Threat mitigation system and method

1. A computer-implemented method, executed on a computing device, comprising:

generating, via a Security Information and Event Management system, system-defined consolidated platform information from a plurality of security-relevant subsystems within a computing platform, the plurality of security-relevant subsystems including one or more of Content Delivery Network systems, Database Activity Monitoring systems, User Behavior Analytic systems, Mobile Device Management systems, Identity and Access Management systems, and Domain Name Server systems;

obtaining one or more artifacts concerning a detected security event from a plurality of sources, wherein the plurality of sources are associated with the computing platform and maintained by the Security Information and Event Management system, wherein the plurality of sources includes at least one of one or more log files defined for the computing platform and two or more security-relevant subsystems from the plurality of security-relevant subsystems deployed within the computing platform;

obtaining artifact information concerning the one or more artifacts from the plurality of sources associated with the computing platform;

assigning a threat level to the detected security event based, at least in part, upon the one or more artifacts;

generating a conclusion concerning the detected security event based, at least in part, upon the detected security event, the one or more artifacts, and the artifact information;

executing a remedial action plan based upon, at least in part, the assigned threat level, wherein executing the remedial action plan includes:

determining that the assigned threat level is low, including permitting a suspect activity corresponding to the security event to continue;

determining that the assigned threat level is moderate, including generating a security event report based, at least in part, upon the one or more artifacts respective to the security event, and providing the security event report to a third party for review; and

determining that the assigned threat level is high, including executing a threat mitigation plan, the threat mitigation plan including shutting down a stream of content corresponding to the security event and closing a port respective to the computing device; and

allowing the third party to manually search through the one or more artifacts within the computing platform.

2. The computer-implemented method of claim 1 further comprising:

documenting the conclusion.

3. The computer-implemented method of claim 1 further comprising:

reporting the conclusion to a third-party.

4. The computer-implemented method of claim 1 further comprising:

obtaining supplemental artifacts and artifact information when needed.

5. The computer-implemented method of claim 1 wherein obtaining artifact information concerning the one or more artifacts includes:

obtaining artifact information concerning the one or more artifacts from one or more investigation resources.

6. The computer-implemented method of claim 1 wherein the detected security event includes one or more of: access auditing; anomalies; authentication; denial of services; exploitation; malware; phishing; spamming; reconnaissance; and web attack.

7. A computer program product residing on a non-transitory computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:

generating, via a Security Information and Event Management system, system-defined consolidated platform information from a plurality of security-relevant subsystems within a computing platform, the plurality of security-relevant subsystems including one or more of Content Delivery Network systems, Database Activity Monitoring systems, User Behavior Analytic systems, Mobile Device Management systems, Identity and Access Management systems, and Domain Name Server systems;

obtaining one or more artifacts concerning a detected security event from a plurality of sources, wherein the plurality of sources are associated with the computing platform and maintained by the Security Information and Event Management system, wherein the plurality of sources includes at least one of one or more log files defined for the computing platform and two or more security-relevant subsystems from the plurality of security-relevant subsystems deployed within the computing platform;

obtaining artifact information concerning the one or more artifacts from the plurality of sources associated with the computing platform;

assigning a threat level to the detected security event based, at least in part, upon the one or more artifacts;

generating a conclusion concerning the detected security event based, at least in part, upon the detected security event, the one or more artifacts, and the artifact information;

executing a remedial action plan based upon, at least in part, the assigned threat level, wherein executing the remedial action plan includes:

determining that the assigned threat level is low, including permitting a suspect activity corresponding to the security event to continue;

determining that the assigned threat level is moderate, including generating a security event report based, at least in part, upon the one or more artifacts respective to the security event, and providing the security event report to a third party for review; and

determining that the assigned threat level is high, including executing a threat mitigation plan, the threat mitigation plan including shutting down a stream of content corresponding to the security event and closing a port respective to the computing device; and

allowing the third party to manually search through the one or more artifacts within the computing platform.

8. The computer program product of claim 7 further comprising:

documenting the conclusion.

9. The computer program product of claim 7 further comprising:

reporting the conclusion to a third-party.

10. The computer program product of claim 7 further comprising:

obtaining supplemental artifacts and artifact information when needed.

11. The computer program product of claim 7 wherein obtaining artifact information concerning the one or more artifacts includes:

obtaining artifact information concerning the one or more artifacts from one or more investigation resources.

12. The computer program product of claim 7 wherein the detected security event includes one or more of: access auditing; anomalies; authentication; denial of services; exploitation; malware; phishing; spamming; reconnaissance; and web attack.

