Systems and methods of information security monitoring with third-party indicators of compromise
An information security monitoring system can import indicators of compromise (IOC) definitions in disparate formats from third-party source systems, convert them into editable security definitions in an internal system format, and provide a user interface for composing or editing these security definitions with enhancements, including complex security definitions such as those having a nested Boolean structure and/or those that reference one or more security definitions, a behavioral rule, and/or a vulnerability description. One or more whitelists can be added to handle exceptions. Each composed or modified security definition is then compiled into an executable rule. The executable rule, when evaluated, produces a result indicative of an endpoint security action needed in view of an endpoint event that meets the composed or modified security definition.
1. A method for endpoint security monitoring, comprising:
importing, by an information security monitoring system in an enterprise network, security definitions in disparate formats from a plurality of source systems, the plurality of source systems operating external to and independently of the information security monitoring system, the security definitions including at least one of an atomic indicator of compromise (IOC) definition or a complex IOC definition, wherein the complex IOC definition comprises a nested Boolean structure or references another IOC definition, a behavior rule, or a vulnerability description;
converting, by the information security monitoring system, the security definitions in the disparate formats into editable security definitions in a system format internal to the information security monitoring system;
providing, by the information security monitoring system, a user interface and the editable security definitions in the system format to a user device, the user interface adapted for composing, modifying, or enhancing the editable security definitions in the system format;
receiving or retrieving, by the information security monitoring system from the user device, a composed or modified security definition in the system format, wherein the composed or modified security definition in the system format preserves the nested Boolean structure or the reference to another IOC definition, to the behavioral rule, or to the vulnerability description; and
compiling, by the information security monitoring system, the composed or modified security definition in the system format into an executable rule, wherein the executable rule is executable by the information security monitoring system or an endpoint of the enterprise network to produce a result indicative of an endpoint security action needed in view of an endpoint event that meets the composed or modified security definition.
2. The method according to claim 1 , wherein the endpoint security action comprises collecting a file, killing a process, deleting a file, or uploading a file to a sandbox.
3. The method according to claim 1 , further comprising:
communicating the executable rule to an agent or sensor running on an endpoint of the enterprise network, wherein the agent or sensor sends a notification to the information security monitoring system in response to the endpoint having telemetry meeting the executable rule, and wherein, in response to the notification, the information security monitoring system retrieves the telemetry from the endpoint.
4. The method according to claim 1 , wherein the converting includes:
parsing the security definitions in the disparate formats from the plurality of source systems to extract metadata fields and operators; and
mapping the metadata fields to metadata fields of the editable security definitions in the system format in accordance with a master metadata schema.
5. The method according to claim 1 , wherein the security definitions in the disparate formats comprise at least two of an endpoint behavioral rule in a JavaScript Object Notation (JSON) format, an IOC definition in the JSON format, an IOC definition in an eXtensible Markup Language (XML) format, an IOC definition in a language and serialization format, a rule consisting of sets of strings and a Boolean expression, or a vulnerability description in the XML format.
6. The method according to claim 1 , further comprising:
prior to the compiling, adding a whitelist to the composed or modified security definition in the system format; or
storing the executable rule in a database on the enterprise network.
7. The method according to claim 1 , wherein the system format comprises JavaScript Object Notation.
8. A system for information security monitoring, comprising:
a processor;
a non-transitory computer-readable medium; and
stored instructions translatable by the processor for:
importing security definitions in disparate formats from a plurality of source systems, the plurality of source systems operating external to and independently of the system, the security definitions including at least one of an atomic indicator of compromise (IOC) definition or a complex IOC definition, wherein the complex IOC definition comprises a nested Boolean structure or references another IOC definition, a behavior rule, or a vulnerability description;
converting the security definitions in the disparate formats into editable security definitions in a system format internal to the system;
providing a user interface and the editable security definitions in the system format to a user device, the user interface adapted for composing, modifying, or enhancing the editable security definitions in the system format;
receiving or retrieving, from the user device, a composed or modified security definition in the system format, wherein the composed or modified security definition in the system format preserves the nested Boolean structure or the reference to another IOC definition, to the behavioral rule, or to the vulnerability description; and
compiling the composed or modified security definition in the system format into an executable rule, wherein the executable rule is executable by the system or an endpoint of an enterprise network to produce a result indicative of an endpoint security action needed in view of an endpoint event that meets the composed or modified security definition.
