Platform and method for performing cybersecurity analyses employing an intelligence hub with a modular architecture
A network device for collecting and distributing cybersecurity intelligence, which features analytics logic and a plurality of plug-ins. The analytics logic is configured to (i) receive a request message to conduct a cybersecurity analysis and (ii) select one of a first set or second set of plug-ins to conduct the cybersecurity analysis. Responsive to selecting a first plug-in of the first set of plug-ins by the analytics logic, the system conducts and completes the cybersecurity analysis while a communication session between the first plug-in and a network device initiating the request message remains open. Responsive to selecting a second plug-in by the analytics logic, the system conducts and completes the cybersecurity analysis while allowing the cybersecurity intelligence to be provided in response to the request message during a different and subsequent communication session than the communication session during which the request message is received.
1. A cybersecurity intelligence hub for collecting and distributing cybersecurity intelligence, the cybersecurity intelligence hub comprising:
a non-transitory storage medium operating as a data store to store meta-information for prior evaluated artifacts;
a plurality of plug-ins; and
analytics logic communicatively coupled to at least the plurality of plug-ins, the analytics logic being configured to (i) receive a request message to conduct a cybersecurity analysis, (ii) select at least one plug-in of the plurality of plug-ins to analyze the stored meta-information for the prior evaluated artifacts and perform the cybersecurity analysis requested by the request message to obtain the cybersecurity intelligence, and (iii) provide, using meta-information within the request message, the cybersecurity intelligence in response to the request message,
wherein the plurality of plug-ins comprises (i) a first set of plug-ins each configured to analyze the stored meta-information for the prior evaluated artifacts and provide the cybersecurity intelligence in response to and during a same communication session as the request message and (ii) a second set of plug-ins each being configured to analyze the stored meta-information for the prior evaluated artifacts and allow the cybersecurity intelligence to be provided in response to the request message during a different and subsequent communication session than a communication session during which the request message is received.
2. The cybersecurity intelligence hub of claim 1 further comprising user interface logic operating as a portal that authenticates access to the analytics logic,
wherein the request message is a query from a customer, via the user interface logic, requesting stored meta-information including any of the prior evaluated artifacts classified as malicious and submitted by one or more network devices associated with the customer.
3. The cybersecurity intelligence hub of claim 1 , wherein each of the first set of plug-ins is configured to handle request messages that require lesser latency than latencies associated with servicing request messages handled by the second set of plug-ins.
4. The cybersecurity intelligence hub of claim 1 , wherein the analytics logic being configured to (i) receive the request message, including the meta-information associated with an artifact, from a cybersecurity sensor, (ii) select the at least one plug-in, being one of the first set of plug-ins, to analyze the stored meta-information for the prior evaluated artifacts, and (iii) determine, using the meta-information associated with the artifact, a consolidated verdict for the artifact being part of the cybersecurity intelligence to be provided to the cybersecurity sensor.
5. The cybersecurity intelligence hub of claim 1 , wherein a plug-in of the second set of plug-ins being configured to receive cybersecurity information regarding previously encountered incidents exhibiting one or more indicators of compromise as part of the request message, the one or more indicators of compromise being utilized as a search index.
6. The cybersecurity intelligent hub of claim 1 , wherein the plurality of plug-ins further include a third set of plug-ins each configured to analyze the stored meta-information for the prior evaluated artifacts and generate at least a portion of the cybersecurity intelligence provided in response to the request message.
7. The cybersecurity intelligent hub of claim 6 , wherein one of the third set of plug-ins comprises a plug-in configured to identify a campaign being a cyber-attack based on repetitious attempts targeted towards a network device or a network associated with the network device to infiltrate and disrupt operations of the network device or the network based on analysis of prior evaluated artifacts of the stored meta-information being of a malicious classification.
8. A system for determining whether an artifact is associated with a cyber-attack, the system comprising:
one or more network devices operating as one or more cybersecurity sensors, each of the one or more network devices including a hardware processor; and
a cybersecurity intelligence hub remotely located from and communicatively coupled to the one or more cybersecurity sensors over a network, the cybersecurity intelligence hub comprises
a data store to store meta-information for prior evaluated artifacts,
interface logic operating as a customer portal or as an administrator portal,
a plurality of plug-ins, and
analytics logic communicatively coupled to the data store and the plurality of plug-ins, the analytics logic configured to (i) receive a request message including meta-information associated with an artifact from a cybersecurity sensor of the one or more cybersecurity sensors, (ii) select at least one plug-in of the plurality of plug-ins to analyze a portion of the stored meta-information for the prior evaluated artifacts, and (iii) determine, using the meta-information associated with the artifact, a consolidated verdict for the artifact to be provided to the cybersecurity sensor,
wherein the plurality of plug-ins comprise (i) a first set of plug-ins including a first plug-in configured to analyze the stored meta-information for prior evaluated artifacts and provide the consolidated verdict for the artifact to the cybersecurity sensor within a first latency threshold and during a same communication session as the request message, and (ii) a second set of plug-ins each being configured to analyze the stored meta-information for the prior evaluated artifacts and allow cybersecurity intelligence to be provided in response to a second request message received by the analytics logic, the cybersecurity intelligence being provided within a second latency threshold that is greater than the first latency threshold.
