Risk based priority processing of data
Utilities (e.g., methods, systems, apparatuses, etc.) for use in generating and making use of priority scores for data generated by one or more data systems that more accurately prioritize those events and other pieces of data to be addressed by analysts and troubleshooters before others (e.g., collectively taking into account threats posed by origin host components and risks to impacted host components) to work the highest risk events and alarms first and to effectively and efficiently spend their alarm monitoring time.
1. A computer-based system for use in monitoring data generated by one or more data systems, the system comprising:
a processor; and
non-transitory computer readable media accessible by the processor, wherein the non-transitory computer readable media includes:
a database including:
a first list of known hosts of the one or more data systems and respective relative risk or threat levels for the known hosts;
a second list of known network ranges of the one or more data systems and respective relative risk or threat levels for the known network ranges;
a third list of default relative risk or threat levels for origin host components responsible for initiating an occurrence on the one or more data systems; wherein the third list of default relative risk or threat levels for origin host components responsible for initiating an occurrence on the one or more data systems includes an external host default threat level for when an origin host component is inferred to be an external host and an internal host default threat level for when the origin host component is inferred to be an internal host and
a fourth list of default relative risk or threat levels for impacted host components that are affected by an occurrence on the one or more data systems; and
a set of computer-readable instructions that are executable by the processor to:
receive data generated by one or more data systems over at least one network;
parse, from the received data, at least one of an origin host identifier associated with an origin host component responsible for initiating an occurrence on the one or more data systems and an impacted host identifier associated with an impacted host component that is affected by an occurrence on the one or more data systems;
determine that the at least one of the parsed origin host identifier or impacted host identifier cannot be used to obtain a relative risk or threat level from the first list; and
access one or more of the second, third and fourth lists to obtain a relative risk or threat level with the at least one of the parsed origin host identifier or impacted host identifier.
2. A computer-based system for use in monitoring data generated by one or more data systems, the system comprising:
a processor; and
non-transitory computer readable media accessible by the processor, wherein the non-transitory computer readable media includes:
a database including:
a first list of known hosts of the one or more data systems and respective relative risk or threat levels for the known hosts;
a second list of known network ranges of the one or more data systems and respective relative risk or threat levels for the known network ranges;
a third list of default relative risk or threat levels for origin host components responsible for initiating an occurrence on the one or more data systems; and
a fourth list of default relative risk or threat levels for impacted host components that are affected by an occurrence on the one or more data systems; wherein the fourth list of default relative risk or threat levels for impacted host components that are affected by an occurrence on the one or more data systems includes an external host default threat level for when the impacted host component is inferred to be an external host and an internal host default threat level for when the impacted host component is inferred to be an internal host; and
a set of computer-readable instructions that are executable by the processor to:
receive data generated by one or more data systems over at least one network;
parse, from the received data, at least one of an origin host identifier associated with an origin host component responsible for initiating an occurrence on the one or more data systems and an impacted host identifier associated with an impacted host component that is affected by an occurrence on the one or more data systems;
determine that the at least one of the parsed origin host identifier or impacted host identifier cannot be used to obtain a relative risk or threat level from the first list; and
access one or more of the second, third and fourth lists to obtain a relative risk or threat level with the at least one of the parsed origin host identifier or impacted host identifier.