Threat mitigation system and method
A computer-implemented method, computer program product and computing system for: receiving platform information from a plurality of security-relevant subsystems; processing the platform information to generate processed platform information; identifying more threat-pertinent content included within the processed content; and routing the more threat-pertinent content to a threat analysis engine.
1. A computer-implemented method, executed on a computing device, comprising:
receiving platform information from a plurality of security-relevant subsystems including
distributing at least a portion of a unified query to the plurality of security relevant subsystems;
effectuating at least a portion of the unified query on each of the security-relevant subsystems; and
combining a plurality of results sets from the plurality of security-relevant subsystems;
processing the platform information to generate processed platform information;
identifying more threat-pertinent content included within the processed platform information;
routing the more threat-pertinent content to a threat analysis engine;
detecting, by the threat analysis engine, a security event based upon the processed content;
assigning a threat level to the security event using a probabilistic model, wherein the probabilistic model is one of iteratively and continuously revised; and
executing a remedial action plan based upon, at least in part, the assigned threat level, wherein executing the remedial action plan includes:
determining that the assigned threat level is low, including permitting a suspect activity corresponding to the security event to continue; and
determining that the assigned threat level is high, including executing a threat mitigation plan, the threat mitigation plan including shutting down a stream of content corresponding to the security event and closing a port respective to the computing device.
2. The computer-implemented method of claim 1 wherein processing the platform information to generate processed platform information includes:
parsing the platform information into a plurality of subcomponents to allow for compensation of varying formats and/or nomenclature.
3. The computer-implemented method of claim 1 wherein processing the platform information to generate processed platform information includes:
enriching the platform information by including supplemental information from external information resources.
4. The computer-implemented method of claim 1 wherein processing the platform information to generate processed platform information includes:
utilizing artificial intelligence or machine learning to identify one or more patterns or trends within the platform information.
5. The computer-implemented method of claim 1 wherein the plurality of security-relevant subsystems includes one or more of:
a data lake;
a data log;
a security-relevant software application;
a security-relevant hardware system; and
a resource external to the computing platform.
6. The computer-implemented method of claim 1 wherein identifying more threat-pertinent content included within the processed platform information includes:
processing the processed platform information to identify actionable processed platform information that may be used by the threat analysis engine for correlation purposes.
7. The computer-implemented method of claim 1 wherein the threat analysis engine is a Security Event Information Management (SEIM) system.
8. A computer program product residing on a non-transitory computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:
receiving platform information from a plurality of security-relevant subsystems including
distributing at least a portion of a unified query to the plurality of security relevant subsystems;
effectuating at least a portion of the unified query on each of the security-relevant subsystems; and
combining a plurality of results sets from the plurality of security-relevant subsystems;
processing the platform information to generate processed platform information;
identifying more threat-pertinent content included within the processed platform information;
routing the more threat-pertinent content to a threat analysis engine;
detecting, by the threat analysis engine, a security event based upon the processed content;
assigning a threat level to the security event using a probabilistic model, wherein the probabilistic model is one of iteratively and continuously revised; and
executing a remedial action plan based upon, at least in part, the assigned threat level, wherein executing the remedial action plan includes:
determining that the assigned threat level is low, including permitting a suspect activity corresponding to the security event to continue; and
determining that the assigned threat level is high, including executing a threat mitigation plan, the threat mitigation plan including shutting down a stream of content corresponding to the security event and closing a port respective to the computing device.
9. The computer program product of claim 8 wherein processing the platform information to generate processed platform information includes:
parsing the platform information into a plurality of subcomponents to allow for compensation of varying formats and/or nomenclature.
10. The computer program product of claim 8 wherein processing the platform information to generate processed platform information includes:
enriching the platform information by including supplemental information from external information resources.
11. The computer program product of claim 8 wherein processing the platform information to generate processed platform information includes:
utilizing artificial intelligence or machine learning to identify one or more patterns or trends within the platform information.
12. The computer program product of claim 8 wherein the plurality of security-relevant subsystems includes one or more of:
a data lake;
a data log;
a security-relevant software application;
a security-relevant hardware system; and
a resource external to the computing platform.
13. The computer program product of claim 8 wherein identifying more threat-pertinent content included within the processed platform information includes:
processing the processed platform information to identify actionable processed platform information that may be used by the threat analysis engine for correlation purposes.
14. The computer program product of claim 8 wherein the threat analysis engine is a Security Event Information Management (SEIM) system.
15. A computing system including a processor and memory configured to perform operations comprising:
receiving platform information from a plurality of security-relevant subsystems including
distributing at least a portion of a unified query to the plurality of security relevant subsystems;
effectuating at least a portion of the unified query on each of the security-relevant subsystems; and
combining a plurality of results sets from the plurality of security-relevant subsystems;
processing the platform information to generate processed platform information;
identifying more threat-pertinent content included within the processed platform information;
routing the more threat-pertinent content to a threat analysis engine;
detecting, by the threat analysis engine, a security event based upon the processed content;
assigning a threat level to the security event using a probabilistic model, wherein the probabilistic model is one of iteratively and continuously revised; and
executing a remedial action plan based upon, at least in part, the assigned threat level, wherein executing the remedial action plan includes:
determining that the assigned threat level is low, including permitting a suspect activity corresponding to the security event to continue; and
determining that the assigned threat level is high, including executing a threat mitigation plan, the threat mitigation plan including shutting down a stream of content corresponding to the security event and closing a port respective to the computing device.
16. The computing system of claim 15 wherein processing the platform information to generate processed platform information includes:
parsing the platform information into a plurality of subcomponents to allow for compensation of varying formats and/or nomenclature.
17. The computing system of claim 15 wherein processing the platform information to generate processed platform information includes:
enriching the platform information by including supplemental information from external information resources.
18. The computing system of claim 15 wherein processing the platform information to generate processed platform information includes:
utilizing artificial intelligence or machine learning to identify one or more patterns or trends within the platform information.
19. The computing system of claim 15 wherein the plurality of security-relevant subsystems includes one or more of:
a data lake;
a data log;
a security-relevant software application;
a security-relevant hardware system; and
a resource external to the computing platform.
20. The computing system of claim 15 wherein identifying more threat-pertinent content included within the processed platform information includes:
processing the processed platform information to identify actionable processed platform information that may be used by the threat analysis engine for correlation purposes.
21. The computing system of claim 15 wherein the threat analysis engine is a Security Event Information Management (SEIM) system.