Determining false positives of file change events detected by file integrity monitoring tools
A system comprises a memory and one or more processors in communication with the memory. The one or more processors may be configured to obtain information associated with one or more authorized file changes and store the information associated with one or more authorized file changes in a first index. The processors may be further configured to obtain one or more file change events and enrich the one or more file change events with the information associated with one or more authorized file changes from the first index. The processors may also be configured to store the one or more file change events enriched with the information associated with one or more authorized file changes in a second index, and based on the enriched data stored in the second index, output an indication that the one or more file change events are false positives.
1. A system comprising:
a memory;
one or more processors in communication with the memory, the one or more processors configured to:
obtain information associated with one or more authorized file changes;
store the information associated with one or more authorized file changes in a first index;
obtain one or more file change events;
integrate the one or more file change events with the information associated with one or more authorized file changes from the first index, one or more incident tasks associated with the one or more file change events, and one or more assets associated with the one or more file change events or the one or more incident tasks to generate integrated data,
wherein integrating the one or more file change events is based on a determination that one or more fields of the one or more file change events match one or more fields of the information associated with one or more authorized file changes, the one or more incident tasks, or the one or more assets, and
wherein the one or more assets comprise a device associated with the one or more file change events or the one or more task incidents;
store the integrated data in a second index; and
output, based on the integrated data stored in the second index, an indication that the one or more file change events are false positives.
2. The system of claim 1 , wherein the information associated with one or more authorized file changes comprises information associated with at least one or more change requests, one or more task incidents, one or more assets associated with the one or more change requests, and one or more assets associated with the one or more task incidents.
3. The system of claim 1 , wherein the one or more fields of the information associated with one or more authorized file changes comprises at least one of a start time of a change request, an end time of the change request, and a description of a phase of the change request.
4. The system of claim 1 , wherein the one or more fields of the information associated with one or more authorized file changes comprises at least one of an open time of an incident task, a close time of the incident task, and a description of a phase of the task incident.
5. The system of claim 4 , wherein the one or more fields of the information associated with one or more authorized file changes comprises at least one of a start time of a change request, an end time of the change request, business information, user information, or confidentiality of data.
6. The system of claim 1 , wherein to integrate the one or more file change events with the information associated with one or more authorized change requests from the first index, the one or more incident tasks associated with the one or more file change events, and the one or more assets associated with the one or more file change events or the one or more incident tasks to generate integrated data, the one or more processors are further configured to:
determine a time of a file change event of the one or more file change events is within a start time or an end time of a change request.
7. The system of claim 1 , wherein to integrate the one or more file change events with the information associated with one or more authorized change requests from the first index, the one or more incident tasks associated with the one or more file change events, and the one or more assets associated with the one or more file change events or the one or more incident tasks to generate integrated data, the one or more processors are further configured to:
determine a time of a file change event of the one or more file change events is within an open time or a close time of an incident task.
8. The system of claim 1 ,
wherein to integrate the one or more change requests with the one or more assets, the one or more processors are further configured to integrate the one or more change requests with the one or more assets based on a ticket identifier of a ticket associated with at least one of the one or more change requests; and
wherein to integrate the one or more change requests with the one or more incident tasks, the one or more processors are further configured to integrate the one or more change requests with the one or more incident tasks based on a ticket associated with at least one of the one or more incident tasks.
9. The system of claim 1 , further comprising:
a cache configured to store a subset of the information associated with one or more authorized file changes stored in the first index, and
wherein to integrate the one or more file change events with the information associated with one or more authorized file changes from the first index, the one or more incident tasks associated with the one or more file change events, and the one or more assets associated with the one or more file change events or the one or more incident tasks to generate integrated data, the one or more processors are further configured to:
obtain, from the cache, the subset of the information associated with one or more authorized file changes stored in the first index.
10. The system of claim 9 , wherein the subset of the information associated with one or more authorized file changes stored in the first index comprises the information for a current day.
11. The system of claim 1 , wherein the subset of the information associated with one or more authorized file changes stored in the first index comprises the information for a period of time.
12. A method comprising:
obtaining information associated with one or more authorized file changes from a computer management system;
storing the information associated with one or more authorized file changes in a first index;
obtaining one or more file change events;
integrating the one or more file change events with the information associated with the one or more authorized file changes from the first index, one or more incident tasks associated with the one or more file change events, and one or more assets associated with the one or more file change events or the one or more incident tasks to generate integrated data,
wherein integrating the one or more file change events is based on a determination that one or more fields of the one or more file change events match one or more fields of the information associated with one or more authorized file changes, the one or more incident tasks, or the one or more assets,
wherein the one or more assets comprise a device associated with the one or more file change events or the one or more incident tasks;
storing the integrated data in a second index; and
outputting, based on the integrated data stored in the second index, an indication that the one or more file change events are false positives.
13. The method of claim 12 , wherein the information associated with one or more authorized file changes comprises information associated with at least one or more change requests, one or more task incidents, one or more assets associated with the one or more change requests, and one or more assets associated with the one or more task incidents.
14. The method of claim 12 , wherein the one or more fields of the information associated with one or more authorized file changes comprises at least one of a start time of a change request, an end time of the change request, and a description of a phase of the change request.
15. The method of claim 12 , wherein the one or more fields of the information associated with one or more authorized file changes comprises at least one of an open time of an incident task, a close time of the incident task, and a description of a phase of the task incident.
16. The method of claim 12 , wherein the one or more fields of the information associated with one or more authorized file changes comprises at least one of a start time of a change request, an end time of the change request, business information, user information, or confidentiality of data.
17. The method of claim 12 , wherein integrating the one or more file change events with the information associated with the one or more authorized file changes from the first index, the one or more incident tasks associated with the one or more file change events, and the one or more assets associated with the one or more file change events or the one or more incident tasks to generate integrated data comprises determining a time of a file change event of the one or more file change events is within a start time or an end time of a task incident.
18. The method of claim 12 , wherein integrating the one or more file change events with the information associated with the one or more authorized file changes from the first index, the one or more incident tasks associated with the one or more file change events, and the one or more assets associated with the one or more file change events or the one or more incident tasks to generate integrated data comprises determining a time of a file change event of the one or more file change events is within an open time or a close time of a change request.
19. The method of claim 12 ,
wherein integrating the one or more change requests with the one or more assets is based on a ticket identifier of a ticket associated with at least one of the one or more change requests; and
wherein integrating the one or more change requests with the one or more incident tasks is based on a ticket associated with at least one of the one or more task incidents.
20. Non-transitory computer readable media comprising instructions that when executed cause one or more processors to:
obtain the information associated with one or more authorized file changes;
store the information associated with one or more authorized file changes in a first index;
obtain one or more file change events;
integrate the one or more file change events with the information associated with one or more authorized file changes from the first index, one or more incident tasks associated with the one or more file change events, and one or more assets associated with the one or more file change events or the one or more incident tasks to generate integrated data,
wherein integrating the one or more file change events with the information associated with one or more authorized file changes from the first index is based on a determination that one or more fields of the one or more file change events match one or more fields of the information associated with one or more authorized file changes, the one or more incident tasks, or the one or more assets, and
wherein the one or more assets comprise a device associated with the one or more file change events or the one or more incident tasks;
store the integrated data in a second index; and
output, based on the integrated data stored in the second index, an indication that the one or more file change events are false positives.