Alerting and tagging using a malware analysis platform for threat intelligence made actionable
Techniques for alerting and tagging using a malware analysis platform for threat intelligence made actionable are disclosed. In some embodiments, a system, process, and/or computer program product for alerting and tagging using a malware analysis platform for threat intelligence made actionable includes receiving a plurality of samples for performing automated malware analysis to generate log files based on the automated malware analysis; processing the log files to extract artifacts associated with the log files; determining whether a tag matches any of the plurality of samples based on the artifacts; and performing an action based on whether the tag matches any of the plurality of samples.
1. A computer-implemented method, comprising:
receiving a plurality of samples for performing automated malware analysis to generate log files based on the automated malware analysis;
processing the log files to extract artifacts associated with the log files;
receiving a configuration to enable an alert action based on a tag type for matching any of the plurality of samples, wherein the tag type is configured for the alert action for a tag based on a plurality of conditions associated with one or more artifacts, wherein the alert action is configured to match private samples and public samples, and wherein the alert action is configured as a prioritized alert based on the tag;
determining whether the tag matches any of the plurality of samples based on the plurality of conditions associated with one or more artifacts; and
performing an action based on whether the tag matches any of the plurality of samples including to trigger the alert action based on the determination that the tag matches a sample detected on a monitored enterprise network, wherein the sample is a public sample and the monitored enterprise network is associated with another subscriber's enterprise network.
2. The method of claim 1 , wherein an extracted artifact is a high-risk artifact, and wherein the high-risk artifact is determined to be associated with malware based on the automated malware analysis.
3. The method of claim 1 , wherein performing automated malware analysis includes performing a dynamic analysis.
4. The method of claim 1 , wherein performing automated malware analysis includes performing a static analysis.
5. The method of claim 1 , wherein a log file for a sample comprises one or more lines based on results of the automated malware analysis for the sample.
6. The method of claim 1 , further comprising:
generating another alert based on the determination that the tag matches a sample detected on a second monitored enterprise network, wherein the sample is a private sample and the second monitored enterprise network is associated with the subscriber's enterprise network.
7. A system, comprising:
a processor configured to:
receive a plurality of samples for performing automated malware analysis to generate log files based on the automated malware analysis;
process the log files to extract artifacts associated with the log files;
receive a configuration to enable an alert action based on a tag type for matching any of the plurality of samples, wherein the tag type is configured for the alert action for a tag based on a plurality of conditions associated with one or more artifacts, wherein the alert action is configured to match private samples and public samples, and wherein the alert action is configured as a prioritized alert based on the tag;
determine whether the tag matches any of the plurality of samples based on the plurality of conditions associated with one or more artifacts; and
perform an action based on whether the tag matches any of the plurality of samples including to trigger the alert action based on the determination that the tag matches a sample detected on a first monitored enterprise network, wherein the sample is a public sample and the first monitored enterprise network is associated with another subscriber's enterprise network; and
a memory coupled to the processor and configured to provide the processor with instructions.
8. The system recited in claim 7 , wherein an extracted artifact is a high-risk artifact, and wherein the high-risk artifact is determined to be associated with malware based on the automated malware analysis.
9. The system recited in claim 7 , wherein performing automated malware analysis includes performing a dynamic analysis.
10. The system recited in claim 7 , wherein performing automated malware analysis includes performing a static analysis.
11. The system recited in claim 7 , wherein a log file for a sample comprises one or more lines based on results of the automated malware analysis for the sample.
12. The system recited in claim 7 , wherein the processor is further configured to:
generate another alert based on determining that the tag matches a sample detected on a second monitored enterprise network, wherein the sample is a private sample and the second monitored enterprise network is associated with the subscriber's enterprise network.
13. The system recited in claim 7 , wherein the processor is further configured to:
determine whether the tag matches any of the plurality of samples based on the plurality of conditions associated with one or more artifacts.
14. A computer program product, the computer program product being embodied in a non-transitory tangible computer readable storage medium and comprising computer instructions for:
receiving a plurality of samples for performing automated malware analysis to generate log files based on the automated malware analysis;
processing the log files to extract artifacts associated with the log files;
receiving a configuration to enable an alert action based on a tag type for matching any of the plurality of samples, wherein the tag type is configured for the alert action for a tag based on a plurality of conditions associated with one or more artifacts, wherein the alert action is configured to match private samples and public samples, and wherein the alert action is configured as a prioritized alert based on the tag;
determining whether the tag matches any of the plurality of samples based on the plurality of conditions associated with one or more artifacts; and
performing an action based on whether the tag matches any of the plurality of samples including to trigger the alert action based on the determination that the tag matches a sample detected on a monitored enterprise network, wherein the sample is a public sample and the monitored enterprise network is associated with another subscriber's enterprise network.
15. The computer program product recited in claim 14 , wherein an extracted artifact is a high-risk artifact.
16. The computer program product recited in claim 14 , wherein the artifact is a high-risk artifact, and wherein the high-risk artifact is determined to be associated with malware based on the automated malware analysis.
17. The computer program product recited in claim 14 , wherein performing automated malware analysis includes performing a dynamic analysis.
18. The computer program product recited in claim 14 , wherein performing automated malware analysis includes performing a static analysis.
19. The computer program product recited in claim 14 , wherein a log file for a sample comprises one or more lines based on results of the automated malware analysis for the sample.
20. The computer program product recited in claim 14 , and further comprising computer instructions for:
generating another alert based on the determination that the tag matches a sample detected on a second monitored enterprise network, wherein the sample is a private sample and the second monitored enterprise network is associated with the subscriber's enterprise network.