Collecting endpoint data and network data to detect an anomaly
The present application describes a system that uses endpoint data and network data to detect an anomaly. Once an anomaly is detected, the system may determine a severity of the anomaly by comparing the anomaly to a global database of known anomalies. The system may then initiate preventative measures to address the anomaly.
1. A method, comprising:
receiving endpoint data of a computing device from the computing device, the endpoint data comprising activities and/or events that occurred on the computing device;
receiving network data from a network access device, the network data being associated with the computing device;
combining the endpoint data and the network data to generate event data associated with the computing device, the event data including a sequence of events between the computing device and the network access device;
analyzing the event data associated with the computing device to detect an anomaly; and
initiating a mitigation procedure to address the anomaly.
2. The method of claim 1 , further comprising:
generating a timeline of the event data; and
causing the timeline to be provided on a display of a remote computing device.
3. The method of claim 2 , wherein at least a portion of the timeline is selectable.
4. The method of claim 3 , further comprising providing additional information associated with the timeline in response to receiving a selection of the at least the portion of the timeline.
5. The method of claim 1 , wherein the mitigation procedure includes causing a blocking action to be performed on the anomaly.
6. The method of claim 1 , wherein the endpoint data is endpoint detection and response (EDR) data.
7. A system, comprising:
a processor; and
a memory coupled to the processor and storing instructions that, when executed by the processor, perform operations, comprising:
receiving endpoint data of a computing device from the computing device, the endpoint data comprising activities and/or events that occurred on the computing device;
receiving network data from a network access device, the network data being associated with the computing device;
combining the endpoint data and the network data to generate event data associated with the computing device, the event data including a sequence of events between the computing device and the network access device;
analyzing the event data associated with the computing device to detect an anomaly;
categorizing the anomaly based, at least in part, on the analyzing; and
initiating a mitigation procedure to address the anomaly.
8. The system of claim 7 , further comprising instructions for:
generating a timeline of the event data; and
causing the timeline to be provided on a display of a remote computing device.
9. The system of claim 8 , wherein at least a portion of the timeline is selectable.
10. The system of claim 9 , further comprising instructions for providing additional information associated with the timeline in response to receiving a selection of the at least the portion of the timeline.
11. The system of claim 7 , wherein the mitigation procedure includes an initiating of a blocking action performed on the anomaly based, at least in part, on the categorization of the anomaly.
12. The system of claim 7 , wherein the endpoint data is endpoint detection and response (EDR) data.
13. A method, comprising:
receiving endpoint data of a first computing device from the first computing device, the endpoint data comprising activities and/or events that occurred on the first computing device;
receiving network data associated with the first computing device;
generating event data for the first computing device based, at least in part, on the endpoint data and the network data;
analyzing the event data;
identifying an anomaly in the event data; and
initiating a mitigation procedure on the anomaly.
14. The method of claim 13 , wherein the mitigation procedure is a blocking procedure.
15. The method of claim 13 , wherein the network data includes one or more of a domain name system (DNS) lookup associated with the first computing device, a website that was visited by the first computing device, or an address resolution protocol (ARP) communication associated with the first computing device.
16. The method of claim 13 , further comprising generating a timeline for display on a user interface, the timeline including one or more selectable events associated with the event data.