Threat mitigation system and method
A computer-implemented method, computer program product and computing system for: obtaining consolidated platform information for a computing platform to identify one or more deployed security-relevant subsystems; processing the consolidated platform information to identify one or more non-deployed security-relevant subsystems; generating a list of ranked & recommended security-relevant subsystems that ranks the one or more non-deployed security-relevant subsystems; and providing the list of ranked & recommended security-relevant subsystems to a third-party.
1. A computer-implemented method, executed on a computing device, comprising:
monitoring and logging, by a plurality of deployed security-relevant subsystems, activity with respect to a computing platform;
establishing connectivity with the plurality of deployed security-relevant subsystems within a computing platform, the plurality of security-relevant subsystems including one or more of Content Delivery Network systems, Database Activity Monitoring systems, User Behavior Analytic systems, Mobile Device Management systems, Identity and Access Management systems, Domain Name Server systems, antivirus systems, operating systems;
receiving a unified query, the unified query including a query that may be parsed to provide a plurality of security-relevant subsystem specific queries;
effectuating at least a portion of the unified query on at least a subset of the plurality of deployed security-relevant subsystems;
obtaining at least one security-relevant information set from each of the subset of the plurality of security-relevant subsystems, thus defining a plurality of security-relevant information sets, wherein the plurality of security-relevant information sets include one or more artifacts concerning a detected security event;
processing the plurality of security-relevant information sets using artificial intelligence/machine learning to identify one or more commonalities amongst the plurality of security-relevant information sets;
combining the plurality of security-relevant information sets to form an aggregated security-relevant information set for the computing platform;
obtaining artifact information concerning the one or more artifacts; and
generating a conclusion concerning the detected security event based upon, at least in part, the detected security event, the one or more artifacts and the artifact information.
2. The computer-implemented method of claim 1 wherein establishing connectivity with a plurality of security-relevant subsystems includes:
utilizing at least one application program interface to access at least one of the plurality of security-relevant subsystems.
3. The computer-implemented method of claim 1 wherein combining the plurality of security-relevant information sets to form an aggregated security-relevant information set includes:
homogenizing the plurality of security-relevant information sets to form the aggregated security-relevant information set.
4. The computer-implemented method of claim 1 further comprising:
enabling third-party access to the aggregated security-relevant information set.
5. The computer-implemented method of claim 1 further comprising:
enabling third-party searching of the aggregated security-relevant information set.
6. The computer-implemented method of claim 1 wherein the plurality of security-relevant information sets utilize a plurality of different formats.
7. The computer-implemented method of claim 1 wherein the plurality of security-relevant information sets utilize a plurality of different nomenclatures.
8. The computer-implemented method of claim 1 wherein the plurality of security-relevant subsystems includes one or more of:
a data lake;
a data log;
a security-relevant software application;
a security-relevant hardware system; and
a resource external to the computing platform.
9. A computer program product residing on a non-transitory computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:
monitoring and logging, by a plurality of deployed security-relevant subsystems, activity with respect to a computing platform;
establishing connectivity with the plurality of deployed security-relevant subsystems within a computing platform, the plurality of security-relevant subsystems including one or more of Content Delivery Network systems, Database Activity Monitoring systems, User Behavior Analytic systems, Mobile Device Management systems, Identity and Access Management systems, Domain Name Server systems, antivirus systems, operating systems;
receiving a unified query, the unified query including a query that may be parsed to provide a plurality of security-relevant subsystem specific queries;
effectuating at least a portion of the unified query on at least a subset of the plurality of deployed security-relevant subsystems;
obtaining at least one security-relevant information set from each of the subset of the plurality of security-relevant subsystems, thus defining a plurality of security-relevant information sets, wherein the plurality of security-relevant information sets include one or more artifacts concerning a detected security event;
processing the plurality of security-relevant information sets using artificial intelligence/machine learning to identify one or more commonalities amongst the plurality of security-relevant information sets;
combining the plurality of security-relevant information sets to form an aggregated security-relevant information set for the computing platform;
obtaining artifact information concerning the one or more artifacts; and
generating a conclusion concerning the detected security event based upon, at least in part, the detected security event, the one or more artifacts and the artifact information.
10. The computer program product of claim 9 wherein establishing connectivity with a plurality of security-relevant subsystems includes:
utilizing at least one application program interface to access at least one of the plurality of security-relevant subsystems.
11. The computer program product of claim 9 wherein combining the plurality of security-relevant information sets to form an aggregated security-relevant information set includes:
homogenizing the plurality of security-relevant information sets to form the aggregated security-relevant information set.
12. The computer program product of claim 9 , further comprising:
enabling third-party access to the aggregated security-relevant information set.
13. The computer program product of claim 9 further comprising:
enabling third-party searching of the aggregated security-relevant information set.
14. The computer program product of claim 9 wherein the plurality of security-relevant information sets utilize a plurality of different formats.
15. The computer program product of claim 9 wherein the plurality of security-relevant information sets utilize a plurality of different nomenclatures.
16. The computer program product of claim 9 wherein the plurality of security-relevant subsystems includes one or more of:
a data lake;
a data log;
a security-relevant software application;
a security-relevant hardware system; and
a resource external to the computing platform.
17. A computing system including a processor and memory configured to perform operations comprising:
monitoring and logging, by a plurality of deployed security-relevant subsystems, activity with respect to a computing platform;
establishing connectivity with the plurality of deployed security-relevant subsystems within a computing platform, the plurality of security-relevant subsystems including one or more of Content Delivery Network systems, Database Activity Monitoring systems, User Behavior Analytic systems, Mobile Device Management systems, Identity and Access Management systems, Domain Name Server systems, antivirus systems, operating systems;
receiving a unified query, the unified query including a query that may be parsed to provide a plurality of security-relevant subsystem specific queries;
effectuating at least a portion of the unified query on at least a subset of the plurality of deployed security-relevant subsystems;
obtaining at least one security-relevant information set from each of the subset of the plurality of security-relevant subsystems, thus defining a plurality of security-relevant information sets, wherein the plurality of security-relevant information sets include one or more artifacts concerning a detected security event;
processing the plurality of security-relevant information sets using artificial intelligence/machine learning to identify one or more commonalities amongst the plurality of security-relevant information sets;
combining the plurality of security-relevant information sets to form an aggregated security-relevant information set for the computing platform;
obtaining artifact information concerning the one or more artifacts; and
generating a conclusion concerning the detected security event based upon, at least in part, the detected security event, the one or more artifacts and the artifact information.
18. The computing system of claim 17 wherein establishing connectivity with a plurality of security-relevant subsystems includes:
utilizing at least one application program interface to access at least one of the plurality of security-relevant subsystems.
19. The computing system of claim 17 wherein combining the plurality of security-relevant information sets to form an aggregated security-relevant information set includes:
homogenizing the plurality of security-relevant information sets to form the aggregated security-relevant information set.
20. The computing system of claim 17 further comprising:
enabling third-party access to the aggregated security-relevant information set.
21. The computing system of claim 17 further comprising:
enabling third-party searching of the aggregated security-relevant information set.
22. The computing system of claim 17 wherein the plurality of security-relevant information sets utilize a plurality of different formats.
23. The computing system of claim 17 wherein the plurality of security-relevant information sets utilize a plurality of different nomenclatures.
24. The computing system of claim 17 wherein the plurality of security-relevant subsystems includes one or more of:
a data lake;
a data log;
a security-relevant software application;
a security-relevant hardware system; and
a resource external to the computing platform.