Automated cybersecurity threat detection with aggregation and analysis
The systems and methods described herein generally relate to techniques for automated detection, aggregation, and integration of cybersecurity threats. The system ingests multiple data feeds which can be in one or numerous different formats. The system evaluates information based on defined scores to display to users threats and risks associated with them. The system also calculates decay rates for expiration of threats and indicators through various methods.
1. A method for collecting, processing, and displaying cybersecurity threat intelligence information, comprising:
collecting threat intelligence information from a plurality of threat intelligence information sources, the collected threat intelligence information being of different formats;
parsing the collected threat intelligence information into a common format;
storing the parsed threat intelligence information in a database, wherein the parsed threat intelligence information further comprises multiple threat indicators;
storing the threat indicators in the database in association with one or more parameter attributes, wherein a first parameter attribute is a source of a threat indicator;
receiving the parsed threat intelligence information comprising threat indicators from the database;
storing the parsed threat intelligence information in a first threat data container object;
receiving investigation information relating to an active threat investigation, wherein the investigation information is one or more of: an event type, attack vector, indicator of compromise, adversary attribution, or file, and wherein the investigation information is associated with a threat indicator;
storing the investigation information in a second threat data container object;
identifying a common relation between the first threat data container object and the second threat data container object based on the respective threat indicators of the first threat data container object and the second threat data container object;
displaying the first threat data container object, the second threat data container object and a graphical indication of the common relation between the first threat data container object and the second threat data container object;
exporting formatted threat intelligence information, wherein the formatted threat intelligence information includes indicators, sources, and dates for input to a set visualization process; and
calculating a set visualization of the threat intelligence information, wherein the set visualization is configured to calculate and display one or more of: a trend analysis, analysis based on date constraints, side-by-side comparison, or time series analysis.
2. The method of claim 1 , further comprising:
identifying multiple common relations between multiple threat data container objects;
assigning multiple subsets of common relations to multiple respective layers; and
selecting one of the multiple layers for display to a user such that the non-selected layers are not displayed.
3. The method of claim 2 , wherein at least one layer is associated with a level of access or an individual user.
4. The method of claim 1 , further comprising:
recording in association with a threat data container object an indication that a user has taken an action with respect to the threat data container object;
recording in association with the threat data container object a time associated with the action taken with respect to the threat data container object; and
displaying the threat data container object, a representation of the action taken, and the time associated with the action taken on the threat data container object.
5. The method of claim 1 , wherein the adversary attribution indicates one or more of a foreign intelligence actor, crimeware, hacktivist, or professional hacker.
6. The method of claim 1 , wherein threat intelligence information in the first threat data container object is a file hash, and the second threat data container contains at least one file hash, and further comprising:
comparing the file hashes in the first threat data container object and the second threat data container object to detect equality; and
if the file hashes are equal, then identifying a common relation between the first threat data container object and the second threat data container object, then identifying a file corresponding to the file hashes detected to be equal and transmitting that file to an external integration for threat analysis.
7. A method for collecting, processing, and displaying cybersecurity threat intelligence information, comprising:
collecting threat intelligence information from a plurality of threat intelligence information sources, the collected threat intelligence information being of different formats;
parsing the collected threat intelligence information into a common format;
storing the parsed threat intelligence information in a database, wherein the parsed threat intelligence information further comprises multiple threat indicators;
storing the threat indicators in the database in association with one or more parameter attributes, wherein a first parameter attribute is a source of a threat indicator;
receiving the parsed threat intelligence information comprising threat indicators from the database;
storing the parsed threat intelligence information in a first threat data container object;
receiving investigation information relating to an active threat investigation, wherein the investigation information is one or more of: an event type, attack vector, indicator of compromise, adversary attribution, or file, and wherein the investigation information is associated with a threat indicator;
storing the investigation information in a second threat data container object;
identifying a common relation between the first threat data container object and the second threat data container object based on the respective threat indicators of the first threat data container object and the second threat data container object; and
displaying the first threat data container object, the second threat data container object and a graphical indication of the common relation between the first threat data container object and the second threat data container object.
8. The method of claim 7 , further comprising:
identifying multiple common relations between multiple threat data container objects;
assigning multiple subsets of common relations to multiple respective layers; and
selecting one of the multiple layers for display to a user such that the non-selected layers are not displayed.
9. The method of claim 8 , wherein at least one layer is associated with a level of access or an individual user.
10. The method of claim 7 , further comprising:
recording in association with a threat data container object an indication that a user has taken an action with respect to the threat data container object;
recording in association with the threat data container object a time associated with the action taken with respect to the threat data container object; and
displaying the threat data container object, a representation of the action taken, and the time associated with the action taken on the threat data container object.
11. The method of claim 7 , wherein the adversary attribution indicates one or more of a foreign intelligence actor, crimeware, hacktivist, or professional hacker.
12. The method of claim 7 , wherein threat intelligence information in the first threat data container object is a file hash, and the second threat data container contains at least one file hash, and further comprising comparing the file hashes in the first threat data container object and the second threat data container object to detect equality, and if the file hashes are equal, then identifying a common relation between the first threat data container object and the second threat data container object.
13. The method of claim 12 , further comprising identifying a file corresponding to the file hashes detected to be equal, and transmitting that file to an external integration for threat analysis.