Machine learning model for managing security threat alerts for a compute environment
Data platforms described herein are configured to monitor a compute environment and to use machine learning models for managing security threat alerts for the compute environment. Such a data platform may identify, based on event data indicative of events occurring in the compute environment, a set of detected security threats present within the compute environment. Using a machine learning model trained based on previous event data indicative of events that occurred previously, the data platform may reduce the set of detected security threats to form a subset of prioritized security threats. The data platform may then provide security threat alerts for the compute environment in a manner that emphasizes alerts associated with prioritized security threats over alerts associated with other detected security threats of the set of detected security threats. Corresponding methods, systems, and products are also disclosed.
1 . A method comprising:
identifying, by a data platform monitoring a compute environment and based on event data indicative of events occurring in the compute environment, a set of detected security threats present within the compute environment, wherein the identifying of the set of detected security threats is performed based on one or more predetermined threat criteria that each security threat in the set of detected security threats is detected to satisfy;
reducing, by the data platform using a machine learning model trained based on previous event data indicative of events that occurred previously, the set of detected security threats to
form a subset of prioritized security threats, wherein the subset of prioritized security threats includes a multifaceted security threat detected to be present within the compute environment based on a composite event that includes a first event, and a second event determined to have an affiliation with one another and at least one of the first event or the second event, standing alone, fails to satisfy the one or more predetermined threat criteria, and the composite event that includes the first event and the second event satisfies the one or more predetermined threat criteria; and
providing, by the data platform, security threat alerts for the compute environment in a manner that emphasizes alerts associated with prioritized security threats over alerts associated with other detected security threats of the set of detected security threats.
2 . The method of claim 1 , wherein:
the first event is initiated within the compute environment by a first entity;
the second event is initiated within the compute environment by a second entity; and
the affiliation is based on an affiliation between the first entity and the second entity.
3 . The method of claim 1 , wherein the reducing of the set of detected security threats to form the subset of prioritized security threats is performed in accordance with an upper alert quantity target configured to limit a number or rate of security threat alerts being provided to a number or rate less than the upper alert quantity target.
4 . The method of claim 1 , wherein the reducing of the set of detected security threats to form the subset of prioritized security threats is performed in accordance with a lower alert quantity target configured to ensure that a number or rate of security threat alerts being provided is at least equal to the lower alert quantity target.
5 . The method of claim 1 , wherein the identifying of the set of detected security threats is performed using the machine learning model to designate composite events including two or more affiliated events occurring in the compute environment and to identify the composite events as detected security threats to be included in the set of detected security threats.
6 . The method of claim 5 , further comprising:
discovering, by the data platform, at least one of:
an affiliation between two or more of the events occurring in the compute environment, or
a correlation of one or more of the events occurring in the compute environment with a multifaceted security threat; and
updating, by the data platform based on the discovering, a training of the machine learning model to incorporate the at least one of the affiliation or the correlation.
7 . The method of claim 1 , wherein:
the compute environment is associated with a first client entity;
an additional compute environment is associated with a second client entity distinct from the first client entity; and
the previous event data on which the machine learning model training is based includes cross-client event data indicative of events that occurred previously in the additional compute environment associated with the second client entity.
8 . The method of claim 1 , further comprising detecting, by the data platform during the monitoring of the compute environment, a surge of a particular type of detected security threat within the compute environment;
wherein the reducing of the set of detected security threats to form the subset of prioritized security threats is performed in response to the detecting of the surge and includes at least partially excluding the particular type of detected security threat from the subset of prioritized security threats.
9 . The method of claim 1 , wherein the providing of the security threat alerts in the manner that emphasizes alerts associated with prioritized security threats over alerts associated with other detected security threats includes:
providing security threat alerts associated with the subset of prioritized security threats; and
abstaining from providing security threat alerts associated with detected security threats excluded from the subset of prioritized security threats.
10 . The method of claim 1 , wherein the providing of the security threat alerts in the manner that emphasizes alerts associated with prioritized security threats over alerts associated with other detected security threats includes:
providing a high-priority tier of security threat alerts associated with the subset of prioritized security threats; and
providing one or more low-priority tiers of security threat alerts associated with detected security threats excluded from the subset of prioritized security threats.