9. The system of claim 8 , wherein the endpoint security action comprises collecting a file, killing a process, deleting a file, or uploading a file to a sandbox.
10. The system of claim 8 , wherein the stored instructions are further translatable by the processor for:
communicating the executable rule to an agent or sensor running on an endpoint of the enterprise network, wherein the agent or sensor sends a notification to the system in response to the endpoint having telemetry meeting the executable rule, and wherein, in response to the notification, the system retrieves the telemetry from the endpoint.
11. The system of claim 8 , wherein the converting includes:
parsing the security definitions in the disparate formats from the plurality of source systems to extract metadata fields and operators; and
mapping the metadata fields to metadata fields of the editable security definitions in the system format in accordance with a master metadata schema.
12. The system of claim 8 , wherein the security definitions in the disparate formats comprise at least two of an endpoint behavioral rule in a JavaScript Object Notation (JSON) format, an IOC definition in the JSON format, an IOC definition in an eXtensible Markup Language (XML) format, an IOC definition in a language and serialization format, a rule consisting of sets of strings and a Boolean expression, or a vulnerability description in the XML format.
13. The system of claim 8 , wherein the stored instructions are further translatable by the processor for:
prior to the compiling, adding a whitelist to the composed or modified security definition in the system format; or
storing the executable rule in a database on the enterprise network.
14. The system of claim 8 , wherein the system format comprises JavaScript Object Notation.
15. A computer program product comprising a non-transitory computer-readable medium storing instructions translatable by a processor of an information security monitoring system for:
importing security definitions in disparate formats from a plurality of source systems, the plurality of source systems operating external to and independently of the information security monitoring system, the security definitions including at least one of an atomic indicator of compromise (IOC) definition or a complex IOC definition, wherein the complex IOC definition comprises a nested Boolean structure or references another IOC definition, a behavior rule, or a vulnerability description;
converting the security definitions in the disparate formats into editable security definitions in a system format internal to the information security monitoring system;
providing a user interface and the editable security definitions in the system format to a user device, the user interface adapted for composing, modifying, or enhancing the editable security definitions in the system format;
receiving or retrieving, from the user device, a composed or modified security definition in the system format, wherein the composed or modified security definition in the system format preserves the nested Boolean structure or the reference to another IOC definition, to the behavioral rule, or to the vulnerability description; and
compiling the composed or modified security definition in the system format into an executable rule, wherein the executable rule is executable by the system or an endpoint of an enterprise network to produce a result indicative of an endpoint security action needed in view of an endpoint event that meets the composed or modified security definition.
16. The computer program product of claim 15 , wherein the endpoint security action comprises collecting a file, killing a process, deleting a file, or uploading a file to a sandbox.
17. The computer program product of claim 15 , wherein the instructions are further translatable by the processor of the information security monitoring system for:
communicating the executable rule to an agent or sensor running on an endpoint of the enterprise network, wherein the agent or sensor sends a notification to the information security monitoring system in response to the endpoint having telemetry meeting the executable rule, and wherein, in response to the notification, the information security monitoring system retrieves the telemetry from the endpoint.
18. The computer program product of claim 15 , wherein the converting includes:
parsing the security definitions in the disparate formats from the plurality of source systems to extract metadata fields and operators; and
mapping the metadata fields to metadata fields of the editable security definitions in the system format in accordance with a master metadata schema.
19. The computer program product of claim 18 , wherein the security definitions in the disparate formats comprise at least two of an endpoint behavioral rule in a JavaScript Object Notation (JSON) format, an IOC definition in the JSON format, an IOC definition in an eXtensible Markup Language (XML) format, an 10 C definition in a language and serialization format, a rule consisting of sets of strings and a Boolean expression, or a vulnerability description in the XML format.
20. The computer program product of claim 18 , wherein the instructions are further translatable by the processor of the information security monitoring system for:
prior to the compiling, adding a whitelist to the composed or modified security definition in the system format; or
storing the executable rule in a database on the enterprise network.