DETECTION OF SECURITY TRANSACTIONS

1 . A method comprising:

accessing a plurality of events, wherein an event of the plurality of events includes a portion of raw machine-data from a data source of a plurality of data sources;

for at least one event of the plurality of events, correlating a transaction phase of a computer security transaction with the at least one event based at least in part on a data source associated with the at least one event; and

correlating the transaction phase of the at least one event with a particular asset of a plurality of assets.

2 . The method of claim 1 wherein the computer security transaction includes a. plurality of transaction phases indicative of a progressive cyber-attack.

3 . The method of claim 2 , wherein the plurality of transaction phases are defined by an attack chain security model, wherein the plurality of transaction phases comprises: a reconnaissance transaction phase, a weaponizati on transaction phase, a delivery transaction phase, an exploitation transaction phase, an installation transaction phase, a command and control transaction phase, and an actions on objectives transaction phase.

4 . The method of claim 1 , wherein the correlating a transaction phase of a computer security transaction with the at least one event based at least in part on a data source associated with the at least one event is performed responsive to receiving the event of the plurality of events.

5 . The method of claim 1 , wherein the correlating a transaction phase of a computer security transaction with the at least one event based at least in part on a data source associated with the at least one event is performed responsive to searching the plurality of events.

6 . The method of claim 1 , wherein the correlating a transaction phase of a computer security transaction with the at least one event based at least in part on a data source associated with the at least one event is performed responsive to indexing the plurality of events.

7 . The method of claim 1 , wherein the data source is one of an intrusion detection system (IDS), a next-generation firewall (NGFW) device, an anti-virus (AV) application, an endpoint threat detection and response (ETDR) application, an electronic mail (e-mail) application, and an operating system.

8 . The method of claim 1 , wherein the correlating the transaction phase of the at least one event with a particular asset associated with the at least one event comprises:

correlating the transaction phase of the at least one event with a particular user associated with the particular asset and associated with the at least one event.

9 . The method of claim 1 , further comprising:

aggregating transactions phases for the plurality of assets.

10 . The method of claim 9 , further comprising:

providing an indication of particular assets having correlated transaction phases, the indication identifying the correlated transaction phases for the particular assets.

11 . The method of claim 1 , further comprising:

responsive to a determining that the transaction phase has occurred, generating a notification indicating that the transaction phase involving the particular asset has occurred.

12 . The method of claim 1 , further comprising:

responsive to determining that a plurality of transaction phases of the computer security transaction has occurred for a particular asset, generating a notification indicating that the plurality of transaction phases of the computer security transaction has occurred.

13 . The method of claim 12 , further comprising:

responsive to the plurality of transaction phases comprising non-successive transaction phases of the computer security transaction, generating a notification indicating a potential visibility gap in the detection of transaction phases of the computer security transaction.

14 . The method of claim 1 , wherein the correlating a transaction phase of a computer security transaction with the at least one event based at least in part on a data source associated with the at least one event comprises:

accessing a table of a plurality of sources and respective corresponding transaction phases.

15 . The method of claim 1 , wherein the correlating a transaction phase of a computer security transaction with the at least one event based at least in part on a data source associated with the at least one event comprises:

for the at least one event in the plurality of events, generating a metadata field identifying the transaction phase associated with the at least one event.

16 . The method of claim 15 , further comprising:

searching the plurality of events to identify an event that indicates an association between a particular user identifier and the particular asset; and

in response to the search, generating a data structure for storing the association between the particular asset and the particular user identifier.

17 . The method of claim 16 , wherein the correlating the transaction phase of the at least one event with a particular asset of a plurality of assets comprises:

updating the data structure to append the metadata field to the association between the particular asset and the particular user identifier.

18 . The method of claim 16 , wherein the event that indicates an association between the particular user and the particular asset is a successful authentication operation of the particular user identifier on the particular asset.

19 . The method of claim 1 , further comprising:

searching, based on a set of criteria, the plurality of events to identify the at least one ever

20 . A system, comprising:

one or more data processors; and

a non-transitory computer-readable storage medium containing instructions which when executed on the one or more data processors, cause the one or more processors to perform operations including:

accessing a plurality of events, wherein an event of the plurality of events includes a portion of raw machine-data from a data source of a plurality of data sources;

for at least one event of the plurality of events, correlating a transaction phase of a computer security transaction with the at least one event based at least in part on a data. source associated with the at least one event; and

correlating the transaction phase of the at least one event with a particular asset of a plurality of assets.

21 . A computer-program product tangibly embodied in a non-transitory machine-readable storage medium, including instructions configured to cause one or more data processors to:

access a plurality of events, wherein an event of the plurality of events includes a portion of raw machine-data from a data source of a plurality of data sources;

for at least one event of the plurality of events, correlate a transaction phase of a computer security transaction with the at least one event based at least in part on a data source associated with the at least one event; and

correlate the transaction phase of the at least one event with a particular asset of a plurality of assets.