Using content stored in an entity behavior catalog in combination with an entity risk score
A system, method, and computer-readable medium are disclosed for performing a security operation. The security operation includes monitoring a plurality of electronically-observable actions of an entity, the plurality of electronically-observable actions of the entity corresponding to a respective plurality of events enacted by the entity, the monitoring comprising monitoring the plurality of electronically-observable actions via a protected endpoint; converting the plurality of electronically-observable actions of the entity to electronic information representing the plurality of actions of the entity; generating a representation of occurrences of a particular event from the plurality of events enacted by the entity; and performing an anomaly detection operation based upon the representation of occurrences of the particular event from the plurality of events enacted by the entity, the anomaly detection operation determining when the representation of occurrences of the particular event exceeds a predetermined threshold.
1. A computer-implementable method for performing a security operation, comprising:
monitoring a plurality of electronically-observable actions of an entity, the plurality of electronically-observable actions of the entity corresponding to a respective plurality of events enacted by the entity;
identifying a security related activity of the entity from the plurality of events enacted by the entity, the security related activity being of analytic utility;
generating an event severity risk score based upon the security related activity of the entity;
generating an entity risk severity score for the entity, the generating using the event risk severity score;
accessing an entity behavior catalog based upon the security related activity, the entity behavior catalog providing an inventory of entity behaviors; and,
performing the security operation via a security analytics system, the security operation using the entity risk severity score entity and the behavior catalog data stored within the entity behavior catalog based upon the security related activity, the security analytics system executing on a hardware processor.
2. The method of claim 1 , wherein:
the event risk severity score comprises an initial event risk severity score, the initial event risk severity score comprising an initial event risk severity score value; and,
the initial event risk severity score value is modified to provide a current event risk severity score by application of a reduction function to the initial event risk severity score value.
3. The method of claim 2 , wherein:
the reduction function comprises at least one of a flat reduction function, a gradual reduction function, a flat then gradual reduction function and a step reduction function.
4. The method of claim 2 , wherein:
the reduction function comprises an associated longevity interval, the risk reduction function being applied to the initial event risk severity score for the associated longevity interval.
5. The method of claim 2 , wherein:
the initial event security risk score value is modified to provide a current event risk severity score by application of a plurality of reduction functions to the initial event security risk score value.
6. The method of claim 5 , wherein:
the plurality of events enacted by the entity comprise a plurality of anomalous events;
each of the plurality of reduction functions is applied to a respective anomalous event of the plurality of anomalous events to provide a plurality of event risk severity scores; and,
the entity risk severity score is generated using the plurality of event risk severity scores, the entity risk severity score represents a risk associated with the plurality of anomalous events.
7. A system comprising:
a processor;
a data bus coupled to the processor; and
a non-transitory, computer-readable storage medium embodying computer program code for performing a security operation, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
monitoring a plurality of electronically-observable actions of an entity, the plurality of electronically-observable actions of the entity corresponding to a respective plurality of events enacted by the entity;
identifying a security related activity of the entity from the plurality of events enacted by the entity, the security related activity being of analytic utility;
generating an event severity risk score based upon the security related activity of the entity;
generating an entity risk severity score for the entity, the generating using the event risk severity score;
accessing an entity behavior catalog based upon the security related activity, the entity behavior catalog providing an inventory of entity behaviors; and,
performing the security operation via a security analytics system, the security operation using the entity risk severity score entity and the behavior catalog data stored within the entity behavior catalog based upon the security related activity, the security analytics system executing on a hardware processor.
8. The system of claim 7 , wherein:
the event risk severity score comprises an initial event risk severity score, the initial event risk severity score comprising an initial event risk severity score value; and,
the initial event risk severity score value is modified to provide a current event risk severity score by application of a reduction function to the initial event risk severity score value.
9. The system of claim 8 , wherein:
the reduction function comprises at least one of a flat reduction function, a gradual reduction function, a flat then gradual reduction function and a step reduction function.
10. The system of claim 8 , wherein:
the reduction function comprises an associated longevity interval, the risk reduction function being applied to the initial event risk severity score for the associated longevity interval.
11. The system of claim 8 , wherein:
the initial event security risk score value is modified to provide a current event risk severity score by application of a plurality of reduction functions to the initial event security risk score value.
12. The system of claim 11 , wherein:
the plurality of events enacted by the entity comprise a plurality of anomalous events;
each of the plurality of reduction functions is applied to a respective anomalous event of the plurality of anomalous events to provide a plurality of event risk severity scores; and,
the entity risk severity score is generated using the plurality of event risk severity scores, the entity risk severity score represents a risk associated with the plurality of anomalous events.
13. A non-transitory, computer-readable storage medium embodying computer program code for performing a security operation, the computer program code comprising computer executable instructions configured for:
monitoring a plurality of electronically-observable actions of an entity, the plurality of electronically-observable actions of the entity corresponding to a respective plurality of events enacted by the entity;
identifying a security related activity of the entity from the plurality of events enacted by the entity, the security related activity being of analytic utility;
generating an event severity risk score based upon the security related activity of the entity;
generating an entity risk severity score for the entity, the generating using the event risk severity score;
accessing an entity behavior catalog based upon the security related activity, the entity behavior catalog providing an inventory of entity behaviors; and,
performing the security operation via a security analytics system, the security operation using the entity risk severity score entity and the behavior catalog data stored within the entity behavior catalog based upon the security related activity, the security analytics system executing on a hardware processor.
14. The non-transitory, computer-readable storage medium of claim 13 , wherein:
the event risk severity score comprises an initial event risk severity score, the initial event risk severity score comprising an initial event risk severity score value; and,
the initial event risk severity score value is modified to provide a current event risk severity score by application of a reduction function to the initial event risk severity score value.
15. The non-transitory, computer-readable storage medium of claim 14 , wherein:
the reduction function comprises at least one of a flat reduction function, a gradual reduction function, a flat then gradual reduction function and a step reduction function.
16. The non-transitory, computer-readable storage medium of claim 14 , wherein:
the reduction function comprises an associated longevity interval, the risk reduction function being applied to the initial event risk severity score for the associated longevity interval.
17. The non-transitory, computer-readable storage medium of claim 14 , wherein:
the initial event security risk score value is modified to provide a current event risk severity score by application of a plurality of reduction functions to the initial event security risk score value.
18. The non-transitory, computer-readable storage medium of claim 13 , wherein the computer executable instructions are further configured for:
the plurality of events enacted by the entity comprise a plurality of anomalous events;
each of the plurality of reduction functions is applied to a respective anomalous event of the plurality of anomalous events to provide a plurality of event risk severity scores; and,
the entity risk severity score is generated using the plurality of event risk severity scores, the entity risk severity score represents a risk associated with the plurality of anomalous events.
19. The non-transitory, computer-readable storage medium of claim 13 , wherein:
the computer executable instructions are deployable to a client system from a server system at a remote location.
20. The non-transitory, computer-readable storage medium of claim 13 , wherein:
the computer executable instructions are provided by a service provider to a user on an on-demand basis.