Method And System For Monitoring Entity Activity On An Organization's Computer Network
A security platform employs a variety techniques and mechanisms to detect security related anomalies and threats in a computer network environment. The security platform is “big data” driven and employs machine learning to perform security analytics. The security platform performs user/entity behavioral analytics (UEBA) to detect the security related anomalies and threats, regardless of whether such anomalies/threats were previously known. The security platform can include both real-time and batch paths/modes for detecting anomalies and threats. By visually presenting analytical results scored with risk ratings and supporting evidence, the security platform enables network security administrators to respond to a detected anomaly or threat, and to take action promptly.
1 . A computerized method comprising:
receiving event data associated with network activities by entities that interact with a computer network, wherein types of entities include at least one of devices, applications, and/or network users;
identifying instances of potential network compromise automatically determined from the event data, wherein instances include threats and/or anomalies, and the identified instances are associated with at least one entity;
automatically determining a score for each entity, wherein the score indicates a risk level based at least in part on the number and/or type of identified instances of potential network compromise associated with the entity; and
causing display, in a graphical user interface, of an indication of the score for each of the entities.
2 . The method of claim 1 , wherein the graphical user interface further provides at least one entities view comprising a listing of entities of at least one type that participated in network activities that triggered determinations of potential network compromise;
wherein each entity listed in the entities view includes the associated score and a link which, upon selection by a user, causes the graphical user interface to generate a detailed view comprising additional data about the selected entity.
3 . The method of claim 2 , wherein the entities view lists, for each entity, the number of threats associated with the entity.
4 . The method of claim 2 , wherein the entities view lists, for each entity, the number of anomalies associated with the entity.
5 . The method of claim 2 , wherein the entities view lists, for each entity, the number of threats and anomalies associated with the entity.
6 . The method of claim 2 , wherein the graphical user interface provides a prompt for filtering the entities view according to score, and
upon selection by a user of a score via the graphical user interface, filtering the entities view to include only the entities associated with scores corresponding to the user's selection.
7 . The method of claim 1 , wherein the entities view comprises a listing of users in a computer network of an organization including the department in which the user is assigned in the organization.
8 . The method of claim 2 , wherein the entities view comprises a listing of network users in a computer network of an organization,
and further includes, for each network user, the date of the most recent automated determination regarding the network user's involvement in a potential instance of network compromise.
9 . The method of claim 2 , wherein the entities view comprises a listing of devices communicating on the network and associated with an instance of network compromise,
and further wherein the listing includes, for each device, the date of the most recent automated determination regarding the device's involvement in a potential instance of network compromise.
10 . The method of claim 2 , wherein the entities view includes, for each entity, the date of the most recent update regarding the entity's participation in a potential instance of network compromise, and
wherein the graphical user interface provides a prompt for filtering the entities view according to date, and
upon selection by a user of a temporal range via the graphical user interface, filtering the entities view to include only the entities associated with a date of most recent update falling within the selected temporal range.
11 . The method of claim 2 , wherein the entities view comprises a listing of applications that have run on the network and are associated with an instance of network compromise, and, upon selection of an entry in the listing, providing a detailed view illustrating the relationship between the application and the at least one identified instance of potential network compromise associated with the application.
12 . The method of claim 2 , further comprising:
upon selection by a user of an entity in the listing via the graphical user interface, generating a detailed view of the entity providing additional information, including a trends graph illustrating any changes in the score associated with the entity over a period of time.
13 . The method of claim 2 , further comprising:
upon selection by a user of an entity in the listing via the graphical user interface, generating a detailed view of the entity providing additional information, including an illustration of the relationship between the entity and the associated at least one instance of potential network compromise.
14 . The method of claim 2 , further comprising:
upon selection by a user of an entity in the listing via the graphical user interface, generating a detailed view of the entity providing additional information including, if relevant event data is available, an illustration of how recent network activities associated with the entity has varied from a baseline of activity.
15 . The method of claim 2 , wherein, upon selection by a user of an entity in the listing via the graphical user interface, generating a detailed view of the entity providing a prompt for a user to tag the selected entity for future tracking, and
upon receiving a selection by a user of a tag, associating the tag with the selected entity such that the tag is included in the additional data provided in response to subsequent requests to generate the detailed view of the selected entity.
