Threat mitigation system and method
A computer-implemented method, computer program product and computing system for: establishing connectivity with a plurality of security-relevant subsystems within a computing platform; defining a unified query on a unified platform concerning the plurality of security-relevant subsystems; denormalizing the unified query to define a subsystem-specific query for each of the plurality of security-relevant subsystems, thus defining a plurality of subsystem-specific queries; and providing the plurality of subsystem-specific queries to the plurality of security-relevant subsystems.
1. A computer-implemented method, executed on a computing device, comprising:
establishing connectivity with a plurality of security-relevant subsystems within a computing platform;
defining a unified query on a unified platform concerning the plurality of security-relevant subsystems to search for information on the plurality of security-relevant subsystems;
denormalizing the unified query to define a subsystem-specific query for information for each of the plurality of security-relevant subsystems, thus defining a plurality of subsystem-specific queries configured to be effectuated on a respective plurality of security-relevant subsystems to return a respective plurality of subsystem-specific result sets, including translating a syntax of the unified query to a respective syntax of each of the plurality of subsystem-specific queries; and
providing the plurality of subsystem-specific queries to the plurality of security-relevant subsystems.
2. The computer-implemented method of claim 1 further comprising:
receiving a plurality of subsystem-specific results sets from the plurality of security-relevant subsystems that were generated in response to the plurality of subsystem-specific queries.
3. The computer-implemented method of claim 2 further comprising:
normalizing the plurality of subsystem-specific results sets received from the plurality of security-relevant subsystems to define a unified result set.
4. The computer-implemented method of claim 3 wherein normalizing the plurality of subsystem-specific results sets received from the plurality of security-relevant subsystems to define a unified result set includes:
translating a syntax of each of the plurality of subsystem-specific results sets to a syntax of the unified result set.
5. The computer-implemented method of claim 3 further comprising:
providing the unified result set to a third-party.
6. The computer-implemented method of claim 1 wherein the plurality of security-relevant subsystems includes one or more of:
CDN (i.e., Content Delivery Network) systems;
DAM (i.e., Database Activity Monitoring) systems;
UBA (i.e., User Behavior Analytics) systems;
MDM (i.e., Mobile Device Management) systems;
IAM (i.e., Identity and Access Management) systems;
DNS (i.e., Domain Name Server) systems;
Antivirus systems;
operating systems;
data lakes;
data logs;
security-relevant software applications;
security-relevant hardware systems; and
resources external to the computing platform.
7. The computer-implemented method of claim 1 further comprising:
mapping one or more data fields of the unified platform to one or more data fields of each of the plurality of security-relevant subsystems.
8. The computer-implemented method of claim 7 wherein mapping one or more data fields of the unified platform to one or more data fields of each of the plurality of security-relevant subsystems includes:
mapping one or more data fields within a query structure of the unified platform to one or more data fields within a query structure of each of the plurality of security-relevant subsystems.
9. The computer-implemented method of claim 7 wherein mapping one or more data fields of the unified platform to one or more data fields of each of the plurality of security-relevant subsystems includes:
mapping one or more data fields within a result set structure of each of the plurality of security-relevant subsystems to one or more data fields within a result set structure of the unified platform.
10. The computing system of claim 7 wherein mapping one or more data fields of the unified platform to one or more data fields of each of the plurality of security-relevant subsystems includes:
mapping one or more data fields within a result set structure of each of the plurality of security-relevant subsystems to one or more data fields within a result set structure of the unified platform.
11. A computer program product residing on a computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:
establishing connectivity with a plurality of security-relevant subsystems within a computing platform;
defining a unified query on a unified platform concerning the plurality of security-relevant subsystems to search for information on the plurality of security-relevant subsystems;
denormalizing the unified query to define a subsystem-specific query for information for each of the plurality of security-relevant subsystems, thus defining a plurality of subsystem-specific queries configured to be effectuated on a respective plurality of security-relevant subsystems to return a respective plurality of subsystem-specific result sets, including translating a syntax of the unified query to a respective syntax of each of the plurality of subsystem-specific queries; and
providing the plurality of subsystem-specific queries to the plurality of security-relevant subsystems.
