Near-real time dynamic cybersecurity inspection techniques
A system and method for near real time detection of cybersecurity threats in a computing environment. The method includes: detecting an event in a data log, the data log including a plurality of data records, each data record corresponding to at least an event; parsing a data record corresponding to the event to detect a data value; detecting a node in a security graph, the node corresponding to the detected data value, wherein the security graph includes a representation of the computing environment; initiating inspection of a resource corresponding to the node.
1 . A method for near real time detection of cybersecurity threats in a computing environment, comprising:
detecting at least a first event with a first timestamp and a second event with a second timestamp in a data log, the data log including a plurality of data records, including a first data record corresponding to the first event and a second data record corresponding to the second event;
parsing the first data record to detect a first data value;
parsing the second data record to detect a second data value;
detecting a node in a security graph, the node corresponding to any detected data value, wherein the security graph includes a representation of the computing environment, and wherein the first event and the second event are grouped based on condition that the first timestamp and the second timestamp are within a predetermined time window;
initiating inspection of a resource represented by the detected node.
2 . The method of claim 1 , further comprising:
detecting any of the events in the data log based on an event type, wherein any of the events includes a predetermined event type.
3 . The method of claim 1 , further comprising:
generating an inspectable disk based on a disk of the resource; and
configuring an inspector to inspect the inspectable disk for a cybersecurity threat.
4 . The method of claim 1 , further comprising:
generating a query for the security graph based on the detected data value; and
detecting the node in the security graph by executing the query.
5 . The method of claim 1 , further comprising:
initiating a mitigation action based on any of the detected events.
6 . The method of claim 1 , further comprising:
detecting a cybersecurity threat on the resource corresponding to the node.
7 . The method of claim 6 , further comprising:
generating a node in the security graph to represent the cybersecurity threat; and
generating a connection between the node representing the cybersecurity threat and the node representing the resource.
8 . The method of claim 6 , further comprising:
updating a second node connected to the detected node in response to determining that any of the detected events is of a first event type.
9 . The method of claim 1 , further comprising:
determining a reachability path to the resource; and
initiating active inspection of the resource based on the reachability path.
10 . A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:
detecting at least a first event with a first timestamp and a second event with a second timestamp in a data log, the data log including a plurality of data records, including a first data record corresponding to the first event and a second data record corresponding to the second event;
parsing the first data record to detect a first data value;
parsing the second data record to detect a second data value;
detecting a node in a security graph, the node corresponding to any detected data value, wherein the security graph includes a representation of a computing environment, and wherein the first event and the second event are grouped based on condition that the first timestamp and the second timestamp are within a predetermined time window;
initiating inspection of a resource represented by the detected node.
11 . A system for near real time detection of cybersecurity threats in a computing environment, comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
detect at least a first event with a first timestamp and a second event with a second timestamp in a data log, the data log including a plurality of data records, including a first data record corresponding to the first event and a second data record corresponding to the second event;
parse the first data record to detect a first data value;
parse the second data record to detect a second data value;
detect a node in a security graph, the node corresponding to any detected data value, wherein the security graph includes a representation of the computing environment, and wherein the first event and the second event are grouped based on condition that the first timestamp and the second timestamp are within a predetermined time window;
initiate inspection of a resource represented by the detected node.
12 . The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configures the system to:
detect any of the events in the data log based on an event type, wherein any of the events includes a predetermined event type.
13 . The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configures the system to:
generate an inspectable disk based on a disk of the resource; and
configure an inspector to inspect the inspectable disk for a cybersecurity threat.
14 . The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configures the system to:
generate a query for the security graph based on the detected data value; and
detect the node in the security graph by executing the query.
15 . The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configures the system to:
initiate a mitigation action based on any of the detected events.
16 . The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configures the system to:
detect a cybersecurity threat on the resource corresponding to the node.
17 . The system of claim 16 , wherein the memory contains further instructions which when executed by the processing circuitry further configures the system to:
generate a node in the security graph to represent the cybersecurity threat; and
generate a connection between the node representing the cybersecurity threat and the node representing the resource.
18 . The system of claim 16 , wherein the memory contains further instructions which when executed by the processing circuitry further configures the system to:
update a second node connected to the detected node in response to determining that any of the detected events is of a first event type.
19 . The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configures the system to:
determine a reachability path to the resource; and
initiate active inspection of the resource based on the reachability path.