Data augmentation for threat investigation in an enterprise network
An endpoint in an enterprise network is instrumented with sensors to detect security-related events occurring on the endpoint. Event data from these sensors is augmented with contextual information about, e.g., a source of each event in order to facilitate improved correlation, analysis, and visualization at a threat management facility for the enterprise network.
1 . A computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, performs the steps of:
receiving event data from a sensor on an endpoint, the event data responsive to an event on the endpoint, and the event data identifying the event;
in response to receiving the event data, precomputing, with the endpoint, a relationship between the event in a temporal context of the sensor and transient information including a local collection of causally related events, each of the causally related events causally related with the event and each of the causally related events associated with a source around a time of the event;
generating a mini-graph that characterizes the relationship precomputed between the event and the local collection of causally related events;
creating a modified event record that includes the mini-graph by joining the event data with the mini-graph that characterizes the relationship, precomputed in response to receiving the event data, between the event and the local collection of causally related events;
storing the modified event record in a data recorder on the endpoint;
transmitting the modified event record to a threat management facility; and
receiving data from the threat management facility for managing security for the endpoint based on the modified event record.
2 . The computer program product of claim 1 further comprising code that performs the step of storing a plurality of modified event records in the data recorder.
3 . The computer program product of claim 1 further comprising code that, when executing on the endpoint, performs the step of responding to a query from a resource external to the endpoint for data stored in the data recorder.
4 . The computer program product of claim 1 further comprising code that, when executing on the threat management facility, performs the step of providing a user interface for navigating a chain of events based on relationships among a plurality of modified event records received at the threat management facility.
5 . The computer program product of claim 1 further comprising code that, when executing on the threat management facility, performs the step of processing a stream of modified event records to evaluate security threats to an enterprise network.
6 . The computer program product of claim 1 further comprising code that performs the step of processing a stream of modified event records at the threat management facility to evaluate a security state of the endpoint.
7 . A method comprising:
instrumenting an endpoint with a sensor and a local security agent, the sensor configured to generate an event record in response to and identifying an event, the event record identifying the event, and the local security agent configured to locally receive the event record from the sensor;
in response to receiving the event record, precomputing, with the endpoint, a relationship between the event and transient information including a local collection of causally related events;
creating a modified event record by appending a mini-graph to the event record that characterizes the relationship, precomputed in response to receiving the event record, between the event and the local collection of causally related events,
thereby providing the modified event record including the mini-graph;
transmitting the modified event record to a threat management facility; and
receiving data from the threat management facility for managing security for the endpoint based on the event and the local collection of causally related events, as identified in the modified event record.
8 . The method of claim 7 further comprising determining a relationship of the modified event record with one or more other modified event records stored at the threat management facility based on a source identifier in the mini-graph.
9 . The method of claim 7 further comprising determining a relationship of a source identifier in the mini-graph with one or more other source identifiers based on a plurality of modified event records received at the threat management facility.
10 . The method of claim 7 wherein managing the security for the endpoint includes displaying the mini-graph from the threat management facility.
11 . The method of claim 7 further comprising providing a user interface for navigating the mini-graph of the modified event record.
12 . The method of claim 7 further comprising storing a plurality of modified event records on a data recorder for the endpoint, the data recorder configured to respond to queries for event data from the threat management facility.
13 . The method of claim 7 wherein the transient information includes a process identifier for a source of the event.
14 . The method of claim 7 wherein the transient information includes a process identifier for a source of one or more of the events in the local collection of causally related events.
15 . The method of claim 7 wherein the transient information includes a temporal address that includes an identifier for at least one of a user of the endpoint, a device associated with the endpoint, a path associated with a computing object on the endpoint, a process executing on the endpoint, and an application on the endpoint.
16 . The method of claim 7 further comprising processing a stream of modified event records at the threat management facility to evaluate security threats to an enterprise network.
17 . The method of claim 7 further comprising processing a stream of modified event records at the threat management facility to evaluate a security state of the endpoint.
18 . The method of claim 7 further comprising processing a stream of modified event records at the threat management facility to deduplicate one or more event records based on a reconciliation of sources of the local collection of causally related events.
19 . A system comprising a local security agent embodied in computer executable code stored in a non-transitory computer readable medium that, when executing on a computing device of an endpoint, causes the local security agent to perform the steps of:
receiving data characterizing and identifying an event from a sensor on the endpoint;
generating an event record in response to the event;
in response to generating the event record, precomputing, with the endpoint, a relationship between the event and transient information including a local collection of causally related events;
creating a modified event record by appending a mini-graph to the event record that characterizes the relationship, precomputed in response to generating the event record, between the event and the local collection of causally related events,
thereby providing the modified event record including the mini-graph;
transmitting the modified event record to a threat management facility; and
receiving data from the threat management facility for managing security for the endpoint based on the relationship precomputed between the event and the local collection of causally related events, as identified in the modified event record.
20 . The system of claim 19 further comprising the threat management facility configured to receive a stream of modified event records from a plurality of endpoints in an enterprise network that includes the endpoint, and to evaluate security threats to the enterprise network based on the stream of the modified event records.