based security threat containment
Systems, methods, and software described herein provide action recommendations to administrators of a computing environment based on effectiveness of previously implemented actions. In one example, an advisement system identifies a security incident for an asset in the computing environment, and obtains enrichment information for the incident. Based on the enrichment information a rule set and associated recommended security actions are identified for the incident. Once the recommended security actions are identified, a subset of the action recommendations are organized based on previous action implementations in the computing environment, and the subset is provided to an administrator for selection.
1. A computer-implemented method performed by an advisement system, the method comprising:
receiving an indication of a security incident involving a computing asset in a networked computing environment comprising a plurality of computing assets;
in response to receiving the indication of the security incident, obtaining enrichment information about the security incident from one or more internet resources;
identifying, based on the enrichment information, a plurality of action recommendations for responding to the security incident;
identifying, for each action recommendation of the plurality of action recommendations, an effectiveness measurement indicating an effectiveness of the action recommendation against past occurrences of the security incident, wherein the effectiveness measurement of an action recommendation of the plurality of action recommendations against past occurrences of the security incident is generated by measuring an amount of data lost after execution of the action recommendation;
identifying a subset of action recommendations from the plurality of action recommendations based on a respective effectiveness measurement of each action recommendation of the plurality of action recommendations, wherein the subset of action recommendations is less than the plurality of action recommendations;
receiving input selecting an action recommendation from the subset of action recommendations; and
implementing the action recommendation in the networked computing environment.
2. The method of claim 1 , wherein identifying the effectiveness measurement indicating an effectiveness of the action recommendation against past occurrences of the security incident includes measuring an effectiveness of an instance of a user selecting the action recommendation.
3. The method of claim 1 , wherein identifying the effectiveness measurement indicating an effectiveness of the action recommendation against past occurrences of the security incident includes measuring an effectiveness of an automatic implementation of the action recommendation.
4. The method of claim 1 , wherein the indication of the security incident comprises at least one of: an internet protocol (IP) address related to the security incident, an identity of the computing asset affected by the security incident, or a process name related to the security incident.
5. The method of claim 4 , wherein the one or more internet resources includes a database or a website associated with the security incident.
6. The method of claim 1 , further comprising providing a hierarchy of the subset of action recommendations to a user via an administration console of the advisement system.
7. The method of claim 1 , further comprising causing display of a user interface including a representation of a hierarchy of the subset of action recommendations.
8. The method of claim 1 , wherein the effectiveness measurement is further generated by measuring whether the action recommendation removed threats associated with the security incident.
9. A non-transitory computer readable storage medium having instructions stored thereon which, when executed by one more processors, cause performance of operations comprising:
receiving an indication of a security incident involving a computing asset in a networked computing environment comprising a plurality of computing assets;
in response to receiving the indication of the security incident, obtaining enrichment information about the security incident from one or more internet resources;
identifying, based on the enrichment information, a plurality of action recommendations for responding to the security incident;
identifying, for each action recommendation of the plurality of action recommendations, an effectiveness measurement indicating an effectiveness of the action recommendation against past occurrences of the security incident, wherein the effectiveness measurement of an action recommendation of the plurality of action recommendations against past occurrences of the security incident is generated by measuring an amount of data lost after execution of the action recommendation;
identifying a subset of action recommendations from the plurality of action recommendations based on a respective effectiveness measurement of each action recommendation of the plurality of action recommendations, wherein the subset of action recommendations is less than the plurality of action recommendations;
receiving input selecting an action recommendation from the subset of action recommendations; and
implementing the action recommendation in the networked computing environment.
10. The non-transitory computer readable storage medium of claim 9 , wherein identifying the effectiveness measurement indicating an effectiveness of the action recommendation against past occurrences of the security incident includes measuring an effectiveness of an instance of a user selecting the action recommendation.
11. The non-transitory computer readable storage medium of claim 9 , wherein identifying the effectiveness measurement indicating an effectiveness of the action recommendation against past occurrences of the security incident includes measuring an effectiveness of an automatic implementation of the action recommendation.
12. The non-transitory computer readable storage medium of claim 9 , wherein the indication of the security incident comprises at least one of: an internet protocol (IP) address related to the security incident, an identity of the computing asset affected by the security incident, or a process name related to the security incident.
13. The non-transitory computer readable storage medium of claim 12 , wherein of the one or more internet resources includes a database or a website associated with the security incident.
14. The non-transitory computer readable storage medium of claim 9 , further comprising providing a hierarchy of the subset of action recommendations to a user via an administration console of an advisement system.
15. The non-transitory computer readable storage medium of claim 9 , further comprising causing display of a user interface including a representation of a hierarchy of the subset of action recommendations.
16. The non-transitory computer readable storage medium of claim 9 , wherein the effectiveness measurement is further generated by measuring whether the action recommendation removed threats associated with the security incident.
17. An apparatus, comprising:
one or more processors;
one or more non-transitory computer readable storage media storing instructions which, when executed by the one or more processors, cause the apparatus to:
receive an indication of a security incident involving a computing asset in a networked computing environment comprising a plurality of computing assets;
in response to receiving the indication of the security incident, obtaining enrichment information about the security incident from one or more internet resources;
identify, based on the enrichment information, a plurality of action recommendations for responding to the security incident;
identify, for each action recommendation of the plurality of action recommendations, an effectiveness measurement indicating an effectiveness of the action recommendation against past occurrences of the security incident, wherein the effectiveness measurement of an action recommendation of the plurality of action recommendations against past occurrences of the security incident is generated by measuring an amount of data lost after execution of the action recommendation;
identify a subset of action recommendations from the plurality of action recommendations based on a respective effectiveness measurement of each action recommendation of the plurality of action recommendations, wherein the subset of action recommendations is less than the plurality of action recommendations;
receive input selecting an action recommendation from the subset of action recommendations; and
implement the action recommendation in the networked computing environment.
18. The apparatus of claim 17 , wherein the effectiveness measurement is further generated by measuring whether the action recommendation removed threats associated with the security incident.
19. The apparatus of claim 17 , wherein the instructions, when executed by the one or more processors, further cause the apparatus to cause display of a user interface including a representation of a hierarchy of the subset of action recommendations.