9. The system of claim 8 , wherein the cybersecurity intelligence hub further comprising data management logic configured to retrieve the portion of the stored meta-information from the data store for use by the at least one plug-in of the plurality of plug-ins and the analytics logic to determine the consolidated verdict for the artifact.
10. The system of claim 8 , wherein the plurality of plug-ins of the cybersecurity intelligence hub includes the first set of plug-ins including the first plug-in configured to analyze the stored meta-information for the prior evaluated artifacts.
11. The system of claim 10 , wherein the plurality of plug-ins of the cybersecurity intelligence hub further includes the second set of plug-ins each being configured to analyze the stored meta-information for the prior evaluated artifacts and allow the cybersecurity intelligence to be provided in response to the second request message received by the analytics logic, the cybersecurity intelligence being provided during a different and subsequent communication session than the communication session during which the second request message is received.
12. The system of claim 8 , wherein the plurality of plug-ins of the cybersecurity intelligent hub includes a third set of plug-ins, each plug-in of the third set of plug-ins being configured to analyze the stored meta-information for the prior evaluated artifacts and generate cybersecurity intelligence available for retrieval from the data store via the interface logic.
13. The system of claim 12 , wherein a plug-in of the third set of plug-ins being configured to identify a campaign being a cyber-attack based on repetitious attempts targeted towards a network device or a network associated with the network device to infiltrate and disrupt operations of the network device or the network based on analysis of prior evaluated artifacts of the stored meta-information being of a malicious classification.
14. A cybersecurity intelligence hub for collecting and distributing cybersecurity intelligence, the cybersecurity intelligence hub comprising:
a non-transitory storage medium;
analytics logic stored within the non-transitory storage medium, the analytic logic being configured to (i) receive a request message to conduct a cybersecurity analysis and (ii) select at least one module of a plurality of modules to conduct the cybersecurity analysis; and
the plurality of modules including at least a first set of modules and a second set of modules, wherein
responsive to selecting at least one module of the first set of modules by the analytics logic, conducting and completing the cybersecurity analysis while a communication session between the at least one module of the first set of modules and a network device initiating the request message remains open, and
responsive to selecting at least one module of the second set of modules by the analytics logic, conducting and completing the cybersecurity analysis while allowing the cybersecurity intelligence to be provided in response to the request message during a different and subsequent communication session than the communication session during which the request message is received.
15. The cybersecurity intelligence hub of claim 14 , wherein the at least one module is a software plug-in communicatively coupled to the analytics logic.
16. The cybersecurity intelligence hub of claim 15 further comprising user interface logic operating as a portal that authenticates access to the analytics logic,
wherein the request message is a query from a customer, via the user interface logic, conducting the cybersecurity analysis by at least requesting stored meta-information including any of the prior evaluated artifacts classified as malicious and submitted by one or more network devices associated with the customer.
17. The cybersecurity intelligence hub of claim 15 , wherein the analytics logic being configured to (i) receive the request message, including the meta-information associated with an artifact, from a cybersecurity sensor, (ii) select the at least one module, being one of the first set of modules, to conduct the cybersecurity analysis by at least analyzing stored meta-information for the prior evaluated artifacts, and (iii) determine, using the meta-information associated with the artifact, a consolidated verdict for the artifact being part of the cybersecurity intelligence to be provided to the cybersecurity sensor.
18. The cybersecurity intelligence hub of claim 17 , wherein a module of the second set of modules being configured to receive cybersecurity information regarding previously encountered incidents exhibiting one or more indicators of compromise as part of the request message, the one or more indicators of compromise being utilized as a search index.
19. The cybersecurity intelligent hub of claim 17 , wherein the plurality of modules further include a third set of modules each configured to analyze the stored meta-information for the prior evaluated artifacts and generate at least a portion of the cybersecurity intelligence provided in response to the request message.
20. The cybersecurity intelligent hub of claim 17 , wherein the plurality of modules further include a third set of modules operating as a background process, each of the third set of modules being configured to analyze the stored meta-information for the prior evaluated artifacts and generate at least a portion of the cybersecurity intelligence provided over a portal.
21. The cybersecurity intelligent hub of claim 19 or 20 , wherein one of the third set of modules comprises a plug-in configured to identify a campaign being a cyber-attack based on repetitious attempts directed towards a network device or a network to which the network device is connected, the repetitious attempts to infiltrate and disrupt operations of the network device or the network based on analysis of prior evaluated artifacts of the stored meta-information being of a malicious classification.
22. The cybersecurity intelligent hub of claim 19 or 20 , wherein one of the third set of modules comprises a plug-in configured to analyze stored meta-information within a data store for cyber-attack trends across enterprises, industries, government agencies, or geographic locations.