Security integration for cloud services
A threat management facility for an enterprise network integrates native threat management capabilities with threat data from a cloud service provider used by the enterprise. By properly authenticating to the cloud service and mapping data feeds from the cloud service to a native threat management environment, the threat management facility can extend threat detection and management capabilities beyond endpoint-centric techniques.
1 . A computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, causes the one or more computing devices to perform the steps of:
receiving, at a threat management facility, a first event stream of local threat data from a plurality of local security agents executing on a plurality of compute instances associated with an enterprise network;
storing the first event stream in a data lake according to a threat schema for the threat management facility;
authenticating the threat management facility to a cloud service provider that provides cloud computing facilities to users of the plurality of compute instances associated with the enterprise network;
receiving security data for the plurality of compute instances from the cloud service provider;
mapping the security data from the cloud service provider into a second event stream for the enterprise network, the second event stream conforming to the threat schema for the threat management facility used to store the first event stream of local threat data from the plurality of local security agents executing on the plurality of compute instances;
storing the second event stream in the data lake;
calculating a threat score for one of the plurality of compute instances based on data from the first event stream and the second event stream stored in the data lake; and
initiating a remediation of the one of the plurality of compute instances when the threat score meets a predetermined criterion; and
displaying the threat score in a user interface.
2 . The computer program product of claim 1 , wherein mapping the security data includes converting a data blob in the security data from the cloud service provider into a plurality of risk items in the threat schema.
3 . The computer program product of claim 1 , wherein the cloud service provider includes a cloud computing service hosting virtual compute instances for the enterprise network.
4 . The computer program product of claim 1 , wherein the cloud service provider includes an identity provider providing identity management and authentication services for the users of the plurality of compute instances associated with the enterprise network.
5 . The computer program product of claim 1 , wherein the cloud service provider includes a third party network security service for the users of the plurality of compute instances associated with the enterprise network.
6 . The computer program product of claim 1 , wherein the cloud service provider includes an electronic mail service provider for the users of the plurality of compute instances associated with the enterprise network.
7 . The computer program product of claim 1 , wherein the cloud service provider includes an application hosting provider for the users of the plurality of compute instances associated with the enterprise network.
8 . A method comprising:
receiving a first event stream of events based on local threat data from a plurality of compute instances in an enterprise network;
storing the first event stream in a data lake according to a threat schema;
authenticating to a cloud service provider for the plurality of compute instances in the enterprise network;
receiving security data for the plurality of compute instances from the cloud service provider;
mapping the security data from the cloud service provider into a second event stream for the enterprise network, the second event stream conforming to the threat schema used to store the first event stream based on local threat data from the plurality of compute instances;
storing the second event stream in the data lake;
calculating a threat score for one of the plurality of compute instances based on data from the first event stream and the second event stream stored in the data lake;
initiating a remediation of the one of the plurality of compute instances when the threat score meets a predetermined criterion; and
displaying the threat score in an administrative console of a threat management facility for the enterprise network.
9 . The method of claim 8 , wherein mapping the security data includes scaling one or more quantitative threat scores in the security data to a threat score range for the threat schema.
10 . The method of claim 8 , wherein mapping security data includes converting one or more threat types in the security data to a threat category for the threat schema.
11 . The method of claim 8 , wherein mapping security data includes transforming risk metadata in the security data into one or more context descriptors for the threat schema.
12 . The method of claim 8 , further comprising:
calculating a plurality of threat scores for a plurality of the compute instances based on the first event stream and the second event stream, and displaying one or more of the plurality of threat scores in the administrative console in an order ranked according to threat severity.
13 . The method of claim 8 , wherein the cloud service provider hosts one or more of an electronic mail application, a cloud storage service, a cloud computing service, a virtualization platform, and an authentication service.
14 . The method of claim 8 , further comprising augmenting the second event stream with additional security data from one or more third party security data providers.
15 . The method of claim 8 , wherein the second event stream includes contextual data for a suspected threat, the contextual data including one or more of classification information for the suspected threat, a network location associated with the suspected threat, a path for the suspected threat, a filename for the suspected threat, a process name for the suspected threat, and a machine identifier for the suspected threat.
16 . The method of claim 8 , wherein the cloud service provider hosts one or more of a web application, a zero trust network access resource, and a network monitor executing on a third-party firewall.
17 . The method of claim 8 , further comprising receiving contextual information for a suspected threat from a remote data source, the contextual information including one or more of classification information for the suspected threat, a network location associated with the suspected threat, and geolocation data for the suspected threat.
18 . A system comprising:
a plurality of compute instances associated with an enterprise network, each executing a local security agent that provides event data to a first event stream; and
a threat management facility for the enterprise network, the threat management facility implemented by at least one hardware processor and configured to:
receive the first event stream of event data from local security agents executing on the plurality of compute instances;
store the first event stream in a data lake according to a threat schema for the threat management facility;
authenticate to a cloud service provider that provides cloud computing facilities to users of the plurality of compute instances;
receive security data for the plurality of compute instances from the cloud service provider;
map the security data from the cloud service provider into a second event stream for the enterprise network, the second event stream conforming to the threat schema used by the threat management facility to store the first event stream based on local threat data from the plurality of compute instances, wherein mapping the security data includes scaling one or more quantitative threat scores in the security data to a threat score range for the threat schema, converting one or more threat types in the security data to a threat category for the threat schema, and transforming risk metadata in the security data into one or more context descriptors for the threat schema;
store the second event stream in the data lake;
calculate a composite threat score indicative of a security risk of one of the plurality of compute instances based on data from the first event stream and the second event stream stored in the data lake;
initiate a remediation of the one of the plurality of compute instances when the composite threat score meets a predetermined criterion; and
display the composite threat score in a user interface.
19 . The system of claim 18 , wherein the cloud service provider includes one or more of an application hosting platform, a communication platform, an identity management platform, and a remote security services platform.
20 . The system of claim 18 , wherein mapping the security data includes converting a data blob in the security data from the cloud service provider into a plurality of risk items in the threat schema.