Systems and methods for identity management
Disclosed is a computer-implemented method for correlating user information can include receiving, from a user device, a login log associated with a user; receiving an intrusion detection system (IDS) log; receiving a domain name system (DNS) log; receiving, from a computing device, a log; enriching at least one of the login log, the IDS log, or the DNS log; and correlating an identity with one or more of the login log, the IDS log, and the DNS log. In some embodiments, correlating the identity with one or more of the login log, the IDS log, and the DNS log can include generating a graph representation and saving the graph representation as a sparse graph representation.
1 . A computer-implemented method for correlating user information comprising:
receiving, from a user device, a login log associated with a user;
receiving an intrusion detection system (IDS) log;
receiving a domain name system (DNS) log;
receiving, from a computing device, an application log;
enriching at least one of the login log, the IDS log, or the DNS log, wherein enriching at least one of the login log, the IDS log, or the DNS log comprises enriching the application log with a hostname associated with the DNS log, a first IP address associated with the IDS log, and a second IP address associated with the DNS log;
correlating an identity with one or more of the login log, the IDS log, and the DNS log; and
executing a response action via at least one of a network device, an identity management system, an email system, or a cloud workspace application to address a detected threat associated with the correlated identity.
2 . The computer-implemented method of claim 1 , wherein correlating the identity with one or more of the login log, the IDS log, and the DNS log comprises generating a graph representation and saving the graph representation as a sparse graph representation.
3 . The computer-implemented method of claim 2 , wherein receiving the login log comprises receiving at least one of a username and an internet protocol (IP) address.
4 . The computer-implemented method of claim 3 , wherein receiving the IDS log comprises receiving at least one of an IP address and the hostname.
5 . The computer-implemented method of claim 4 , wherein the IP address is the first IP address and receiving the DNS log comprises receiving the hostname and the second IP address.
6 . The computer-implemented method of claim 5 , wherein receiving the log comprises receiving at least one of an email address and the username.
7 . The computer-implemented method of claim 6 , wherein enriching at least one of the login log, the IDS log, or the DNS log comprises enriching the IDS log with the username.
8 . The computer-implemented method of claim 5 , wherein the graph representation comprises a plurality of nodes, wherein each node is associated with one of the identity, the first IP address, the second IP address, the username, the hostname, and the email address.
9 . The computer-implemented method of claim 1 comprising:
receiving at least one of keystroke information, ad analysis information, and browser fingerprinting information; and
correlating the at least one of keystroke information, ad analysis information, and browser fingerprinting information with the identity.
10 . A computer-implemented method for correlating user information comprising:
receiving, from a user device, a login log associated with a user;
receiving an intrusion detection system (IDS) log;
receiving a domain name system (DNS) log;
receiving, from the user device, an application log;
enriching at least one of the login log, the IDS log, or the DNS log, wherein enriching at least one of the login log, the IDS log, or the DNS log comprises enriching the application log with a hostname associated with the DNS log, a first IP address associated with the IDS log, and a second IP address associated with the DNS log;
receiving a second DNS log;
correlating an identity with one or more of the login log, the IDS log, and the DNS log; and
executing a response action via at least one of a network device, an identity management system, an email system, or a cloud workspace application to address a detected threat associated with the correlated identity.
11 . The computer-implemented method of claim 10 , wherein correlating the identity with one or more of the login log, the IDS log, and the DNS log comprises generating a graph representation and saving the graph representation as a sparse graph representation.
12 . The computer-implemented method of claim 10 , wherein receiving the login log comprises receiving at least one of a username and an internet protocol (IP) address.
13 . The computer-implemented method of claim 12 , wherein receiving the IDS log comprises receiving at least one of an IP address and the hostname.
14 . The computer-implemented method of claim 13 , wherein the IP address is the first IP address and receiving the DNS log comprises receiving the hostname and the second IP address.
15 . The computer-implemented method of claim 14 , wherein receiving the application log comprises receiving at least one of an email address and the username.
16 . The computer-implemented method of claim 15 , wherein enriching at least one of the login log, the IDS log, or the DNS log comprises enriching the IDS log with the username.
17 . The computer-implemented method of claim 14 , wherein receiving the second DNS log comprises receiving a second hostname and the second IP address.
18 . The computer-implemented method of claim 10 comprising:
receiving at least one of keystroke information, ad analysis information, and browser fingerprinting information; and
correlating the at least one of keystroke information, ad analysis information, and browser fingerprinting information with the identity.