Systems and methods for security monitoring processing

1. A computer implemented method for security event monitoring, the method comprising:

receiving, by one or more processors, data from one or more modules of a first operating system, wherein the data from the one or more modules includes data from both trusted sources and untrusted sources;

defining, by the one or more processors, an audit classes data filter for collection by a security event monitoring application, wherein the audit classes data filter includes data only from trusted sources;

receiving, by the one or more processors, a verbosity level of the audit classes data filter;

filtering, by the one or more processors, the data from the trusted sources based on the verbosity level of the audit classes data filter, resulting in a trusted stream of data;

comparing, by the one or more processors, the trusted stream of data with the data from the untrusted sources;

creating a validated data set by comparing field data from the trusted stream of data with the data from the untrusted sources, wherein a first subset of data from the untrusted sources is excluded from the validated data set when the first subset does not include any of the field data from the trusted stream of data;

comparing, by the one or more processors, the validated data set with a set of blacklisted values;

dropping, by the one or more processors, any value from the validated data set that matches one or more blacklisted values from the set of blacklisted values, based on the comparison of the validated data set with the set of blacklisted values, resulting in a new data set;

parsing, by the processor, the new data set into a common structured format; and

outputting, by the one or more processors, the new data set that is in the common structured format.

2. The computer implemented method of claim 1 , wherein the common structured format is at least one of JSON, csv, or xml.

3. The computer implemented method of claim 1 , further including receiving, by the one or more processors, a preference file change for a first computing device executing the first operating system; and

performing, by the one or more processors, a response action by the security event monitoring application based on the preference file change.

4. The computer implemented method of claim 1 , wherein the field data includes one or more of process id, auditToken, session ID, file or process path, audit user, effective user, unix socket, unix file descriptors, signing ID, or timestamp.

5. The computer implemented method of claim 4 , wherein the trusted stream of data includes one or more of BSM records, network interface logs, firewall logs, user security and privacy permission changes, application usage information from the first operating system, network interface configuration and attributes data, device location data from the first operating system, file modification events, configuration change events, unix socket notifications, or first operating system logs.

6. The computer implemented method of claim 5 , wherein, upon determining that a second subset of data from the untrusted sources contains field data from the trusted stream of data, increasing a trust level of the second subset.

7. A non-transitory computer-readable medium for security event monitoring, the non-transitory computer-readable medium storing instructions that, when executed by one or more processors, configure the one or more processors to perform:

receiving, by the one or more processors, data from a first operating system, wherein the data from the first operating system includes data from both trusted sources and untrusted sources;

defining, by the one or more processors, an audit classes data filter for collection by a security event monitoring application, wherein the audit classes data filter includes data only from trusted sources;

filtering, by the one or more processors, the data from the trusted sources based on a verbosity level of the audit classes data filter, resulting in a trusted stream of data;

comparing, by the one or more processors, the trusted stream of data with the data from the untrusted sources;

dropping, by the one or more processors, data from certain untrusted sources upon determining that the trusted stream of data does not verify the data from the certain untrusted sources, when there is no field, associated with the data from the certain untrusted sources, that confirms the data from the certain untrusted sources with the trusted stream of data, resulting in a validated data set excluding the data from the certain untrusted sources;

comparing, by the one or more processors, the validated data set with a set of blacklisted values;

dropping, by the one or more processors, any value from the validated data set that matches one or more blacklisted values from the set of blacklisted values, based on the comparison of the validated data set with the set of blacklisted values, resulting in a new data set;

parsing, by the processor, the new data set into a common structured format; and

outputting, by the one or more processors, the new data set that is in the common structured format.

8. The non-transitory computer-readable medium of claim 7 , wherein the common structured format is at least one of JSON, csv, or xml.

9. The non-transitory computer-readable medium of claim 7 , further including receiving, by the one or more processors, the verbosity level of the audit classes data filter, wherein the verbosity level defines an amount of audit classes data collected.

10. The non-transitory computer-readable medium of claim 9 , further including receiving, by the one or more processors, a preference file change for a first computing device executing the first operating system; and

performing, by the one or more processors, a response action by the security event monitoring application based on the preference file change.

11. The non-transitory computer-readable medium of claim 7 , wherein the field, associated with the data from the certain untrusted sources, that confirms the data from the certain untrusted sources with the trusted stream of data, includes one or more of process id, auditToken, session ID, file or process path, audit user, effective user, unix socket, unix file descriptors, signing ID, or timestamp.

12. The non-transitory computer-readable medium of claim 11 , wherein the trusted stream of data includes one or more of BSM records, network interface logs, firewall logs, user security and privacy permission changes, application usage information from the first operating system, network interface configuration and attributes data, device location data from the first operating system, file modification events, configuration change events, unix socket notifications, or first operating system logs.

13. The non-transitory computer-readable medium of claim 12 , wherein, upon determining that the trusted stream of data does verify certain data from the certain untrusted sources, when there is a field, associated with the data from the certain untrusted sources, that confirms the data from the certain untrusted sources with the trusted stream of data, increasing a trust level of the verified certain data.

14. A computer implemented method for security event monitoring, the method comprising:

receiving, by one or more processors, data from a first operating system, wherein the data from the first operating system includes data from both trusted sources and untrusted sources;

filtering, by the one or more processors, the data from the trusted sources based on a verbosity level of an audit classes data filter, resulting in a trusted stream of data;

comparing, by the one or more processors the trusted stream of data with the data from the untrusted sources;

dropping, by the one or more processors, data from certain untrusted sources upon determining that the trusted stream of data does not verify the data from the certain untrusted sources, when there is no field, associated with the data from the certain untrusted sources, that confirms the data from the certain untrusted sources with the trusted stream of data, resulting in a validated data set excluding the data from the certain untrusted sources;

parsing, by the processor, the validated data set into a common structured format; and

outputting, by the one or more processors, the validated data set that is in the common structured format.

15. The computer implemented method of claim 14 , wherein the common structured format is at least one of JSON, csv, or xml.

16. The computer implemented method of claim 14 , wherein the field, associated with the data from the certain untrusted sources, that confirms the data from the certain untrusted sources with the trusted stream of data, includes one or more of process id, auditToken, session ID, file or process path, audit user, effective user, unix socket, unix file descriptors, signing ID, or timestamp.