16 . The method of claim 2 , wherein the entities view comprises a listing of network users in a computer network of an organization and upon selection by a user of a network user in the listing, a detailed network user view is generated that identifies other network users determined to be similar.
17 . The method of claim 2 , wherein, upon selection by a user of an entity in the listing via the graphical user interface, generating a detailed view of the entity that provides additional information concerning the entity,
upon receiving a selection by a user, via the graphical user interface, of a link in the detailed view, generating an instances view listing instances of potential network compromise that are associated with the entity.
18 . The method of claim 2 , wherein, upon selection by a user of an entity in the listing via the graphical user interface, generating a detailed view of the entity that provides additional information concerning the entity,
upon receiving a selection by a user, via the graphical user interface, of a link in the detailed view, generating an instances view listing instances of potential network compromise that are associated with the entity,
wherein each listed instance includes a link to a detailed view of that instance.
19 . A non-transitory, computer-readable storage medium storing instructions, an execution of which in a computer system causes the computer system to perform operations comprising:
receiving event data associated with network activities by entities that interact with a computer network, wherein types of entities include at least one of devices, applications, and/or network users;
identifying instances of potential network compromise automatically determined from the event data, wherein instances include threats and anomalies, and the identified instances are associated with at least one entity;
automatically determining a score for each entity, wherein the score indicates a risk level based at least in part on the number and/or type of identified instances of potential network compromise associated with the entity;
causing for display, in graphical user interface, of an indication of the score for each of the entities.
20 . The computer-readable storage medium of claim 19 , wherein the graphical user interface provides at least one entities view comprising a listing of entities of at least one type that participated in network activities that triggered determinations of potential network compromise;
wherein each entity listed in the entities view includes the associated score and a link which, upon selection by a user, causes the graphical user interface to generate a detailed view comprising additional data about the selected entity.
21 . The computer-readable storage medium of claim 20 , wherein the entities view lists, for each entity, the number of threats associated with the entity.
22 . The computer-readable storage medium of claim 20 , wherein the entities view lists, for each entity, the number of anomalies associated with the entity.
23 . The computer-readable storage medium of claim 20 , wherein the entities view lists, for each entity, the number of threats and anomalies associated with the entity.
24 . The computer-readable storage medium of claim 20 , wherein the graphical user interface provides a prompt for filtering the entities view according to score, and
upon selection by a user of a score via the graphical user interface, filtering the entities view to include only the entities associated with scores corresponding to the user's selection.
25 . The computer-readable storage medium of claim 20 , wherein the entities view comprises a listing of users in a computer network of an organization including, if known, the department in which the user is assigned in the organization.
26 . The computer-readable storage medium of claim 20 , wherein the entities view comprises a listing of network users in a computer network of an organization,
and further includes, for each network user, the date of the most recent automated determination regarding the network user's participation in a potential instance of network compromise.
27 . A computer system comprising:
computer memory for storing machine data; and
a processor for:
receiving event data associated with network activities by entities that interact with a computer network, wherein types of entities include at least one of devices, applications, and/or network users;
identifying instances of potential network compromise automatically determined from the event data, wherein instances include threats and/or anomalies, and the identified instances are associated with one or more entities;
automatically determining a score for each entity, wherein the score indicates a risk level based at least in part on the number and type of identified instances of potential network compromise associated with the entity;
causing display, in a graphical user interface, of an indication of the score for each of the entities.
28 . The computer system of claim 27 , wherein the graphical user interface provides at least one entities view comprising a listing of entities of at least one type that participated in network activities that triggered determinations of potential network compromise;
wherein each entity listed in the entities view includes the associated score and a link which, upon selection by a user, causes the graphical user interface to generate a detailed view comprising additional data about the selected entity.
29 . The computer system of claim 28 , wherein the entities view lists, for each entity, the number of threats associated with the entity.
30 . The computer system of claim 28 , wherein the entities view lists, for each entity, the number of anomalies associated with the entity.