Generation of cyber-attacks investigation policies
A system and method for generating policies for investigating cyber-security attacks are provided. The method includes selecting at least one entity of interest (EoI); determining at least one detection event associated with the at least one EoI; processing the at least one detection event to create a plurality of investigation rules, wherein each of the plurality of investigation rules includes a set of filters utilized to identify malicious activity related the at least one EoI; and defining an investigation policy for the EoI, wherein the defined investigation policy includes the plurality of investigation rules.
1. A method for generating policies for investigating cyber-security attacks, comprising:
selecting at least one security product as a source for attack logs input to at least one investigator security engine, wherein the selection is based on a performance score of the at least one security product;
generating a risk chain for a multivector attack based on information received from the at least one security product;
determining a risk level for the risk chain;
selecting at least one entity of interest (EoI) designated in the risk-chain representing a potential cyber-attack;
determining at least one detection event associated with the at least one EoI;
processing the at least one detection event to create a plurality of investigation rules, wherein each of the plurality of investigation rules includes a set of filters utilized to identify malicious activity against the at least one EoI; and
defining an investigation policy for the EoI, wherein the defined investigation policy includes the plurality of investigation rules.
2. The method of claim 1 , wherein selecting the at least one EoI further comprises: selecting an entity designated in an event that triggered an investigation function.
3. The method of claim 2 , wherein the at least one detection event is any one of: an event that causes the inclusion of the at least one EoI in the risk-chain, and the event that triggered an investigation function.
4. The method of claim 1 , further comprising:
defining at least one filter for each of the plurality of investigation rules.
5. The method of claim 4 , wherein the at least one filter for each of the plurality of investigation rules is based on any one of: a source entity, a destination entity, a time, and application path.
6. The method of claim 1 , wherein processing the at least one detection event to create the plurality of investigation rules further comprises:
identifying a detector security engine responsible for causing generation of the at least one detection event; and
determining the at least one investigator security engine.
7. The method of claim 6 , further comprising:
configuring the at least one investigator security engine and the detector security engine to carry out the investigation policy.
8. The method of claim 6 , wherein the at least one investigator security engine and the detector security engine are any of: the same security engine, and different security engines, wherein each of the at least one investigator security engine and the detector security engine is configured to detect and investigate threats by processing attack logs generated by the at least one security product communicatively connected thereto.
9. The method of claim 8 , further comprising:
normalizing the attack logs into a unified data structure, wherein the unified data structure is processed by the at least one investigator security engine.
10. The method of claim 1 , wherein the malicious activity related to the at least one EoI comprises at least one of: past malicious activity performed against at the least one EoI, past malicious activity performed by the at least one EoI, future malicious activity to be performed by the at least one EoI, and future malicious activity performed against at least one EoI.
11. A non-transitory computer readable medium having stored thereon instructions for causing one or more processing units to execute a method, the method comprising:
selecting at least one security product as a source for attack logs input to at least one investigator security engine, wherein the selection is based on a performance score of the at least one security product;
generating a risk chain for a multivector attack based on information received from the at least one security product;
determining a risk level for the risk chain;
selecting at least one entity of interest (EoI) designated in the risk-chain representing a potential cyber-attack;
determining at least one detection event associated with the at least one EoI;
processing the at least one detection event to create a plurality of investigation rules, wherein each of the plurality of investigation rules includes a set of filters utilized to identify malicious activity against the at least one EoI; and
defining an investigation policy for the EoI, wherein the defined investigation policy includes the plurality of investigation rules.
12. A system for generating policies for investigating cyber-security attacks, comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
select at least one security product as a source for attack logs input to at least one investigator security engine, wherein the selection is based on a performance score of the at least one security product;
generate a risk chain for a multivector attack based on information received from the at least one security product;
determine a risk level for the risk chain;
select at least one entity of interest (EoI) designated in the risk-chain representing a potential cyber-attack;
determine at least one detection event associated with the at least one EoI;
process the at least one detection event to create a plurality of investigation rules, wherein each of the plurality of investigation rules includes a set of filters utilized to identify malicious activity against the at least one EoI; and
define an investigation policy for the EoI, wherein the defined investigation policy includes the plurality of investigation rules.
13. The system of claim 12 , wherein the system is further configured to select an entity designated in an event that triggered an investigation function.
14. The system of claim 13 , wherein the at least one detection event is any one of: an event that causes the inclusion of the at least one EoI in the risk-chain, and the event that triggered an investigation function.
15. The system of claim 12 , wherein the system is further configured to:
define at least one filter for each of the plurality of investigation rules.
16. The system of claim 15 , wherein the at least one filter for each of the plurality of investigation rules is based on any one of: a source entity, a destination entity, a time, and application path.
17. The system of claim 12 , wherein processing the at least one detection event to create the plurality of investigation rules further comprises:
identifying a detector security engine responsible for causing generation of the at least one detection event; and
determining the at least one investigator security engine.
18. The system of claim 17 , wherein the system is further configured to:
configure the at least one investigator security engine and the detector security engine to carry out the investigation policy.
19. The system of claim 17 , wherein the at least one investigator security engine and the detector security engine are any of: the same security engine, and different security engines, wherein each of the at least one investigator security engine and the detector security engine is configured to detect and investigate threats by processing attack logs generated by at least one security product communicatively connected thereto.
20. The system of claim 19 , wherein the system is further configured to:
normalize the attack logs into a unified data structure, wherein the unified data structure is processed by the at least one investigator security engine.
21. The system of claim 12 , wherein the malicious activity related to the at least one EoI comprises at least one of: past malicious activity performed against at the least one EoI, past malicious activity performed by the at least one EoI, future malicious activity to be performed by the at least one EoI, and future malicious activity performed against at least one EoI.