Threat mitigation system and method

1. A computer-implemented method, executed on a computing device, comprising:

gathering objects from a plurality of sources associated with a computing platform in response to a security event; the plurality of sources includes one or more of log files maintained by a SIEM system and log files maintained by one or security-relevant sub systems;

obtaining object information concerning one or more initial objects within a computing platform in response to the security event;

identifying an event type for the security event;

executing a response script based, at least in part, upon the event type; and

providing suggestions concerning additional objects to be reviewed by a third party, wherein the additional objects include one or more of a time-based traffic map object, a destination port object, a service plunk object, a service CB Response object, an outbound traffic port graphical object, and a data sources graphical object.

2. The computer-implemented method of claim 1 further comprising:

detecting the security event based upon identified suspect activity within the computing platform.

3. The computer-implemented method of claim 2 wherein detecting the security event based upon identified suspect activity within the computing platform includes:

establishing connectivity with a plurality of security-relevant subsystems within the computing platform.

4. The computer-implemented method of claim 3 wherein detecting the security event based upon identified suspect activity within the computing platform further includes:

monitoring the plurality of security-relevant subsystems to identify suspect activity within the computing platform.

5. The computer-implemented method of claim 3 wherein the plurality of security-relevant subsystems includes one or more of:

CDN (i.e., Content Delivery Network) systems;

DAM (i.e., Database Activity Monitoring) systems;

UBA (i.e., User Behavior Analytics) systems;

MDM (i.e., Mobile Device Management) systems;

IAM (i.e., Identity and Access Management) systems;

DNS (i.e., Domain Name Server) systems;

Antivirus systems;

operating systems;

data lakes;

data logs;

security-relevant software applications;

security-relevant hardware systems; and

resources external to the computing platform.

6. The computer-implemented method of claim 1 wherein executing a response script includes:

obtaining object information concerning one or more additional objects.

7. The computer-implemented method of claim 1 wherein executing a response script includes:

obtaining artifacts concerning the security event.

8. The computer-implemented method of claim 7 wherein the artifacts include one or more of:

raw data;

screen shots;

graphics;

notes;

annotations;

audio recordings; and

video recordings.

9. The computer-implemented method of claim 1 wherein executing a response script includes:

providing suggestions to a third-party concerning a remedial action to be taken by the third-party in response to the security event.

10. The computer-implemented method of claim 1 wherein executing a response script includes:

executing a remedial action in response to the security event.

11. A computer program product residing on a non-transitory computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:

gathering objects from a plurality of sources associated with a computing platform in response to a security event; the plurality of sources includes one or more of log files maintained by a SIEM system and log files maintained by one or security-relevant subsystems;

obtaining object information concerning one or more initial objects within a computing platform in response to the security event;

identifying an event type for the security event;

executing a response script based, at least in part, upon the event type; and

providing suggestions concerning additional objects to be reviewed by a third party, wherein the additional objects include one or more of a time-based traffic map object, a destination port object, a service plunk object, a service CB Response object, an outbound traffic port graphical object, and a data sources graphical object.

12. The computer program product of claim 11 further comprising:

detecting the security event based upon identified suspect activity within the computing platform.

13. The computer program product of claim 12 wherein detecting the security event based upon identified suspect activity within the computing platform includes:

establishing connectivity with a plurality of security-relevant subsystems within the computing platform.

14. The computer program product of claim 13 wherein detecting the security event based upon identified suspect activity within the computing platform further includes:

monitoring the plurality of security-relevant subsystems to identify suspect activity within the computing platform.

15. The computer program product of claim 13 wherein the plurality of security-relevant subsystems includes one or more of:

CDN (i.e., Content Delivery Network) systems;

DAM (i.e., Database Activity Monitoring) systems;

UBA (i.e., User Behavior Analytics) systems;

MDM (i.e., Mobile Device Management) systems;

IAM (i.e., Identity and Access Management) systems;

DNS (i.e., Domain Name Server) systems;

Antivirus systems;

operating systems;

data lakes;

data logs;

security-relevant software applications;

security-relevant hardware systems; and

resources external to the computing platform.

16. The computer program product of claim 11 wherein executing a response script includes:

obtaining object information concerning one or more additional objects.

17. The computer program product of claim 11 wherein executing a response script includes:

obtaining artifacts concerning the security event.

18. The computer program product of claim 17 wherein the artifacts include one or more of:

raw data;

screen shots;

graphics;

notes;

annotations;

audio recordings; and

video recordings.

19. The computer program product of claim 11 wherein executing a response script includes:

providing suggestions to a third-party concerning a remedial action to be taken by the third-party in response to the security event.

20. The computer program product of claim 11 wherein executing a response script includes:

executing a remedial action in response to the security event.

21. A computing system including a processor and memory configured to perform operations comprising:

gathering objects from a plurality of sources associated with a computing platform in response to a security event; the plurality of sources includes one or more of log files maintained by a SIEM system and log files maintained by one or security-relevant sub systems;

obtaining object information concerning one or more initial objects within a computing platform in response to the security event;

identifying an event type for the security event;

executing a response script based, at least in part, upon the event type; and

providing suggestions concerning additional objects to be reviewed by a third party, wherein the additional objects include one or more of a time-based traffic map object, a destination port object, a service plunk object, a service CB Response object, an outbound traffic port graphical object, and a data sources graphical object.

22. The computing system of claim 21 further comprising:

detecting the security event based upon identified suspect activity within the computing platform.

23. The computing system of claim 22 wherein detecting the security event based upon identified suspect activity within the computing platform includes:

establishing connectivity with a plurality of security-relevant subsystems within the computing platform.

24. The computing system of claim 23 wherein detecting the security event based upon identified suspect activity within the computing platform further includes:

monitoring the plurality of security-relevant subsystems to identify suspect activity within the computing platform.

25. The computing system of claim 23 wherein the plurality of security-relevant subsystems includes one or more of:

CDN (i.e., Content Delivery Network) systems;

DAM (i.e., Database Activity Monitoring) systems;

UBA (i.e., User Behavior Analytics) systems;

MDM (i.e., Mobile Device Management) systems;

IAM (i.e., Identity and Access Management) systems;

DNS (i.e., Domain Name Server) systems;

Antivirus systems;

operating systems;

data lakes;

data logs;

security-relevant software applications;

security-relevant hardware systems; and

resources external to the computing platform.

26. The computing system of claim 21 wherein executing a response script includes:

obtaining object information concerning one or more additional objects.

27. The computing system of claim 21 wherein executing a response script includes:

obtaining artifacts concerning the security event.

28. The computing system of claim 27 wherein the artifacts include one or more of:

raw data;

screen shots;

graphics;

notes;

annotations;

audio recordings; and

video recordings.

29. The computing system of claim 21 wherein executing a response script includes:

providing suggestions to a third-party concerning a remedial action to be taken by the third-party in response to the security event.

30. The computing system of claim 21 wherein executing a response script includes:

executing a remedial action in response to the security event.