Grouping alerts into bundles of alerts
In some examples, a plurality of alerts relating to issues in a computing arrangement are received, where the plurality of alerts generated based on events in the computing arrangement. A subset of the plurality of alerts is grouped into a bundle of alerts, the grouping being based on a criterion. The bundle of alerts is communicated to cause processing of the alerts in the bundle of alerts together.
1. A non-transitory machine-readable storage medium storing instructions that upon execution cause a system to:
receive a plurality of alerts relating to issues in a computing arrangement, the plurality of alerts generated based on events in the computing arrangement;
group a subset of the plurality of alerts into a bundle of alerts, the grouping being based on a criterion, wherein grouping the subset of the plurality of alerts into the bundle of alerts based on the criterion comprises grouping the subset of the plurality of alerts according to a comparison of behavioral profiles of respective alerts of the plurality of alerts; and
trigger processing of the alerts in the bundle of alerts together to address the issues.
2. The non-transitory machine-readable storage medium of claim 1 , wherein the comparison of the behavioral profiles of respective alerts of the plurality of alerts comprises comparing profiles of a measure associated with the respective alerts of the plurality of alerts, wherein each profile of the measure includes a variation of values of the measure as a function of a variable.
3. The non-transitory machine-readable storage medium of claim 1 , wherein grouping the subset of the plurality of alerts into the bundle of alerts based on the criterion comprises grouping the subset of the plurality of alerts according to a comparison of criticalities of assets impacted by respective alerts of the plurality of alerts.
4. The non-transitory machine-readable storage medium of claim 3 , further comprising determining the criticalities of the assets impacted by the respective alerts of the plurality of alerts based upon a rule that specifies a criticality of a given asset responsive to a factor selected from among a role of an owner of the given asset or a type of data stored on the given asset.
5. The non-transitory machine-readable storage medium of claim 1 , wherein grouping the subset of the plurality of alerts into the bundle of alerts based on the criterion comprises grouping the subset of the plurality of alerts according to a comparison of analytics modules that generate respective alerts of the plurality of alerts, wherein the comparison of the analytics modules that generate respective alerts of the plurality of alerts comprises comparing rules or policies applied by the analytics modules to generate respective alerts.
6. The non-transitory machine-readable storage medium of claim 1 , wherein grouping the subset of the plurality of alerts into the bundle of alerts based on the criterion comprises grouping the subset of the plurality of alerts according to a comparison of indicators of compromise associated with respective alerts of the plurality of alerts, wherein each indicator of compromise includes an artifact indicating compromise of the computing arrangement.
7. The non-transitory machine-readable storage medium of claim 1 , wherein grouping the subset of the plurality of alerts into the bundle of alerts based on the criterion comprises grouping the subset of the plurality of alerts based on a determination that the subset of the plurality of alerts affect members of a predefined group.
8. The non-transitory machine-readable storage medium of claim 1 , wherein the criterion is selected from among similarity of events associated with respective alerts of the plurality of alerts, similarity of targets affected by respective alerts of the plurality of alerts, similarity sources of respective alerts of the plurality of alerts, similarity of attributes of users affected by or causing respective alerts of the plurality of alerts, similarity of features of features of respective alerts of the plurality of alerts, similarity of timings of respective alerts of the plurality of alerts, and similarity of analyst-defined tags of respective alerts of the plurality of alerts.
9. The non-transitory machine-readable storage medium of claim 1 , wherein the instructions upon execution cause the system to further:
identify related information for the bundle of alerts; and
communicate the identified related information for the bundle of alerts with the bundle of alerts to trigger processing of the alerts in the bundle of alerts together.
10. A system comprising:
a processor; and
a non-transitory storage medium storing instructions executable on the processor to:
receive event data relating to a plurality of events corresponding to operation of a computing arrangement;
generate a plurality of alerts in response to respective events of the plurality of events;
select, based on a similarity criterion, a subset of the plurality of alerts, and grouping the selected subset of the plurality of alerts into a bundle of alerts, wherein the selecting of the subset of the plurality of alerts that is included in the bundle of alerts is based on the similarity criterion comprising similarity of criticalities of assets impacted by the alerts of the plurality of alerts; and
trigger processing of the bundle of alerts to address respective issues in the computing arrangement.
11. The system of claim 10 , wherein the selecting of the subset of the plurality of alerts that are included in the bundle of alerts is based on the similarity criterion comprising: similarity of events associated with respective alerts of the plurality of alerts, similarity of behavioral profiles of respective alerts of the plurality of alerts, and similarity of analytics modules that generate respective alerts of the plurality of alerts.
12. The system of claim 10 , wherein the selecting of the subset of the plurality of alerts that are included in the bundle of alerts is based on the similarity criterion specifying that alerts affecting members of a predefined group are to be grouped.
13. A method of a system comprising a computer processor, comprising:
receiving a plurality of alerts relating to issues in a computing arrangement, the plurality of alerts generated based on events in the computing arrangement;
grouping a subset of the plurality of alerts into a bundle of alerts, the grouping being based on a grouping criterion that specifies grouping of alerts according to a comparison of behavioral profiles of respective alerts of the plurality of alerts, each behavioral profile of the behavioral profiles comprising a variation of values of a measure as a function of a variable;
identifying related information for the bundle of alerts based on a related information identification criterion;
communicating the bundle of alerts and the identified related information for the bundle of alerts; and
in response to the communicating of the bundle of alerts and the identified related information for the bundle of alerts, triggering processing of the alerts in the bundle of alerts together to address the issues.
14. The method of claim 13 , wherein the related information identification criterion is selected from among: a specification of an extent of historical data to search, a type of information to be returned, a feature used to determine similarity of alerts, a type of alert, a criticality of an alert, an asset affected by an alert, a category to which the bundle of alerts belong, and presence of an alert from a security tool.
15. The non-transitory machine-readable storage medium of claim 1 , wherein grouping the subset of the plurality of alerts into the bundle of alerts based on the criterion comprises:
grouping, into the bundle of alerts, a first alert generated responsive to a first set of events, and a second alert generated responsive to a second set of events, responsive to determining that the first set of events and the second set of events share greater than a threshold amount of common events.
16. The non-transitory machine-readable storage medium of claim 15 , wherein sharing greater than the threshold amount of common events is satisfied if:
the first set of events and the second set of events share greater than a threshold number of the common events, or
the first set of events and the second set of events share greater than a threshold percentage amount of the common events.
17. The non-transitory machine-readable storage medium of claim 2 , wherein the variable that the values of the measure are a function of comprises time or location.
18. The non-transitory machine-readable storage medium of claim 2 , wherein each behavioral profile of the behavioral profiles comprises variations of values of a plurality of measures as a function of the variable.
19. The system of claim 10 , wherein the selecting of the subset of the plurality of alerts that are included in the bundle of alerts is based on the similarity criterion that specifies grouping of alerts according to a comparison of behavioral profiles of respective alerts of the plurality of alerts, each behavioral profile of the behavioral profiles comprising a variation of values of a measure as a function of a variable.