11 . The method of claim 1 , wherein the event data is provided by a plurality of distinct data sources associated with the compute environment.
12 . The method of claim 1 , further comprising constructing, by the data platform, a graph based on the previous event data;
wherein:
the graph includes a plurality of nodes connected by a plurality of edges,
each node of the plurality of nodes represents a logical entity and each edge of the plurality of edges represents a behavioral relationship between nodes connected by the edge, and
the machine learning model is trained based on the graph.
13 . A computer program product embodied in a non-transitory computer-readable storage medium and comprising computer instructions for a data platform to perform a process comprising:
identifying, based on event data indicative of events occurring in a compute environment monitored by the data platform, a set of detected security threats present within the compute environment, wherein the identifying of the set of detected security threats is performed based on one or more predetermined threat criteria that each security threat in the set of detected security threats is detected to satisfy;
reducing, based on a machine learning model trained based on previous event data indicative of events that occurred previously, the set of detected security threats to form a subset of prioritized security threats, wherein the subset of prioritized security threats includes a multifaceted security threat detected to be present within the compute environment based on a composite event that includes a first event, and a second event determined to have an affiliation with one another and at least one of the first event or the second event, standing alone, fails to satisfy the one or more predetermined threat criteria, and the composite event that includes the first event and the second event satisfies the one or more predetermined threat criteria; and
providing security threat alerts for the compute environment in a manner that emphasizes alerts associated with prioritized security threats over alerts associated with other detected security threats of the set of detected security threats.
14 . The computer program product of claim 13 , wherein:
the subset of prioritized security threats includes a multifaceted security threat detected to be present within the compute environment based on a composite event that includes a first event initiated within the compute environment by a first entity and a second event initiated within the compute environment by a second entity; and
the first event is determined to have an affiliation with the second event based on an affiliation between the first entity and the second entity.
15 . The computer program product of claim 13 , wherein the reducing of the set of detected security threats to form the subset of prioritized security threats is performed in accordance with:
an upper alert quantity target configured to limit a number or rate of security threat alerts being provided to a number or rate less than the upper alert quantity target; and
a lower alert quantity target configured to ensure that the number or rate of security threat alerts being provided is at least equal to the lower alert quantity target.
16 . The computer program product of claim 13 , wherein the identifying of the set of detected security threats is performed using the machine learning model to designate composite events that each include two or more affiliated events occurring in the compute environment and to identify the composite events as detected security threats to be included in the set of detected security threats.
17 . A system comprising:
memory storing instructions; and
one or more processors communicatively coupled to the memory and configured to execute the instructions to perform a process comprising:
identifying, based on event data indicative of events occurring in a compute environment monitored by the system, a set of detected security threats present within the compute environment, wherein the identifying of the set of detected security threats is performed based on one or more predetermined threat criteria that each security threat in the set of detected security threats is detected to satisfy;
reducing, based on previous event data indicative of events that occurred previously, the set of detected security threats to form a subset of prioritized security threats, wherein the subset of prioritized security threats includes a multifaceted security threat detected to be present within the compute environment based on a composite event that includes a first event, and a second event determined to have an affiliation with one another and at least one of the first event or the second event, standing alone, fails to satisfy the one or more predetermined threat criteria, and the composite event that includes the first event and the second event satisfies the one or more predetermined threat criteria; and
presenting a prioritized alert interface configured to provide security threat alerts for the compute environment in a manner that emphasizes alerts associated with prioritized security threats over alerts associated with other detected security threats of the set of detected security threats.
18 . The system of claim 17 , wherein:
the subset of prioritized security threats includes a multifaceted security threat detected to be present within the compute environment based on a composite event that includes a first event initiated within the compute environment by a first entity and a second event initiated within the compute environment by a second entity; and
the first event is determined to have an affiliation with the second event based on an affiliation between the first entity and the second entity.
19 . The system of claim 17 , wherein the reducing of the set of detected security threats to form the subset of prioritized security threats is performed in accordance with:
an upper alert quantity target configured to limit a number or rate of security threat alerts being provided to a number or rate less than the upper alert quantity target; and
a lower alert quantity target configured to ensure that the number or rate of security threat alerts being provided is at least equal to the lower alert quantity target.