Selecting actions responsive to computing environment incidents based on severity rating
Systems, methods, and software described herein provide enhancements for implementing security actions in a computing environment. In one example, a method of operating an advisement system to provide actions in a computing environment includes identifying a security incident in the computing environment, identifying a criticality rating for the asset, and obtaining enrichment information for the security incident from one or more internal or external sources. The method also provides identifying a severity rating for the security incident based on the enrichment information, and determining one or more security actions based on the enrichment information. The method further includes identifying effects of the one or more security actions on operations of the computing environment based on the criticality rating and the severity rating, and identifying a subset of the one or more security actions to respond to the security incident based on the effects.
1. A computer-implemented method, comprising:
receiving data indicating an occurrence of a security incident involving a computing asset of a computing environment;
identifying properties associated with the security incident;
obtaining, using the properties, enrichment information associated with the security incident from one or more internal or external sources;
determining, based on the enrichment information, a severity rating for the security incident and a confidence level of whether the security incident involves a security threat;
determining, based on at least the enrichment information, the severity rating, and the confidence level, one or more actions to respond to the security incident; and
initiating implementation, in the computing environment, of at least one action from the one or more actions.
2. The method of claim 1 , further comprising:
obtaining further enrichment information associated with the security incident from the one or more internal or external sources;
determining, based on the further enrichment information, a further confidence level of whether the security incident involves a security threat; and
determining, based on at least the further enrichment information, one or more further actions to respond to the security incident.
3. The method of claim 1 , wherein the severity rating indicates how dangerous or malicious a threat is to the computing environment.
4. The method of claim 1 , wherein the severity rating is provided in the enrichment information.
5. The method of claim 1 , wherein the severity rating comprises a numerical identifier or a letter grade.
6. The method of claim 1 , further comprising determining, based on at least the enrichment information, a criticality rating associated with the computing asset, wherein determining the one or more actions to respond to the security incident is further based on the criticality rating.
7. The method of claim 6 , wherein the criticality rating indicates an importance of the computing asset to operation of the computing environment.
8. An apparatus, comprising:
one or more non-transitory computer-readable storage media;
a processing system operatively coupled to the one or more non-transitory computer-readable storage media; and
processing instructions stored on the one or more non-transitory computer-readable storage media that, when executed by the processing system, direct the processing system to:
receive data indicating an occurrence of a security incident involving a computing asset of a computing environment;
identify properties associated with the security incident;
obtain, using the properties, enrichment information associated with the security incident from one or more internal or external sources;
determine, based on the enrichment information, a severity rating for the security incident and a confidence level of whether the security incident involves a security threat;
determine, based on at least the enrichment information, the severity rating, and the confidence level, one or more actions to respond to the security incident; and
initiate implementation, in the computing environment, of at least one action from the one or more actions.
9. The apparatus of claim 8 , comprising further processing instructions stored on the one or more non-transitory computer-readable storage media that, when executed by the processing system, further direct the processing system to:
obtain further enrichment information associated with the security incident from the one or more internal or external sources;
determine, based on the further enrichment information, a further confidence level of whether the security incident involves a security threat; and
determine, based on at least the further enrichment information, one or more further actions to respond to the security incident.
10. The apparatus of claim 8 , wherein the severity rating indicates how dangerous or malicious a threat is to the computing environment.
11. The apparatus of claim 8 , wherein the severity rating is provided in the enrichment information.
12. The apparatus of claim 8 , wherein the severity rating comprises a numerical identifier or a letter grade.
13. The apparatus of claim 8 , comprising further processing instructions stored on the one or more non-transitory computer-readable storage media that, when executed by the processing system, further direct the processing system to determine, based on at least the enrichment information, a criticality rating associated with the computing asset, wherein determining the one or more actions to respond to the security incident is further based on the criticality rating.
14. The apparatus of claim 13 , wherein the criticality rating indicates an importance of the computing asset to operation of the computing environment.
15. A non-transitory computer-readable storage medium storing instructions that, when executed by one or more processors, cause performance of operations comprising:
receiving data indicating an occurrence of a security incident involving a computing asset of a computing environment;
identifying properties associated with the security incident;
obtaining, using the properties, enrichment information associated with the security incident from one or more internal or external sources;
determining, based on the enrichment information, a severity rating for the security incident and a confidence level of whether the security incident involves a security threat;
determining, based on at least the enrichment information, the severity rating, and the confidence level, one or more actions to respond to the security incident; and
initiating implementation, in the computing environment, of at least one action from the one or more actions.
16. The non-transitory computer-readable storage medium of claim 15 , further comprising:
obtaining further enrichment information associated with the security incident from the one or more internal or external sources;
determining, based on the further enrichment information, a further confidence level of whether the security incident involves a security threat; and
determining, based on at least the further enrichment information, one or more further actions to respond to the security incident.
17. The non-transitory computer-readable storage medium of claim 15 , wherein the severity rating indicates how dangerous or malicious a threat is to the computing environment.
18. The non-transitory computer-readable storage medium of claim 15 , wherein the severity rating is provided in the enrichment information.
19. The non-transitory computer-readable storage medium of claim 15 , wherein the severity rating comprises a numerical identifier or a letter grade.
20. The non-transitory computer-readable storage medium of claim 15 , storing further instructions that, when executed by one or more processors, cause performance of further operations comprising determining, based on at least the enrichment information, a criticality rating associated with the computing asset, the criticality rating indicating an importance of the computing asset to operation of the computing environment, wherein determining the one or more actions to respond to the security incident is further based on the criticality rating.