System and method for aggregating and securing managed detection and response connection interfaces between multiple networked sources
A system and method for a flexible, high-speed Managed Detection and Response platform that ingests, parses, normalizes, monitors, and correlates nearly any log source or security tool output. The MDR comprising of a declarative connector service that tags events with appropriate data source labels to facilitating data isolation, proper handling, and provenance across multiple customers and security products but otherwise aggregate alerts into a single data stream for consumption by the MDR SOC operators. A connector service further provides a programmatic (API-based) means to interchange data securely across environments. Event data is aggregated by the Managed Detection and Response platform that then utilizes enhanced log ingest capabilities to process the data allowing SOC operators to be able to write rules against the alerts.
1. A system for facilitating data isolation across multiple entities and security products comprising:
a computing device comprising a plurality of programming instructions cause the computing device to:
receive a service configuration for a service from a plurality of different managed detection and response client services, wherein the service configuration comprises authentication information, access information, and processing information for the service, wherein the processing information specifies data processing and storage requirements for events associated with the service, wherein the processing information includes regulatory compliance requirements specifying isolation requirements for computing and networking events;
retrieve data from the service using at least the authentication information and the access information in the service configuration, wherein the retrieved data comprises computing and networking events;
tag the retrieved data by embedding a tag into each computing and networking event of the retrieved data according to the respective processing information, wherein the embedded tag is used to enforce the data processing and storage requirements specified by the processing information during subsequent processing, wherein the embedded tag comprises an indication of the regulatory compliance requirements for the computing and networking event;
organize the tagged data into a single data stream;
encrypt the single data stream; and
send the encrypted data stream comprising the tagged data over a network to a secure processing facility;
a secure processing facility configured to receive the encrypted data stream and use the embedded tags to process the computing and networking events according to their respective requirements by isolating access to the computing and networking events based on the regulatory compliance requirements indicated in the embedded tags.
2. The system of claim 1 , wherein the tag further comprises data provenance information.
3. The system of claim 1 , wherein the computing device comprises multiple computing systems forming a distributed system.
4. The system of claim 1 , wherein the retrieval of data from more than one service is accomplished via a connector workflow configuration.
5. The system of claim 4 , wherein the connector workflow configuration is a data processing workflow generated from a distributed computational graph.
6. The system of claim 1 , wherein the data is exchanged using a RESTful API that facilitates data exchange between and among cloud-based services.
7. A method for facilitating data isolation across multiple entities and security products, comprising the steps of:
receiving a service configuration for a service from a plurality of different managed detection and response client services, wherein the service configuration comprises authentication information, access information, and processing information for the service, wherein the processing information specifies data processing and storage requirements for events associated with the service, wherein the processing information includes regulatory compliance requirements specifying isolation requirements for computing and networking events;
retrieving data from the service using at least the authentication information and the access information in the service configuration, wherein the retrieved data comprises computing and networking events;
tagging the retrieved data by embedding a tag into each computing and networking event of the retrieve data according to the respective processing information, wherein the embedded tag is used to enforce the data processing and storage requirements specified by the processing information during subsequent processing, wherein the embedded tag comprises an indication of the regulatory compliance requirements for the computing and networking event;
organizing the tagged data into a single data stream;
encrypting the single data stream; and
sending the encrypted data stream comprising the tagged data over a network to a secure processing facility;
a secure processing facility configured to receive the encrypted data stream and use the embedded tags to process the computing and networking events according to their respective requirements by isolating access to the computing and networking events based on the regulatory compliance requirements indicated in the embedded tags.
8. The method of claim 7 , wherein the tag further comprises data provenance information.
9. The method of claim 7 , wherein the retrieval of data from more than one service is accomplished via a connector workflow configuration.
10. The method of claim 9 , wherein the connector workflow configuration is a data processing workflow generated from a distributed computational graph.
11. The method of claim 7 , wherein the data is exchanged using a RESTful API that facilitates data exchange between and among cloud-based services.