Threat mitigation system and method
A computer-implemented method, computer program product and computing system for: establishing connectivity with a plurality of security-relevant subsystems within a computing platform; receiving a unified query from a third-party concerning the plurality of security-relevant subsystems; distributing at least a portion of the unified query to the plurality of security-relevant subsystems; and effectuating the at least a portion of the unified query on each of the plurality of security-relevant subsystems to generate a plurality of result sets.
1. A computer-implemented method, executed on a computing device, comprising:
detecting a security event within a computing platform;
gathering artifacts concerning the security event from log files maintained by a plurality of security-relevant subsystems, including obtaining artifact information concerning one or more artifacts from one or more investigation resources;
assigning a threat level to the security event using artificial intelligence/machine learning;
executing a remedial action plan based upon, at least in part, the assigned threat level;
generating a security event report based upon, at least in part, the gathered artifacts;
obtaining consolidated platform information concerning the computing platform;
processing the consolidated platform information to identify one or more non-deployed security-relevant subsystems;
ranking the one or more non-deployed security-relevant subsystems based on anticipated use within the computing platform, wherein ranking the one or more non-deployed security-relevant subsystems is based on:
one or more of a functionality and an effectiveness of the non-deployed security relevant subsystems; and
an anticipated manner in which the implementation of the one or more nondeployed security relevant subsystems will impact a functionality/security of the computing platform;
searching the artifacts concerning the security event within log files maintained by the plurality of security-relevant subsystems including:
establishing connectivity with the plurality of security-relevant subsystems within the computing platform including utilizing a respective application program interface to access each of the plurality of security-relevant subsystems, wherein each security-relevant subsystem of the plurality of security-relevant subsystems is configured to monitor and log their activity with respect to the computing platform;
receiving a unified query concerning logged files of the plurality of security-relevant subsystems with respect to the computing platform;
distributing at least a portion of the unified query to the plurality of security-relevant subsystems, including:
parsing the unified query to form a plurality of queries, wherein a specific query is defined for each of the plurality of security-relevant subsystems; and
providing the specific query defined for each of the plurality of security-relevant subsystems to the respective security-relevant subsystems;
effectuating the at least a portion of the unified query on each of the plurality of security-relevant subsystems to generate a plurality of result sets;
receiving the plurality of result sets from the plurality of security-relevant subsystems; and
processing one or more results sets of the plurality of result sets so that the results sets all have at least one of a common format, a common nomenclature, and a common structure, and rendering the results set as security-relevant information within an interactive report.
2. The computer-implemented method of claim 1 further comprising:
combining the plurality of result sets to form a unified query result.
3. The computer-implemented method of claim 2 wherein combining the plurality of result sets to form a unified query result includes:
homogenizing the plurality of result sets to form the unified query result.
4. The computer-implemented method of claim 2 further comprising:
providing the unified query result to a third-party.
5. The computer-implemented method of claim 1 wherein the plurality of security-relevant subsystems includes one or more of:
a data lake;
a data log;
a security-relevant software application;
a security-relevant hardware system; and
a resource external to the computing platform.
6. A computer program product residing on a non-transitory computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:
detecting a security event within a computing platform;
gathering artifacts concerning the security event from log files maintained by a plurality of security-relevant subsystems, including obtaining artifact information concerning one or more artifacts from one or more investigation resources;
assigning a threat level to the security event using artificial intelligence/machine learning;
executing a remedial action plan based upon, at least in part, the assigned threat level;
generating a security event report based upon, at least in part, the gathered artifacts;
obtaining consolidated platform information concerning the computing platform;
processing the consolidated platform information to identify one or more non-deployed security-relevant subsystems;
ranking the one or more non-deployed security-relevant subsystems based on anticipated use within the computing platform, wherein ranking the one or more non-deployed security-relevant subsystems is based on:
one or more of a functionality and an effectiveness of the non-deployed security relevant subsystems; and
an anticipated manner in which the implementation of the one or more non-deployed security relevant subsystems will impact a functionality/security of the computing platform;
searching the artifacts concerning the security event within log files maintained by the plurality of security-relevant subsystems including:
establishing connectivity with the plurality of security-relevant subsystems within the computing platform including utilizing a respective application program interface to access each of the plurality of security-relevant subsystems, wherein each security-relevant subsystem of the plurality of security-relevant subsystems is configured to monitor and log their activity with respect to the computing platform;
receiving a unified query concerning logged files of the plurality of security-relevant subsystems with respect to the computing platform;
distributing at least a portion of the unified query to the plurality of security-relevant subsystems, including:
parsing the unified query to form a plurality of queries, wherein a specific query is defined for each of the plurality of security-relevant subsystems; and
providing the specific query defined for each of the plurality of security-relevant subsystems to the respective security-relevant subsystems;
effectuating the at least a portion of the unified query on each of the plurality of security-relevant subsystems to generate a plurality of result sets;
receiving the plurality of result sets from the plurality of security-relevant subsystems; and
processing one or more results sets of the plurality of result sets so that the results sets all have at least one of a common format, a common nomenclature, and a common structure, and rendering the results set as security-relevant information within an interactive report.
