Cybersecurity alert, assessment, and remediation engine
The invention includes a computerized method for interfacing with a security hardware appliance for assessing potential remedial action in response to a potential information security threat by automatically ingesting and parsing incoming alerts from a security hardware appliance, automatically extracting relevant data elements from the alert, using the extracted information to supplement the alert by querying and retrieving from other systems, and automatically ranking the alerts in terms of importance using an engine that combines information, and issuing a command to take remedial, containment, or other programmed action on the alerts automatically.
1. A non-transitory computer readable storage medium storing one or more programs that are executed by one or more processors of a cybersecurity system to perform operations, comprising:
receiving a security alert that indicates a threat to the cybersecurity system;
extracting data elements from the security alert, the data elements including at least one of an internet protocol (IP) address, a hash, an alert priority, an alert type, a description of the threat, or a hostname;
using the data elements to obtain additional information regarding the security alert, the additional information including at least one of a domain name, a domain name system (DNS) address, the description of the threat, a confidence level of the threat or a result of a DNS lookup query or a domain query;
adding the additional information regarding the security alert as new data elements of the security alert;
ranking the security alert in importance based on the data elements and new data elements of the security alert;
re-ranking the security alert when any of the data elements of the security alert change, when a new security alert is received or based on an amount of time since the security alert was assigned for resolution or an amount of time since the security alert was received or updated; and
issuing a command to take a programmed action for the security alert based on the data elements and the security alert ranking using an if this then that (IFTTT) expert system.
2. The computer readable storage medium of claim 1 , wherein the operations further comprise:
applying machine learning to user resolution of alerts that were received by the cybersecurity system to determine that the security alert is a false positive or a true positive, whereby the programmed action for the security alert is automatic closure of the security alert by the cybersecurity system if the security alert is a false positive, and automatic escalation of the security alert by the cybersecurity system if the security alert is a true positive.
3. The computer readable storage medium of claim 1 , wherein the operations further comprise:
using a messaging system to automatically inform a user about a status, a disposition, a creation, or the receipt of the security alert.
4. The computer readable storage medium of claim 1 , wherein the operations further comprise receiving the security alert by a pre-defined application program interface (API).
5. The computer readable storage medium of claim 1 , wherein the operations further comprise receiving the security alert from an email containing ASCII text.
6. The computer readable storage medium of claim 1 , wherein the additional information regarding the security alert is obtained from at least one of a threat-intelligence database, a threat intelligence feed, an information technology asset inventory system, a security information event management system, and an end-point system.
7. The computer readable storage medium of claim 1 , wherein the programmed action includes a remedial or containment action.
8. The computer readable storage medium of claim 1 , wherein the programmed action further comprises:
identifying a known malware variant based on malware information stored in a data field in an event fact table; and
executing a script to remove malware, wherein the script is selected based on the known malware variant.
9. The computer readable storage medium of claim 1 , wherein the operations further comprise:
assigning a normalized importance score to each data element for the security alert; and
combining the scores for the security alert using a formula to derive the ranking.
10. The computer readable storage medium of claim 9 , wherein the operations further comprise:
sorting a queue of alerts in order of importance; and
presenting the queue of alerts for review in order of their importance.
11. The computer readable storage medium of claim 10 , wherein the operations further comprise:
dynamically re-scoring and re-sorting the alert queue by importance when the new security alert is received or when a data element of the security alert is updated.
12. The computer readable storage medium of claim 1 , wherein the operations further comprise:
retaining historical importance scores for the security alert in a system database as part of an alert history; and
displaying a representation of the historical importance scores for the security alert over time.
13. The computer readable storage medium of claim 1 , wherein the operations further comprise determining that an advanced persistent threat attack is ongoing and adjusting the importance of the security alert accordingly.
14. The computer readable storage medium of claim 1 , wherein the operations further comprise determining that the new security alert is related to a prior alert in a historical alert database and adjusting the determining an importance of the new security alert accordingly.
15. The computer readable storage medium of claim 1 , wherein the operations further comprise:
determining that multiple alerts received within a designated time window for a specific asset as identified by an IP address or a hostname are related, and determining an importance score of the received multiple alerts accordingly.
16. The computer readable storage medium of claim 1 , wherein the operations further comprise adjusting the importance of the security alert based on a specific keyword present in the security alert.
17. The computer readable storage medium of claim 1 , wherein re-ranking the security alert includes re-ranking the security alert based on the amount of time since the security alert was received.
18. The computer readable storage medium of claim 1 , wherein re-ranking the security alert is based on one or more of: the amount of time since the security alert was assigned and the amount of time since the security alert was received or updated.
19. The computer readable storage medium of claim 1 , wherein the additional information regarding the security alert includes information about an asset that is under attack, wherein the information about the asset includes a person who owns the asset and a last person to log into the asset.
20. A cybersecurity system having a non-transitory computer readable storage medium storing one or more programs for execution by one or more processors, the one or more processors configured to:
receive a security alert that indicates a threat;
extract data elements from the security alert, the data elements including at least one of an internet protocol (IP) address, a hash, an alert priority, an alert type, a description, or a hostname;
determine a score for each data element of the security alert;
determine an importance score for the security alert based on the score for each data element:
rank the security alert in importance based on the importance score;
re-rank the security alert after any of the data elements for the security alert change; and
issue a command to take a programmed action for the security alert based on the data elements and the security alert ranking, using an if this then that (IFTTT) expert system.