Selecting security incidents for advanced automatic analysis

1. A method for prioritizing security incidents for analysis, the method comprising:

retrieving a set of security information and event management data corresponding to each of a set of security incidents;

using a source weight of a security incident and a magnitude of the security incident to determine a priority of the security incident within the set of security incidents; and

performing a local analysis of the security incident based on the retrieved set of security information and event management data corresponding to the security incident and the determined priority of the security incident.

2. The method of claim 1 further comprising:

determining whether the security incident is to be analyzed remotely based on characteristics of the security incident discovered during the local analysis;

responsive to determining that the security incident is to be analyzed remotely based on the characteristics of the security incident discovered during the local analysis, sending the security incident for remote analysis; and

receiving a result of the remote analysis of the security incident.

3. The method of claim 2 further comprising:

adjusting the magnitude of the security incident based on the result of the remote analysis; and

performing a security incident mitigation action step corresponding to the security incident when the magnitude of the security incident is greater than a security incident magnitude threshold level.

4. The method of claim 2 , wherein the characteristics of the security incident discovered during the local analysis include at least one of an observable linked to the security incident, the observable is listed in threat intelligence data, the observable has a security risk score above a threshold, the observable is a known malware hash linked to the security incident, execution of the observable that is a file linked to the security incident, and the observable that is an asset linked to the security incident has an asset weight greater than an asset weight threshold.

5. The method of claim 2 , wherein the remote analysis is performed by a machine learning algorithm of a cloud-based platform.

6. The method of claim 1 further comprising:

determining whether new and unanalyzed security incidents are found during a search of a security incidents database;

responsive to determining that one or more new or unanalyzed security incidents were found during the search of the security incidents database, sorting the found security incidents in descending order by security incident source weight and security incident magnitude of each found security incident;

generating a ranked list of the found security incidents based on the sorting according to the security incident source weight and magnitude of each found security incident; and

selecting a high-ranking security incident in the ranked list.

7. The method of claim 6 further comprising:

applying thresholds to the selected security incident;

determining whether the selected security incident is to be analyzed locally based on applying the thresholds to the selected security incident; and

responsive to determining that the selected security incident is to be analyzed locally, performing the local analysis of the selected security incident using a security information and event manager.

8. The method of claim 7 , wherein the thresholds include a plurality of security incident time thresholds and a plurality of security incident magnitude thresholds.

9. The method of claim 6 further comprising:

applying filters to the selected security incident;

determining whether the selected security incident is to be analyzed locally based on applying the filters to the selected security incident; and

responsive to determining that the selected security incident is to be analyzed locally, performing the local analysis of the selected security incident using a security information and event manager.

10. The method of claim 9 , wherein the filters include a security incident source filter and a security incident category filter.

11. The method of claim 1 , wherein the set of security information and event management data corresponding to each of a set of security incidents is retrieved on a periodic basis.

12. The method of claim 1 , wherein a current analysis status of the security incident is also used to determine the priority of the security incident within the set of security incidents.

13. A computer system for prioritizing security incidents for analysis, the computer system comprising:

a bus system;

a storage device connected to the bus system, wherein the storage device stores program instructions; and

a processor connected to the bus system, wherein the processor executes the program instructions to:

retrieve a set of security information and event management data corresponding to each of a set of security incidents;

use a source weight of a security incident and a magnitude of the security incident to determine a priority of the security incident within the set of security incidents; and

perform a local analysis of the security incident based on the retrieved set of security information and event management data corresponding to the security incident and the determined priority of the security incident.

14. The computer system of claim 13 , wherein the processor further executes the program instructions to:

determine whether the security incident is to be analyzed remotely based on characteristics of the security incident discovered during the local analysis;

send the security incident for remote analysis in response to determining that the security incident is to be analyzed remotely based on the characteristics of the security incident discovered during the local analysis; and

receive a result of the remote analysis of the security incident.

15. The computer system of claim 14 , wherein the processor further executes the program instructions to:

adjust the magnitude of the security incident based on the result of the remote analysis; and

perform a security incident mitigation action step corresponding to the security incident when the magnitude of the security incident is greater than a security incident magnitude threshold level.

16. The computer system of claim 14 , wherein the characteristics of the security incident discovered during the local analysis include at least one of an observable linked to the security incident, the observable is listed in threat intelligence data, the observable has a security risk score above a threshold, the observable is a known malware hash linked to the security incident, execution of the observable that is a file linked to the security incident, and the observable that is an asset linked to the security incident has an asset weight greater than an asset weight threshold.

17. A computer program product for prioritizing security incidents for analysis, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method comprising:

retrieving a set of security information and event management data corresponding to each of a set of security incidents;

using a source weight of a security incident and a magnitude of the security incident to determine a priority of the security incident within the set of security incidents; and

performing a local analysis of the security incident based on the retrieved set of security information and event management data corresponding to the security incident and the determined priority of the security incident.

18. The computer program product of claim 17 further comprising:

determining whether the security incident is to be analyzed remotely based on characteristics of the security incident discovered during the local analysis;

responsive to determining that the security incident is to be analyzed remotely based on the characteristics of the security incident discovered during the local analysis, sending the security incident for remote analysis; and

receiving a result of the remote analysis of the security incident.

19. The computer program product of claim 18 further comprising:

adjusting the magnitude of the security incident based on the result of the remote analysis; and

performing a security incident mitigation action step corresponding to the security incident when the magnitude of the security incident is greater than a security incident magnitude threshold level.

20. The computer program product of claim 18 , wherein the characteristics of the security incident discovered during the local analysis include at least one of an observable linked to the security incident, the observable is listed in threat intelligence data, the observable has a security risk score above a threshold, the observable is a known malware hash linked to the security incident, execution of the observable that is a file linked to the security incident, and the observable that is an asset linked to the security incident has an asset weight greater than an asset weight threshold.