7. The computer program product of claim 6 further comprising:
combining the plurality of result sets to form a unified query result.
8. The computer program product of claim 7 wherein combining the plurality of result sets to form a unified query result includes:
homogenizing the plurality of result sets to form the unified query result.
9. The computer program product of claim 7 further comprising:
providing the unified query result to a third-party.
10. The computer program product of claim 6 wherein the plurality of security-relevant subsystems includes one or more of:
a data lake;
a data log;
a security-relevant software application;
a security-relevant hardware system; and
a resource external to the computing platform.
11. A computing system including a processor and memory configured to perform operations comprising:
detecting a security event within a computing platform;
gathering artifacts concerning the security event from log files maintained by a plurality of security-relevant subsystems, including obtaining artifact information concerning one or more artifacts from one or more investigation resources;
assigning a threat level to the security event using artificial intelligence/machine learning;
executing a remedial action plan based upon, at least in part, the assigned threat level;
generating a security event report based upon, at least in part, the gathered artifacts;
obtaining consolidated platform information concerning the computing platform;
processing the consolidated platform information to identify one or more non-deployed security-relevant subsystems;
ranking the one or more non-deployed security-relevant subsystems based on anticipated use within the computing platform, wherein ranking the one or more non-deployed security-relevant subsystems is based on:
one or more of a functionality and an effectiveness of the non-deployed security relevant subsystems; and
an anticipated manner in which the implementation of the one or more non-deployed security relevant subsystems will impact a functionality/security of the computing platform;
searching the artifacts concerning the security event within log files maintained by the plurality of security-relevant subsystems including:
establishing connectivity with the plurality of security-relevant subsystems within the computing platform including utilizing a respective application program interface to access each of the plurality of security-relevant subsystems, wherein each security-relevant subsystem of the plurality of security-relevant subsystems is configured to monitor and log their activity with respect to the computing platform;
receiving a unified query concerning logged files of the plurality of security-relevant subsystems with respect to the computing platform;
distributing at least a portion of the unified query to the plurality of security-relevant subsystems, including:
parsing the unified query to form a plurality of queries, wherein a specific query is defined for each of the plurality of security-relevant subsystems; and
providing the specific query defined for each of the plurality of security-relevant subsystems to the respective security-relevant subsystems;
effectuating the at least a portion of the unified query on each of the plurality of security-relevant subsystems to generate a plurality of result sets;
receiving the plurality of result sets from the plurality of security-relevant subsystems; and
processing one or more results sets of the plurality of result sets so that the results sets all have at least one of a common format, a common nomenclature, and a common structure, and rendering the results set as security-relevant information within an interactive report.
12. The computing system of claim 11 further comprising:
combining the plurality of result sets to form a unified query result.
13. The computing system of claim 12 wherein combining the plurality of result sets to form a unified query result includes:
homogenizing the plurality of result sets to form the unified query result.
14. The computing system of claim 12 further comprising:
providing the unified query result to a third-party.
15. The computing system of claim 11 wherein the plurality of security-relevant subsystems includes one or more of:
a data lake;
a data log;
a security-relevant software application;
a security-relevant hardware system; and
a resource external to the computing platform.