System and method for automatic forensic investigation
Automatic forensic investigation techniques to more effectively differentiate false positives from true positives. An incident is automatically investigated by a processor that communicates instructions to a device on a network and analyzes information received from the device in response to the instructions. In response to analyzing, the processor raises or lowers its level of confidence in the incident. If the processor's level of confidence in the incident is sufficiently high, the processor generates an output that indicates that the security of the network has been compromised. Otherwise, the processor ascertains that the incident is a false positive and may modify a criteria for alert generation.
1. A system for monitoring security of a computer network, the system comprising:
a perimeter of a network comprising a command and control sensor directly connected to an external network;
a network interface connecting the perimeter of the network to a server computer and at least one other entity on the network;
at least one tap directing communications from the external network to the command and control sensor, wherein the command and control sensor analyzes the communications and issues to the server computer alerts indicative of a possible compromise to the security of the network;
a processor connected to computerized memory storing computer implemented instructions on the server computer;
a plurality of sensors connected on the network in communication with the processor;
wherein the computer implemented instructions are configured to implement a method comprising steps to:
automatically investigate the computer alerts by (i) communicating instructions to the at least one other entity on the computer network, wherein the at least one other entity comprises at least one of the plurality of sensors; and (ii) analyzing information received in response to the instructions; and
compute a level of confidence in the computer alerts;
generate an output when the level of confidence exceeds a given threshold, wherein the output is an indication of a security compromise transmitted on the network to at least one endpoint device; and
in response to investigating the computer alerts, modify criteria for alert generation of at least one of the plurality of sensors.
2. The system according to claim 1 , wherein the instructions include instructions to an endpoint forensic sensor to scan a respective endpoint device on the computer network.
3. The system according to claim 1 , wherein the instructions include instructions to a file analysis sensor to scan a file.
4. The system according to claim 1 , wherein the at least one entity includes one of the plurality of sensors that did not generate any of the received alerts.
5. The system according to claim 1 , wherein the information includes at least one record of past network traffic over the computer network.
6. The system according to claim 1 , wherein the information includes at least one record of past activity of a respective endpoint device on the computer network.
7. A method for monitoring security of a computer network, the method comprising:
connecting a command and control sensor at a perimeter of a network to an external network;
connecting a server computer to the command and control sensor and at least one other entity on the network, wherein the at least one other entity comprises a plurality of sensors connected to the network;
placing at least one tap on the network;
using the at least one tap on the network, directing communications from the external network to the command and control sensor, wherein the command and control sensor, analyzes the communications and issues to the server computer an alert indicative of a possible compromise to security of the network;
automatically investigating the alert by (i) communicating instructions to the at least one other entity on the computer network, and (ii) analyzing information received in response to the instructions; and
compute a level of confidence in the alert;
generate an output when the level of confidence exceeds a given threshold, wherein the output is an audio and/or visual indication of a security compromise and wherein the output is transmitted on the network and used to disconnect at least one endpoint device from the network; and
in response to investigating the alerts, modify criteria for alert generation of at least one of the plurality of sensors.
8. The method according to claim 7 , wherein the instructions include instructions to an endpoint forensic sensor to scan a respective endpoint device on the computer network.
9. The method according to claim 7 , wherein the instructions include instructions to a file analysis sensor to scan a file.
10. The method according to claim 7 , wherein the at least one entity includes one of the plurality of sensors that did not generate any of the received alerts.
11. The method according to claim 7 , wherein the information includes at least one record of past network traffic over the computer network.
12. The method according to claim 7 , wherein the information includes at least one record of past activity of a respective endpoint device on the computer network.