Threat mitigation system and method
A computer-implemented method, computer program product and computing system for defining a first query for a first security-relevant subsystem within a computing platform; processing the first query on the first security-relevant subsystem to generate a first data set concerning security events occurring on the first security-relevant subsystem; and receiving the first data set concerning the security events occurring on the first security-relevant subsystem.
1. A computer-implemented method, executed on a computing device, comprising:
defining a first query for a first security-relevant subsystem within a computing platform, including defining a single search in a universal language, and translating the single search in the universal language into a plurality of technology-specific searches, including a first security-relevant subsystem specific search executable by the first security-relevant subsystem, including translating a syntax of the unified query into a syntax of each of the plurality of plurality of technology-specific searches;
processing the first query on the first security-relevant subsystem to generate a first data set concerning security events occurring on the first security-relevant subsystem; and
receiving the first data set concerning the security events occurring on the first security-relevant subsystem.
2. The computer-implemented method of claim 1 further comprising:
identifying two or more associated detection events defined within the first data set; and
grouping the two or more associated detection events to define a security incident.
3. The computer-implemented method of claim 2 wherein one or more artifacts/log entries are associated with each of the first data set.
4. The computer-implemented method of claim 3 wherein identifying two or more associated detection events defined within the first data set includes:
identifying two or more detection events defined within the first data set that have common artifacts/log entries.
5. The computer-implemented method of claim 4 wherein grouping the two or more associated detection events to define a security incident includes:
grouping the one or more artifacts/log entries associated with each of the two or more associated detection events to form an artifact/log entry set for the security incident.
6. The computer-implemented method of claim 1 further comprising:
defining a second query for a second security-relevant subsystem within the computing platform;
processing the second query on the second security-relevant subsystem to generate a second data set concerning security events occurring on the second security-relevant subsystem; and
receiving the second data set concerning the security events occurring on the second security-relevant subsystem.
7. The computer-implemented method of claim 6 further comprising:
identifying two or more associated detection events defined within the second data set; and
grouping the two or more associated detection events to define a security incident.
8. The computer-implemented method of claim 7 wherein one or more artifacts/log entries are associated with each of the second data set.
9. The computer-implemented method of claim 8 wherein identifying two or more associated detection events defined within the second data set includes:
identifying two or more detection events defined within the second data set that have common artifacts/log entries.
10. The computer-implemented method of claim 9 wherein grouping the two or more associated detection events to define a security incident includes:
grouping the one or more artifacts/log entries associated with each of the two or more associated detection events to form an artifact/log entry set for the security incident.
11. A computer program product residing on a non-transitory computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:
defining a first query for a first security-relevant subsystem within a computing platform, including defining a single search in a universal language, and translating the single search in the universal language into a plurality of technology-specific searches, including a first security-relevant subsystem specific search executable by the first security-relevant subsystem, including translating a syntax of the unified query into a syntax of each of the plurality of plurality of technology-specific searches;
processing the first query on the first security-relevant subsystem to generate a first data set concerning security events occurring on the first security-relevant subsystem; and
receiving the first data set concerning the security events occurring on the first security-relevant subsystem.
12. The computer program product of claim 11 further comprising:
identifying two or more associated detection events defined within the first data set; and
grouping the two or more associated detection events to define a security incident.
13. The computer program product of claim 12 wherein one or more artifacts/log entries are associated with each of the first data set.
14. The computer program product of claim 13 wherein identifying two or more associated detection events defined within the first data set includes:
identifying two or more detection events defined within the first data set that have common artifacts/log entries.
15. The computer program product of claim 14 wherein grouping the two or more associated detection events to define a security incident includes:
grouping the one or more artifacts/log entries associated with each of the two or more associated detection events to form an artifact/log entry set for the security incident.
16. The computer program product of claim 11 further comprising:
defining a second query for a second security-relevant subsystem within the computing platform;
processing the second query on the second security-relevant subsystem to generate a second data set concerning security events occurring on the second security-relevant subsystem; and
receiving the second data set concerning the security events occurring on the second security-relevant subsystem.
17. The computer program product of claim 16 further comprising:
identifying two or more associated detection events defined within the second data set; and
grouping the two or more associated detection events to define a security incident.
18. The computer program product of claim 17 wherein one or more artifacts/log entries are associated with each of the second data set.
19. The computer program product of claim 18 wherein identifying two or more associated detection events defined within the second data set includes:
identifying two or more detection events defined within the second data set that have common artifacts/log entries.
20. The computer program product of claim 19 wherein grouping the two or more associated detection events to define a security incident includes:
grouping the one or more artifacts/log entries associated with each of the two or more associated detection events to form an artifact/log entry set for the security incident.
21. A computing system including a processor and memory configured to perform operations comprising:
defining a first query for a first security-relevant subsystem within a computing platform, including defining a single search in a universal language, and translating the single search in the universal language into a plurality of technology-specific searches, including a first security-relevant subsystem specific search executable by the first security-relevant subsystem, including translating a syntax of the unified query into a syntax of each of the plurality of plurality of technology-specific searches;
processing the first query on the first security-relevant subsystem to generate a first data set concerning security events occurring on the first security-relevant subsystem; and
receiving the first data set concerning the security events occurring on the first security-relevant subsystem.
22. The computing system of claim 21 further comprising:
identifying two or more associated detection events defined within the first data set; and
grouping the two or more associated detection events to define a security incident.
23. The computing system of claim 22 wherein one or more artifacts/log entries are associated with each of the first data set.
24. The computing system of claim 23 wherein identifying two or more associated detection events defined within the first data set includes:
identifying two or more detection events defined within the first data set that have common artifacts/log entries.
25. The computing system of claim 24 wherein grouping the two or more associated detection events to define a security incident includes:
grouping the one or more artifacts/log entries associated with each of the two or more associated detection events to form an artifact/log entry set for the security incident.
26. The computing system of claim 21 further comprising:
defining a second query for a second security-relevant subsystem within the computing platform;
processing the second query on the second security-relevant subsystem to generate a second data set concerning security events occurring on the second security-relevant subsystem; and
receiving the second data set concerning the security events occurring on the second security-relevant subsystem.
27. The computing system of claim 26 further comprising:
identifying two or more associated detection events defined within the second data set; and
grouping the two or more associated detection events to define a security incident.
28. The computing system of claim 27 wherein one or more artifacts/log entries are associated with each of the second data set.
29. The computing system of claim 28 wherein identifying two or more associated detection events defined within the second data set includes:
identifying two or more detection events defined within the second data set that have common artifacts/log entries.
30. The computing system of claim 29 wherein grouping the two or more associated detection events to define a security incident includes:
grouping the one or more artifacts/log entries associated with each of the two or more associated detection events to form an artifact/log entry set for the security incident.