Analysis of endpoint detect and response data
There is disclosed a system and method of detecting security threats for an enterprise, including: filtering a first set of endpoint metadata records to identify a subset of metadata records, wherein filtering includes identifying endpoint security metadata records that are uncommon in context of the enterprise; and designating the subset of metadata records as indicating a potential security threat including designating the subset of metadata records for human analysis.
1. A method of detecting security threats for an enterprise, comprising:
computing commonality baseline metadata records based on multiple time windows;
filtering a first set of endpoint metadata records to identify a subset of metadata records, wherein filtering includes identifying, via machine learning, a delta between the first set of endpoint security metadata records and the commonality baseline metadata records;
based on the filtering designating the subset of metadata records as indicating a potential security threat, wherein designating includes designating the subset of metadata records for human analysis;
identifying command line operations within the endpoint metadata records; and
tokenizing the command line operations into a token, wherein the token is assigned a numerical value.
2. The method of claim 1 , wherein the first set of endpoint metadata records are an unfiltered set.
3. The method of claim 1 , wherein the subset of metadata records is less than one tenth a size of the first set of endpoint metadata records.
4. The method of claim 1 , further including providing the subset of metadata records to a security operations center for human analysis.
5. The method of claim 1 , further including receiving an instruction from a human actor to adjust a threshold for identifying uncommon security metadata records.
6. The method of claim 5 , further including providing a graphical user interface to receive the instruction from the human actor.
7. The method of claim 1 , further including using cooperative human/machine interaction to perform the human analysis.
8. The method of claim 1 , further including using a hash to filter the first set of endpoint metadata records.
9. The method of claim 8 , wherein the hash is a MinHash.
10. The method of claim 1 , further including performing locality-sensitive hashing to group the tokenized command line operations.
11. The method of claim 1 , wherein the numerical value is based on characters within the respective tokens.
12. The method of claim 1 , wherein the commonality baseline metadata records based on multiple time windows represent metadata that are common in context of the enterprise at different times.
13. One or more tangible, non-transitory computer-readable storage media having stored thereon executable instructions to instruct a processor circuit to:
compute baseline security records based on multiple time windows;
filter a first set of endpoint security records to identify a subset of security records, wherein filtering includes identifying, via machine learning, a delta between the first set of endpoint security records and the baseline security records;
based on the filtering, designating the subset of endpoint security records as indicating a potential security threat to an enterprise, wherein designating includes designating the subset of endpoint security records for human analysis;
identify command line operations within the endpoint metadata records; and
tokenize the command line operations into a token, wherein the token is assigned a numerical value.
14. The one or more tangible, non-transitory computer-readable storage media of claim 13 , wherein the subset of endpoint security records is less than one tenth a size of the first set of endpoint security records.
15. The one or more tangible, non-transitory computer-readable storage media of claim 13 , wherein the instructions are further to perform locality-sensitive hashing to group the tokenized command line operations.
16. The one or more tangible, non-transitory computer-readable storage media of claim 13 , wherein the numerical value is based on characters within the respective tokens.
17. A computing ecosystem including one or more computers, virtual machines, or containers, the computing system comprising:
at least one processor circuit;
at least one memory circuit;
instructions encoded within the at least one memory circuit to instruct the at least one processor circuit to:
compute baseline security records based on multiple time windows;
filter a first set of endpoint security records to identify a subset of security records, wherein filtering includes identifying, via machine learning, a delta between the first set of endpoint security records and the baseline security records;
based on the filtering, designating the subset of endpoint security records as indicating a potential security threat to an enterprise, wherein designating includes designating the subset of endpoint security records for human analysis;
identify command line operations within the endpoint metadata records; and
tokenize the command line operations into a token, wherein the token is assigned a numerical value.
18. The computing ecosystem of claim 17 , further including providing the subset of metadata records to a security operations center for human analysis.
19. The computing ecosystem of claim 17 , wherein the instructions are further to receive an instruction from a human actor to adjust a threshold for identifying uncommon endpoint security records.
20. The computing ecosystem of claim 17 , wherein the instructions are further to provide a cooperative human/machine interaction to perform the human analysis.