Threat mitigation system and method
A computer-implemented method, computer program product and computing system is provided that may be utilized in a threat mitigation system. The method may include displaying initial security-relevant information that includes analytical information. The method may also include allowing a third-party to manipulate the initial security-relevant information with automation information. The method may further include generating revised security-relevant information that includes the automation information.
1. A computer-implemented method, executed on a computing device, comprising:
generating, via one or more security-relevant subsystems, initial security-relevant information, wherein the one or more security-relevant subsystems include one or more of a content delivery network system, a database activity monitoring system, a user behavior analytics system, a mobile device management system, an identity and access management system, and a domain name server system;
displaying the initial security-relevant information that includes analytical information;
allowing a third-party to manipulate the initial security-relevant information with automation information;
generating revised security-relevant information, resulting from the manipulated initial security-relevant information, that includes the automation information;
obtaining one or more security-relevant information sets from each of the one or more security-relevant subsystems;
defining an initial probabilistic model for accomplishing at least one defined task based on the one or more security-relevant information sets, the at least one defined task including a training routine for a specific attack of a computing platform, wherein defining the initial probabilistic model for accomplishing the at least one defined task includes generating a simulation of the specific attack;
identifying one or more commonalities amongst the one or more security-relevant information sets, via the initial probabilistic model, using artificial intelligence/machine learning; and
combining the one or more security-relevant information sets based on the one or more commonalities to form an aggregated security-relevant information set of the initial security-relevant information and the revised security-relevant information.
2. The computer-implemented method of claim 1 further comprising:
rendering the revised security-relevant information.
3. The computer-implemented method of claim 2 wherein rendering the revised security-relevant information includes:
rendering the revised security-relevant information within an interactive report.
4. The computer-implemented method of claim 1 wherein allowing a third-party to manipulate the initial security-relevant information with automation information includes:
allowing a third-party to select automation information to add to the initial security-relevant information to generate the revised security-relevant information.
5. The computer-implemented method of claim 4 wherein allowing a third-party to select the automation information to add to the initial security-relevant information to generate the revised security-relevant information includes:
allowing the third-party to choose a specific type of automation information from a plurality of automation information types.
6. The computer-implemented method of claim 1 wherein generating revised security-relevant information that includes the automation information includes:
combining the automation information and the initial security-relevant information to generate the revised security-relevant information.
7. The computer-implemented method of claim 1 wherein the analytical information includes one or more of:
investigative information; and
hunting information.
8. The computer-implemented method of claim 1 wherein the automation information includes one or more of:
automated information; and
orchestrated information.
9. A computer program product residing on a non-transitory computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:
generating, via one or more security-relevant subsystems, initial security-relevant information, wherein the one or more security-relevant subsystems include one or more of a content delivery network system, a database activity monitoring system, a user behavior analytics system, a mobile device management system, an identity and access management system, and a domain name server system;
displaying the initial security-relevant information that includes analytical information;
allowing a third-party to manipulate the initial security-relevant information with automation information;
generating revised security-relevant information, resulting from the manipulated initial security-relevant information, that includes the automation information;
obtaining one or more security-relevant information sets from each of the one or more security-relevant subsystems;
defining an initial probabilistic model for accomplishing at least one defined task based on the one or more security-relevant information sets, the at least one defined task including a training routine for a specific attack of a computing platform, wherein defining the initial probabilistic model for accomplishing the at least one defined task includes generating a simulation of the specific attack;
identifying one or more commonalities amongst the one or more security-relevant information sets, via the initial probabilistic model, using artificial intelligence/machine learning; and
combining the one or more security-relevant information sets based on the one or more commonalities to form an aggregated security-relevant information set of the initial security-relevant information and the revised security-relevant information.
10. The computer program product of claim 9 further comprising:
rendering the revised security-relevant information.
11. The computer program product of claim 10 wherein rendering the revised security-relevant information includes:
rendering the revised security-relevant information within an interactive report.
12. The computer program product of claim 9 wherein allowing a third-party to manipulate the initial security-relevant information with automation information includes:
allowing a third-party to select automation information to add to the initial security-relevant information to generate the revised security-relevant information.
13. The computer program product of claim 12 wherein allowing a third-party to select the automation information to add to the initial security-relevant information to generate the revised security-relevant information includes:
allowing the third-party to choose a specific type of automation information from a plurality of automation information types.
14. The computer program product of claim 9 wherein generating revised security-relevant information that includes the automation information includes:
combining the automation information and the initial security-relevant information to generate the revised security-relevant information.
15. The computer program product of claim 9 wherein the analytical information includes one or more of:
investigative information; and
hunting information.
16. The computer program product of claim 9 wherein the automation information includes one or more of:
automated information; and
orchestrated information.
17. A computing system including a processor and memory configured to perform operations comprising:
generating, via one or more security-relevant subsystems, initial security-relevant information, wherein the one or more security-relevant subsystems include one or more of a content delivery network system, a database activity monitoring system, a user behavior analytics system, a mobile device management system, an identity and access management system, and a domain name server system;
displaying the initial security-relevant information that includes analytical information;
allowing a third-party to manipulate the initial security-relevant information with automation information;
generating revised security-relevant information, resulting from the manipulated initial security-relevant information, that includes the automation information;
obtaining one or more security-relevant information sets from each of the one or more security-relevant subsystems;
defining an initial probabilistic model for accomplishing at least one defined task based on the one or more security-relevant information sets, the at least one defined task including a training routine for a specific attack of a computing platform, wherein defining the initial probabilistic model for accomplishing the at least one defined task includes generating a simulation of the specific attack;
identifying one or more commonalities amongst the one or more security-relevant information sets, via the initial probabilistic model, using artificial intelligence/machine learning; and
combining the one or more security-relevant information sets based on the one or more commonalities to form an aggregated security-relevant information set of the initial security-relevant information and the revised security-relevant information.
18. The computing system of claim 17 further comprising:
rendering the revised security-relevant information.
19. The computing system of claim 16 wherein rendering the revised security-relevant information includes:
rendering the revised security-relevant information within an interactive report.
20. The computing system of claim 17 wherein allowing a third-party to manipulate the initial security-relevant information with automation information includes:
allowing a third-party to select automation information to add to the initial security-relevant information to generate the revised security-relevant information.
21. The computing system of claim 20 wherein allowing a third-party to select the automation information to add to the initial security-relevant information to generate the revised security-relevant information includes:
allowing the third-party to choose a specific type of automation information from a plurality of automation information types.
22. The computing system of claim 17 wherein generating revised security-relevant information that includes the automation information includes:
combining the automation information and the initial security-relevant information to generate the revised security-relevant information.
23. The computing system of claim 17 wherein the analytical information includes one or more of:
investigative information; and
hunting information.
24. The computing system of claim 17 wherein the automation information includes one or more of:
automated information; and
orchestrated information.