12. The computer program product of claim 11 further comprising:
receiving a plurality of subsystem-specific results sets from the plurality of security-relevant subsystems that were generated in response to the plurality of subsystem-specific queries.
13. The computer program product of claim 12 further comprising:
normalizing the plurality of subsystem-specific results sets received from the plurality of security-relevant subsystems to define a unified result set.
14. The computer program product of claim 13 wherein normalizing the plurality of subsystem-specific results sets received from the plurality of security-relevant subsystems to define a unified result set includes:
translating a syntax of each of the plurality of subsystem-specific results sets to a syntax of the unified result set.
15. The computer program product of claim 13 further comprising:
providing the unified result set to a third-party.
16. The computer program product of claim 11 wherein the plurality of security-relevant subsystems includes one or more of:
CDN (i.e., Content Delivery Network) systems;
DAM (i.e., Database Activity Monitoring) systems;
UBA (i.e., User Behavior Analytics) systems;
MDM (i.e., Mobile Device Management) systems;
IAM (i.e., Identity and Access Management) systems;
DNS (i.e., Domain Name Server) systems;
Antivirus systems;
operating systems;
data lakes;
data logs;
security-relevant software applications;
security-relevant hardware systems; and
resources external to the computing platform.
17. The computer program product of claim 11 further comprising:
mapping one or more data fields of the unified platform to one or more data fields of each of the plurality of security-relevant subsystems.
18. The computer program product of claim 17 wherein mapping one or more data fields of the unified platform to one or more data fields of each of the plurality of security-relevant subsystems includes:
mapping one or more data fields within a query structure of the unified platform to one or more data fields within a query structure of each of the plurality of security-relevant subsystems.
19. The computer program product of claim 17 wherein mapping one or more data fields of the unified platform to one or more data fields of each of the plurality of security-relevant subsystems includes:
mapping one or more data fields within a result set structure of each of the plurality of security-relevant subsystems to one or more data fields within a result set structure of the unified platform.
20. A computing system including a processor and memory configured to perform operations comprising:
establishing connectivity with a plurality of security-relevant subsystems within a computing platform;
defining a unified query on a unified platform concerning the plurality of security-relevant subsystems to search for information on the plurality of security-relevant subsystems;
denormalizing the unified query to define a subsystem-specific query for information for each of the plurality of security-relevant subsystems, thus defining a plurality of subsystem-specific queries configured to be effectuated on a respective plurality of security-relevant subsystems to return a respective plurality of subsystem-specific result sets, including translating a syntax of the unified query to a respective syntax of each of the plurality of subsystem-specific queries; and
providing the plurality of subsystem-specific queries to the plurality of security-relevant subsystems.
21. The computing system of claim 20 further comprising:
receiving a plurality of subsystem-specific results sets from the plurality of security-relevant subsystems that were generated in response to the plurality of subsystem-specific queries.
22. The computing system of claim 21 further comprising:
normalizing the plurality of subsystem-specific results sets received from the plurality of security-relevant subsystems to define a unified result set.
23. The computing system of claim 22 wherein normalizing the plurality of subsystem-specific results sets received from the plurality of security-relevant subsystems to define a unified result set includes:
translating a syntax of each of the plurality of subsystem-specific results sets to a syntax of the unified result set.
24. The computing system of claim 22 further comprising:
providing the unified result set to a third-party.
25. The computing system of claim 20 wherein the plurality of security-relevant subsystems includes one or more of:
CDN (i.e., Content Delivery Network) systems;
DAM (i.e., Database Activity Monitoring) systems;
UBA (i.e., User Behavior Analytics) systems;
MDM (i.e., Mobile Device Management) systems;
IAM (i.e., Identity and Access Management) systems;
DNS (i.e., Domain Name Server) systems;
Antivirus systems;
operating systems;
data lakes;
data logs;
security-relevant software applications;
security-relevant hardware systems; and
resources external to the computing platform.
26. The computing system of claim 20 further comprising:
mapping one or more data fields of the unified platform to one or more data fields of each of the plurality of security-relevant subsystems.
27. The computing system of claim 26 wherein mapping one or more data fields of the unified platform to one or more data fields of each of the plurality of security-relevant subsystems includes:
mapping one or more data fields within a query structure of the unified platform to one or more data fields within a query structure of each of the plurality of security-relevant sub systems.