Identifying automated responses to security threats based on communication interactions content
Systems, methods, and software described herein provide security actions based on related security threat communications. In one example, a method of operating an advisement system includes identifying a security threat within the computing environment, wherein the computing environment comprises a plurality of computing assets. The method further provides obtaining descriptor information for the security threat, and retrieving related communication interactions based on the descriptor information. The method also includes generating a response to the security threat based on the related communication interactions.
1. A computer-implemented method comprising:
obtaining, from a first computing asset of a computing environment comprising a plurality of computing assets, data indicating a security threat affecting the computing environment, wherein the data identifies a first communication interaction associated with the security threat;
obtaining, from a second computing asset of the computing environment, one or more second communication interactions related to the first communication interaction, wherein the one or more second communication interactions are identified using a characteristic of the first communication interaction;
receiving a request to monitor future communications associated with the characteristic of the first communication interaction;
identifying a future communication associated with the characteristic of the first communication interaction;
identifying an automated response based at least in part on the characteristic of the first communication interaction;
translating the automated response into an action to be performed at a third computing asset involved in the first communication interaction; and
causing the third computing asset to perform the action, wherein completion of the action mitigates the security threat.
2. The computer-implemented method of claim 1 , wherein content of the one or more second communication interactions includes a uniform resource locator (URL).
3. The computer-implemented method of claim 1 , wherein the characteristic of the first communication interaction includes at least one of: a username, an Internet Protocol (IP) address, a domain name, or a type of message content.
4. The computer-implemented method of claim 1 , further comprising:
identifying a suggested action to be implemented at the third computing asset;
providing the suggested action to an administrator of the computing environment;
identifying a selection of the suggested action by the administrator of the computing environment; and
initiating implementation of the suggested action.
5. The computer-implemented method of claim 1 , wherein the data indicating the security threat within the computing environment includes at least one of: data received from a security information and event management (SIEM) system, or a user-generated notification of the security threat affecting the computing environment.
6. The computer-implemented method of claim 1 , wherein the automated response is identified further based at least in part on a number of the one or more second communication interactions.
7. The computer-implemented method of claim 1 , further comprising:
determining, based on the one or more second communication interactions, a type of the security threat; and
identifying the automated response based on determining the type of the security threat associated with the one or more second communication interactions.
8. The computer-implemented method of claim 1 , further comprising:
determining, based on a type of content contained in the one or more second communication interactions, that the security threat involves a phishing attempt; and
identifying the automated response based on determining that the security threat involves the phishing attempt.
9. The computer-implemented method of claim 1 , further comprising:
identifying another future communication associated with content of the one or more second communication interactions.
10. The computer-implemented method of claim 1 , wherein the first computing asset and the second computing asset are a same computing asset.
11. The computer-implemented method of claim 1 , wherein the first computing asset and the third computing asset are a same computing asset.
12. The computer-implemented method of claim 1 , wherein the action is specific to a hardware or software configuration of the third computing asset.
13. The computer-implemented method of claim 1 , wherein the automated response includes at least one of: blocking receipt of emails at the third computing asset, or blocking an internet protocol (IP) address.
14. The computer-implemented method of claim 1 , wherein the automated response is a first automated response, and wherein the method further comprises:
determining that at least one of the one or more second communication interactions includes a link to download a file;
determining that the file is malicious; and
initiating a second automated response in the computing environment based on determining that the file is malicious.
15. A computing device, comprising:
a processor; and
a non-transitory computer-readable medium having stored thereon instructions that, when executed by the processor, cause the processor to perform operations including:
obtaining, from a first computing asset of a computing environment comprising a plurality of computing assets, data indicating a security threat affecting the computing environment, wherein the data identifies a first communication interaction associated with the security threat;
obtaining, from a second computing asset of the computing environment, one or more second communication interactions related to the first communication interaction, wherein the one or more second communication interactions are identified using a characteristic of the first communication interaction;
receiving a request to monitor future communications associated with the characteristic of the first communication interaction;
identifying a future communication associated with the characteristic of the first communication interaction;
identifying an automated response based at least in part on the characteristic of the first communication interaction;
translating the automated response into an action to be performed at a third computing asset involved in the first communication interaction; and
causing the third computing asset to perform the action, wherein completion of the action mitigates the security threat.
16. The computing device of claim 15 , wherein content of the one or more second communication interactions includes a uniform resource locator (URL).
17. The computing device of claim 15 , wherein the characteristic of the first communication interaction includes at least one of: a username, an Internet Protocol (IP) address, a domain name, or a type of message content.
18. A non-transitory computer-readable medium having stored thereon instructions that, when executed by one or more processors, cause the one or more processors to perform operations including:
obtaining, from a first computing asset of a computing environment comprising a plurality of computing assets, data indicating a security threat affecting the computing environment, wherein the data identifies a first communication interaction associated with the security threat;
obtaining, from a second computing asset of the computing environment, one or more second communication interactions related to the first communication interaction, wherein the one or more second communication interactions are identified using a characteristic of the first communication interaction;
receiving a request to monitor future communications associated with the characteristic of the first communication interaction;
identifying a future communication associated with the characteristic of the first communication interaction;
identifying an automated response based at least in part on the characteristic of the first communication interaction;
translating the automated response into an action to be performed at a third computing asset involved in the first communication interaction; and
causing the third computing asset to perform the action, wherein completion of the action mitigates the security threat.
19. The non-transitory computer-readable medium of claim 18 , wherein content of the one or more second communication interactions includes a uniform resource locator (URL).
20. The non-transitory computer-readable medium of claim 18 , wherein the characteristic of the first communication interaction includes at least one of: a username, an Internet Protocol (IP) address, a domain name, or a type of message content.