Executing modular alerts and associated security actions
Techniques and mechanisms are disclosed for configuring actions to be performed by a network security application in response to the detection of potential security incidents, and for causing a network security application to report on the performance of those actions. For example, users may use such a network security application to configure one or more “modular alerts.” As used herein, a modular alert generally represents a component of a network security application which enables users to specify security modular alert actions to be performed in response to the detection of defined triggering conditions, and which further enables tracking information related to the performance of modular alert actions and reporting on the performance of those actions.
1. A computer-implemented method comprising:
receiving input defining a custom response action to be executed by a network security application in response to a detection of a potential security incident in an information technology (IT) environment, wherein the input specifies a command to be sent to a device or service related to the network security application in response to the detection of the potential security incident in the IT environment, and wherein the input defining the custom response action further comprises a script file that includes code for performing the custom response action;
generating a package containing executable logic for the custom response action;
sending the package to an application programming interface (API) or other component;
receiving a determination that the package conforms to one or more standards for executing actions within the network security application;
based on receiving the determination that the package conforms to one or more standards for executing actions within the network security application, applying the package to an instance of the network security application;
receiving input defining an adaptive response, wherein the input identifies:
a correlation search used to identify notable events from event data stored by a data intake and query system, wherein the data intake and query system includes event data from a plurality of input data sources in the IT environment, and
the custom response action to be executed by the network security application in response to the detection of the potential security incident in the IT environment;
executing, by the data intake and query system, the correlation search against the event data stored by the data intake and query system;
identifying a notable event based on executing the correlation search against the event data stored by the data intake and query system; and
executing the custom response action based on identifying the notable event, wherein executing the custom response action comprises running the script file.
2. The computer-implemented method of claim 1 , wherein the code for performing the custom response action includes code for interacting with an external application.
3. The computer-implemented method of claim 1 , wherein the input defining the adaptive response further includes a configuration for parameters of the custom response action.
4. The computer-implemented method of claim 1 , wherein the input defining the custom response action is received via an editing panel of a graphical user interface.
5. The computer-implemented method of claim 4 , further comprising displaying, via the editing panel of the graphical user interface, output generated based on testing of the custom response action.
6. A non-transitory computer-readable storage medium storing instructions that, when executed by one or more processors, cause performance of operations comprising:
receiving input defining a custom response action to be executed by a network security application in response to a detection of a potential security incident in an information technology (IT) environment, wherein the input specifies a command to be sent to a device or service related to the network security application in response to the detection of the potential security incident in the IT environment, and wherein the input defining the custom response action further comprises a script file that includes code for performing the custom response action;
generating a package containing executable logic for the custom response action;
sending the package to an application programming interface (API) or other component;
receiving a determination that the package conforms to one or more standards for executing actions within the network security application;
based on receiving the determination that the package conforms to one or more standards for executing actions within the network security application, applying the package to an instance of the network security application;
receiving input defining an adaptive response, wherein the input identifies:
a correlation search used to identify notable events from event data stored by a data intake and query system, wherein the data intake and query system includes event data from a plurality of input data sources in the IT environment, and
the custom response action to be executed by the network security application in response to the detection of the potential security incident in the IT environment;
executing, by the data intake and query system, the correlation search against the event data stored by the data intake and query system;
identifying a notable event based on executing the correlation search against the event data stored by the data intake and query system; and
executing the custom response action based on identifying the notable event, wherein executing the custom response action comprises running the script file.
7. The non-transitory computer-readable storage medium of claim 6 ,
wherein the code for performing the custom response action includes code for interacting with an external application.
8. The non-transitory computer-readable storage medium of claim 6 , wherein the input defining the adaptive response further includes a configuration for parameters of the custom response action.
9. The non-transitory computer-readable storage medium of claim 6 , wherein the input defining the custom response action is received via an editing panel of a graphical user interface.
10. The non-transitory computer-readable storage medium of claim 9 , wherein the instructions comprise further instructions that, when executed by the one or more processors, cause performance of further operations comprising displaying, via the editing panel of the graphical user interface, output generated based on testing of the custom response action.
11. An apparatus, comprising:
one or more processors; and
a non-transitory computer-readable storage medium coupled to the one or more processors, the non-transitory computer-readable storage medium storing instructions that, when executed by the one or more processors, cause the apparatus to:
receive input defining a custom response action to be executed by a network security application in response to a detection of a potential security incident in an information technology (IT) environment, wherein the input specifies a command to be sent to a device or service related to the network security application in response to the detection of the potential security incident in the IT environment, and wherein the input defining the custom response action further comprises a script file that includes code for performing the custom response action;
generate a package containing executable logic for the custom response action;
send the package to an application programming interface (API) or other component;
receive a determination that the package conforms to one or more standards for executing actions within the network security application;
based on receiving the determination that the package conforms to one or more standards for executing actions within the network security application, apply the package to an instance of the network security application;
receive input defining an adaptive response, wherein the input identifies:
a correlation search used to identify notable events from event data stored by a data intake and query system, wherein the data intake and query system includes event data from a plurality of input data sources in the IT environment, and
the custom response action to be executed by the network security application in response to the detection of the potential security incident in the IT environment;
execute, by the data intake and query system, the correlation search against the event data stored by the data intake and query system;
identify a notable event based on executing the correlation search against the event data stored by the data intake and query system; and
execute the custom response action based on identifying the notable event, wherein executing the custom response action comprises running the script file.
12. The apparatus of claim 11 , wherein the code for performing the custom response action includes code for interacting with an external application.
13. The apparatus of claim 11 , wherein the input defining the adaptive response further includes a configuration for parameters of the custom response action.
14. The apparatus of claim 11 , wherein the input defining the custom response action is received via an editing panel of a graphical user interface.
15. The apparatus of claim 14 , wherein the instructions comprise further instructions that, when executed by the one or more processors, cause performance of further operations comprising displaying, via the editing panel of the graphical user interface, output generated based on testing of the custom response action.