13. A computing system including a processor and memory configured to perform operations comprising:

generating, via a Security Information and Event Management system, system-defined consolidated platform information from a plurality of security-relevant subsystems within a computing platform, the plurality of security-relevant subsystems including one or more of Content Delivery Network systems, Database Activity Monitoring systems, User Behavior Analytic systems, Mobile Device Management systems, Identity and Access Management systems, and Domain Name Server systems;

obtaining one or more artifacts concerning a detected security event from a plurality of sources, wherein the plurality of sources are associated with the computing platform and maintained by the Security Information and Event Management system, wherein the plurality of sources includes at least one of one or more log files defined for the computing platform and two or more security-relevant subsystems from the plurality of security-relevant subsystems deployed within the computing platform;

obtaining artifact information concerning the one or more artifacts from the plurality of sources associated with the computing platform;

assigning a threat level to the detected security event based, at least in part, upon the one or more artifacts;

generating a conclusion concerning the detected security event based, at least in part, upon the detected security event, the one or more artifacts, and the artifact information;

executing a remedial action plan based upon, at least in part, the assigned threat level, wherein executing the remedial action plan includes:

determining that the assigned threat level is low, including permitting a suspect activity corresponding to the security event to continue;

determining that the assigned threat level is moderate, including generating a security event report based, at least in part, upon the one or more artifacts respective to the security event, and providing the security event report to a third party for review; and

determining that the assigned threat level is high, including executing a threat mitigation plan, the threat mitigation plan including shutting down a stream of content corresponding to the security event and closing a port respective to the computing device; and

allowing the third party to manually search through the one or more artifacts within the computing platform.

14. The computing system of claim 13 further comprising:

documenting the conclusion.

15. The computing system of claim 13 further comprising:

reporting the conclusion to a third-party.

16. The computing system of claim 13 further comprising:

obtaining supplemental artifacts and artifact information when needed.

17. The computing system of claim 13 wherein obtaining artifact information concerning the one or more artifacts includes:

obtaining artifact information concerning the one or more artifacts from one or more investigation resources.

18. The computing system of claim 13 wherein the detected security event includes one or more of: access auditing; anomalies; authentication; denial of services; exploitation; malware; phishing; spamming; reconnaissance; and web attack.

19. A computer-implemented method, executed on a computing device, comprising:

generating, via a Security Information and Event Management system, system-defined consolidated platform information from a plurality of security-relevant subsystems within a computing platform, the plurality of security-relevant subsystems including one or more of Content Delivery Network systems, Database Activity Monitoring systems, User Behavior Analytic systems, Mobile Device Management systems, Identity and Access Management systems, and Domain Name Server systems;

obtaining one or more artifacts concerning a detected security event from a plurality of sources, the plurality of sources being associated with the computing platform and maintained by the Security Information and Event Management system, wherein the plurality of sources includes at least one of one or more log files defined for the computing platform and two or more security-relevant subsystems from the plurality of security-relevant subsystems deployed within the computing platform;

obtaining artifact information concerning the one or more artifacts from the plurality of sources associated with the computing platform;

assigning a threat level to the detected security event based, at least in part, upon the one or more artifacts;

generating a conclusion concerning the detected security event based, at least in part, upon the detected security event, the one or more artifacts, and the artifact information;

executing a remedial action plan based upon, at least in part, the assigned threat level, wherein executing the remedial action plan includes:

determining that the assigned threat level is low, including permitting a suspect activity corresponding to the security event to continue;

determining that the assigned threat level is moderate, including generating a security event report based, at least in part, upon the one or more artifacts respective to the security event, and providing the security event report to a third party for review; and

determining that the assigned threat level is high, including executing a threat mitigation plan, the threat mitigation plan including shutting down a stream of content corresponding to the security event and closing a port respective to the computing device; and

allowing the third party to manually search through the one or more artifacts within the computing platform.

20. The computer-implemented method of claim 19 further comprising:

documenting the conclusion.

21. The computer-implemented method of claim 19 further comprising:

reporting the conclusion to a third-party.

22. The computer-implemented method of claim 19 further comprising:

obtaining supplemental artifacts and artifact information when needed.

23. The computer-implemented method of claim 19 wherein obtaining artifact information concerning the one or more artifacts includes:

obtaining artifact information concerning the one or more artifacts from one or more investigation resources.

24. The computer-implemented method of claim 19 wherein the detected security event includes one or more of: access auditing; anomalies; authentication; denial of services; exploitation; malware; phishing; spamming; reconnaissance; and web attack.