Identifying related communication interactions to a security threat in a computing environment

1. A computer-implemented method comprising:

receiving, from a first computing asset of a computing environment comprising a plurality of computing assets, data indicating a security threat within the computing environment, the data identifying a first communication interaction associated with the security threat;

identifying a characteristic of the first communication interaction;

obtaining, from a second computing asset of the computing environment, one or more second communication interactions related to the first communication interaction, the one or more second communication interactions identified by the second computing asset based at least in part on the characteristic of the first communication interaction;

identifying a network location contained in the one or more second communication interactions;

obtaining enrichment information for the network location from a service external to the computing environment, the enrichment information indicating whether the network location is malicious;

identifying an automated response based at least in part on the enrichment information; and

initiating the automated response to mitigate the security threat in the computing environment, wherein initiating the automated response includes:

identifying a connector associated with a computing asset involved in the automated response,

using the connector to translate at least a portion of the automated response into an action to be performed by the computing asset in the computing environment, and

causing the computing asset in the computing environment to perform the action.

2. The computer-implemented method of claim 1 , wherein the plurality of computing assets includes at least one of: a user computing system, a server computing system, a router, a switch, or a virtual machine.

3. The computer-implemented method of claim 1 , wherein the characteristic includes at least one of: an internet protocol (IP) address, a uniform resource locator (URL), a domain name, content contained in the first communication interaction, or a username.

4. The computer-implemented method of claim 1 , wherein the related communication interactions include a second email interaction, and wherein the first communication interaction comprises a first email interaction that is related to the second email interaction.

5. The computer-implemented method of claim 1 , further comprising:

identifying one or more suggested actions to be implemented in at least one computing asset of the plurality of computing assets, the one or more suggested actions identified based on a type of the security threat;

providing the one or more suggested actions to an administrator of the computing environment;

identifying a selection of an action of the one or more suggested actions by the administrator of the computing environment; and

initiating implementation of the action in the computing environment.

6. The computer-implemented method of claim 1 , wherein the data indicating the security threat within the computing environment includes received from a security information and event management (SIEM) system.

7. The computer-implemented method of claim 1 , wherein the data indicating the security threat within the computing environment includes a user-generated notification of the security threat within the computing environment.

8. The computer-implemented method of claim 1 , further comprising identifying the automated response based at least in part on a number of the one or more second communication interactions.

9. The computer-implemented method of claim 1 , wherein the first computing asset and the second computing asset are the same computing asset.

10. The computer-implemented method of claim 1 , wherein the action is specific to a hardware or software configuration of the computing asset.

11. The computer-implemented method of claim 1 , wherein initiating the automated response to the security threat in the computing environment includes using a first connector to translate at least a first portion of the automated response into one or more first actions used by a first computing asset at which the one or more first actions are to be performed and using a second connector to translate at least a second portion of the automated response into one or more second actions used by a second computing asset at which the one or more second actions are to be performed, wherein the one or more first actions are different from the one or more second actions.

12. The computer-implemented method of claim 1 , further comprising identifying the automated response based at least in part on content contained in the one or more second communication interactions.

13. The computer-implemented method of claim 1 , wherein the enrichment information is first enrichment information, wherein the method further comprises obtaining second enrichment information from a computing asset within the computing environment, and wherein the automated response to the security threat in the computing environment is initiated based at least in part on the first enrichment information and the second enrichment information.

14. The computer-implemented method of claim 1 , further comprising determining, based at least in part on the one or more second communication interactions, that the security threat is a phishing campaign.

15. The computer-implemented method of claim 1 , wherein the automated response includes at least one of: blocking receipt of future emails interactions related to the one or more second communication interactions, blocking an internet protocol (IP) address.

16. The computer-implemented method of claim 1 , wherein the automated response is a first automated response, and wherein the method further comprises:

determining that at least one of the one or more second communication interactions includes a link to download a file;

determining that the file is malicious; and

initiating a second automated response in the computing environment based on determining that the file is malicious.

17. The computer-implemented method of claim 1 , wherein the network location is a Uniform Resource Locator (URL) link.

18. The computer-implemented method of claim 1 , further comprising:

determining, based on the enrichment information, a severity of the security threat; and

identifying the automated response based at least in part on the severity of the security threat.

19. An apparatus, comprising:

one or more non-transitory computer readable media; and

processing instructions stored on the one or more computer readable media that, when executed by a processing system, direct the processing system to:

receive, from a first computing asset of a computing environment comprising a plurality of computing assets, data indicating a security threat within the computing environment, the data identifying a first communication interaction associated with the security threat;

identify a characteristic of the first communication interaction;

obtain, from a second computing asset of the computing environment, one or more second communication interactions related to the first communication interaction, the one or more second communication interactions identified by the second computing asset based at least in part on the characteristic of the first communication interaction;

identify a network location contained in the one or more second communication interactions;

obtain enrichment information for the network location from a service external to the computing environment, the enrichment information indicating whether the network location is malicious;

identifying an automated response based at least in part on the enrichment information; and

initiate the automated response to mitigate the security threat in the computing environment, wherein initiating the automated response includes:

identifying a connector associated with a computing asset involved in the automated response,

using the connector to translate at least a portion of the automated response into an action to be performed by the computing asset in the computing environment, and

causing the computing asset in the computing environment to perform the action.

20. A non-transitory computer-readable storage medium storing instructions which, when executed by one or more processors, cause performance of operations comprising:

receiving, from a first computing asset of a computing environment comprising a plurality of computing assets, data indicating a security threat within the computing environment, the data identifying a first communication interaction associated with the security threat;

identifying a characteristic of the first communication interaction;

obtaining, from a second computing asset of the computing environment, one or more second communication interactions related to the first communication interaction, the one or more second communication interactions identified based at least in part on the characteristic of the first communication interaction;

identifying a network location contained in the one or more second communication interactions;

obtaining enrichment information for the network location from a service external to the computing environment, the enrichment information indicating whether the network location is malicious;

identifying an automated response based at least in part on the enrichment information; and

initiating an automated response to the security threat in the computing environment, wherein initiating the automated response includes:

identifying a connector associated with a computing asset involved in the automated response,

using the connector to translate at least a portion of the automated response into an action to be performed by the computing asset in the computing environment, and

causing the computing asset in the computing environment to perform the action.