Risk based priority processing of data
Utilities (e.g., methods, systems, apparatuses, etc.) for use in generating and making use of priority scores for data generated by one or more data systems that more accurately prioritize those events and other pieces of data to be addressed by analysts and troubleshooters before others (e.g., collectively taking into account threats posed by origin host components and risks to impacted host components) to work the highest risk events and alarms first and to effectively and efficiently spend their alarm monitoring time.
1. A method for use in monitoring data generated by one or more data systems, the method comprising:
receiving, at a processor over at least one communications network, data generated by one or more data systems;
operating the processor to parse from a data field of the data at least one of an origin host identifier associated with an origin host component responsible for initiating an occurrence on the one or more data systems and an impacted host identifier associated with an impacted host component that is affected by an occurrence on the one or more data systems;
determining, by the processor, that the at least one of the origin host identifier and impacted host identifier cannot be used to obtain a previously-configured relative risk or threat level for the origin host component or impacted host component from a database of known hosts and corresponding previously-configured relative risk or threat levels;
obtaining, by the processor, a substitute relative risk or threat level for the origin host component or impacted host component using the at least one of the origin host identifier and impacted host identifier, wherein the obtaining includes using the at least one of the origin host identifier and impacted host identifier to obtain at least one default threat level for the origin host component or impacted host component, wherein the substitute relative risk or threat level is the at least one default risk or threat level, wherein the at least one default risk or threat level is one or more first default threat levels when the at least one of the origin host identifier and impacted host identifier is the origin host identifier, and wherein the at least one default risk or threat level is one or more second default risk levels when the at least one of the origin host identifier and impacted host identifier is the impacted host identifier;
inferring, by the processor, whether the at least one of the origin host identifier and impacted host identifier identifies an internal host or an external host, wherein the inferring includes obtaining a heading of the data field and determining that the at least one of the origin host identifier and impacted host identifier identifies an internal host or an external host based on the obtained heading, wherein the at least one default risk or threat level is obtained based on a result of the inferring, wherein the one or more first default threat levels includes an external host default threat level for when the origin host component is inferred to be an external host and an internal host default threat level for when the origin host component is inferred to be an internal host, and wherein the one or more second default risk levels includes an external host default threat level for when the impacted host component is inferred to be an external host and an internal host default threat level for when the impacted host component is inferred to be an internal host; and
generating, with the processor, a risk based priority score for the data with the substitute relative risk or threat level.
2. The method of claim 1 , further including:
writing the risk based priority score to a field in the data.
3. The method of claim 1 , wherein the obtaining includes:
using the at least one of the origin host identifier and impacted host identifier to obtain a relative risk or threat level of a known network range within which the at least one of the origin host identifier and impacted host identifier is present, wherein the substitute relative risk or threat level is the relative risk or threat level of the known network range.
4. The method of claim 1 , further including:
determining that the at least one of the origin host identifier and impacted host identifier cannot be used to obtain a relative risk or threat level of a known network range within which the at least one of the origin host identifier and impacted host identifier is present.
5. The method of claim 1 , further including:
determining, by the processor, whether the at least one of the origin host identifier and impacted host identifier identifies a known host that is configured as an internal host or an external host, wherein the inferring includes inferring that the at least one of the origin host identifier and impacted host identifier identifies an internal host when the at least one of the origin host identifier and impacted host identifier identifies a known host that is configured as an internal host, and wherein the inferring includes inferring that the at least one of the origin host identifier and impacted host identifier identifies an external host when the at least one of the origin host identifier and impacted host identifier identifies a known host that is configured as an external host.
6. The method of claim 1 , further including:
determining, by the processor, whether the at least one of the origin host identifier and impacted host identifier is resident within at least one network range that is configured as an internal network or an external network, wherein the inferring includes inferring that the at least one of the origin host identifier and impacted host identifier identifies an internal host when the at least one of the origin host identifier and impacted host identifier is resident within at least one network range that is configured as an internal network, and wherein the inferring includes inferring that the at least one of the origin host identifier and impacted host identifier identifies an external host when the at least one of the origin host identifier and impacted host identifier is resident within at least one network range that is configured as an external network.
7. The method of claim 1 , further including:
determining whether the at least one of the origin host identifier and impacted host identifier is resident within at least one private network range, wherein the inferring includes inferring that the at least one of the origin host identifier and impacted host identifier identifies an internal host when the at least one of the origin host identifier and impacted host identifier is resident within at least one private network range, and wherein the inferring includes inferring that the at least one of the origin host identifier and impacted host identifier identifies an external host when the at least one of the origin host identifier and impacted host identifier is not resident within at least one private network range.
8. The method of claim 1 , further including:
determining whether the at least one of the origin host identifier and impacted host identifier is resident within at least a first list of identifiers, wherein the first list of identifiers is assigned a first relative threat level, and wherein the default threat level is obtained based on a result of the whether the at least one of the origin host identifier and impacted host identifier is determined to be resident within the first list of identifiers.
9. The method of claim 8 , wherein the at least one default threat level is the first relative threat level when the at least one of the origin host identifier and impacted host identifier is determined to be resident within the first list of identifiers.
10. The method of claim 8 , further including:
ascertaining that the at least one of the origin host identifier and impacted host identifier is resident within the first list of identifiers and within a second list of identifiers, wherein the second list of identifiers is assigned a second relative threat level different than the first relative threat level, and wherein the at least one default threat level is the one of the first and second relative threat levels that is more severe than the other of the first and second relative threat levels.
11. The method of claim 1 , further including:
obtaining, by the processor, a risk rating assigned to a classification of the data determined by a processing rule used to process the data, wherein the generating includes generating the risk based priority score with classification risk rating.
12. The method of claim 11 , wherein the generating includes:
allowing, by the processor, one of the classification risk rating and the substitute relative risk or threat level to influence generation of the risk based priority score more than the other of the classification risk rating and the substitute relative risk or threat level.