Threat mitigation system and method
A computer-implemented method, computer program product and computing system for: detecting a security event within a computing platform based upon identified suspect activity; gathering artifacts concerning the security event; and assigning a threat level to the security event based, at least in part, upon the gathered artifacts.
1. A computer-implemented method, executed on a computing device, comprising:
detecting a security event within a computing platform based upon identified suspect activity;
gathering artifacts concerning the security event;
assigning a threat level to the security event based, at least in part, upon the gathered artifacts; and
allowing a third-party to manually search the artifacts concerning the security event after the artifacts have been gathered, including:
obtaining at least one security-relevant information set from each of a plurality of security-relevant subsystems; and
combining the plurality of security-relevant information sets, including homogenizing the plurality of security-relevant information sets to have one or more of a common format, a common nomenclature, and a common structure.
2. The computer-implemented method of claim 1 wherein detecting a security event within a computing platform based upon identified suspect activity includes:
monitoring a plurality of sources to identify suspect activity within the computing platform.
3. The computer-implemented method of claim 1 wherein gathering artifacts concerning the security event includes:
gathering artifacts concerning the security event from a plurality of sources associated with the computing platform.
4. The computer-implemented method of claim 1 wherein assigning a threat level to the security event includes:
assigning a threat level using artificial intelligence and machine learning.
5. The computer-implemented method of claim 1 further comprising:
executing a remedial action plan based, at least in part, upon the assigned threat level.
6. The computer-implemented method of claim 5 wherein executing a remedial action plan includes:
allowing the suspect activity to continue.
7. The computer-implemented method of claim 5 wherein executing a remedial action plan includes:
generating a security event report based, at least in part, upon the gathered artifacts; and
providing the security event report to an analyst for further review.
8. The computer-implemented method of claim 5 wherein executing a remedial action plan includes:
autonomously executing a threat mitigation plan.
9. A computer program product residing on a non-transitory computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:
detecting a security event within a computing platform based upon identified suspect activity;
gathering artifacts concerning the security event;
assigning a threat level to the security event based, at least in part, upon the gathered artifacts; and
allowing a third-party to manually search the artifacts concerning the security event after the artifacts have been gathered, including:
obtaining at least one security-relevant information set from each of a plurality of security-relevant subsystems; and
combining the plurality of security-relevant information sets, including homogenizing the plurality of security-relevant information sets to have one or more of a common format, a common nomenclature, and a common structure.
10. The computer program product of claim 9 wherein detecting a security event within a computing platform based upon identified suspect activity includes:
monitoring a plurality of sources to identify suspect activity within the computing platform.
11. The computer program product of claim 9 wherein gathering artifacts concerning the security event includes:
gathering artifacts concerning the security event from a plurality of sources associated with the computing platform.
12. The computer program product of claim 9 wherein assigning a threat level to the security event includes:
assigning a threat level using artificial intelligence and machine learning.
13. The computer program product of claim 9 further comprising:
executing a remedial action plan based, at least in part, upon the assigned threat level.
14. The computer program product of claim 13 wherein executing a remedial action plan includes:
allowing the suspect activity to continue.
15. The computer program product of claim 13 wherein executing a remedial action plan includes:
generating a security event report based, at least in part, upon the gathered artifacts; and
providing the security event report to an analyst for further review.
16. The computer program product of claim 13 wherein executing a remedial action plan includes:
autonomously executing a threat mitigation plan.
17. A computing system including a processor and memory configured to perform operations comprising:
detecting a security event within a computing platform based upon identified suspect activity;
gathering artifacts concerning the security event;
assigning a threat level to the security event based, at least in part, upon the gathered artifacts; and
allowing a third-party to manually search the artifacts concerning the security event after the artifacts have been gathered, including:
obtaining at least one security-relevant information set from each of a plurality of security-relevant subsystems; and
combining the plurality of security-relevant information sets, including homogenizing the plurality of security-relevant information sets to have one or more of a common format, a common nomenclature, and a common structure.
18. The computing system of claim 17 wherein detecting a security event within a computing platform based upon identified suspect activity includes:
monitoring a plurality of sources to identify suspect activity within the computing platform.
19. The computing system of claim 17 wherein gathering artifacts concerning the security event includes:
gathering artifacts concerning the security event from a plurality of sources associated with the computing platform.
20. The computing system of claim 17 wherein assigning a threat level to the security event includes:
assigning a threat level using artificial intelligence and machine learning.
21. The computing system of claim 17 further comprising:
executing a remedial action plan based, at least in part, upon the assigned threat level.
22. The computing system of claim 21 wherein executing a remedial action plan includes:
allowing the suspect activity to continue.
23. The computing system of claim 21 wherein executing a remedial action plan includes:
generating a security event report based, at least in part, upon the gathered artifacts; and
providing the security event report to an analyst for further review.
24. The computing system of claim 21 wherein executing a remedial action plan includes:
autonomously executing a threat mitigation plan.