Systems, methods, and graphical user interfaces for configuring and implementing computer-executable detection instructions in a cybersecurity threat detection and mitigation platform
A system, method, and computer-program product includes obtaining a third-party security event of a subscriber, generating a technology source-agnostic security event signal for the third-party security event based on routing the third-party security event to an event normalization service, identifying a technology source-agnostic security event signal type that corresponds to the technology source-agnostic security event signal based on generating the technology source-agnostic security event signal, retrieving a corpus of computer-executable detection instructions digitally mapped to the technology source-agnostic security event signal type based on querying a detection instructions retrieval application programming interface (API), assessing the technology source-agnostic security event signal against each computer-executable detection instruction included in the corpus of computer-executable detection instructions, and generating, via the one or more processors, a prospective security alert based on the technology source-agnostic security event signal satisfying a set of alerting conditions of one of the computer-executable detection instructions.
1. A computer-implemented method for accelerating a detection of a cybersecurity threat, the method comprising:
obtaining, via one or more processors, a third-party security event that involves a digital asset or computing asset of a subscriber;
generating a technology source-agnostic security event signal for the third-party security event based on routing the third-party security event to an event normalization service;
identifying, via the one or more processors, a technology source-agnostic security event signal type that corresponds to the technology source-agnostic security event signal in response to generating the technology source-agnostic security event signal;
retrieving, via the one or more processors, a corpus of computer-executable detection instructions digitally mapped to the technology source-agnostic security event signal type based on querying a detection instructions retrieval application programming interface (API);
assessing, via the one or more processors, the technology source-agnostic security event signal against each computer-executable detection instruction included in the corpus of computer-executable detection instructions;
generating, via the one or more processors, a prospective security alert based on the technology source-agnostic security event signal satisfying a set of alerting conditions of one of the computer-executable detection instructions of the corpus of computer-executable detection instructions; and
instantiating, via the one or more processors, a detection-building graphical user interface for constructing a target automated detection instruction based on receiving a request from a user, wherein the detection-building graphical user interface includes:
a plurality of detection-identifying user interface input elements configured to receive, from the user, one or more strings of text that characterize the target automated detection instruction, and
a set of user interface buttons, that when operated, is configured to control whether the target automated detection instruction is used for only the subscriber or across all subscribers subscribing to a cybersecurity event detection and response service.
2. The computer-implemented method according to claim 1 , wherein:
the one of the computer-executable detection instructions of the corpus of computer-executable detection instructions is configured to assign a predetermined degree of threat severity to the prospective security alert based on the technology source-agnostic security event signal satisfying the set of alerting conditions of the one of the computer-executable detection instructions,
the one of the computer-executable detection instructions of the corpus of computer-executable detection instructions is configured to assign a predetermined alert name to the prospective security alert based on the technology source-agnostic security event signal satisfying the set of alerting conditions of the one of the computer-executable detection instructions, and
the one of the computer-executable detection instructions of the corpus of computer-executable detection instructions is configured to assign a predetermined security threat classification or attack strategy to the prospective security alert based on the technology source-agnostic security event signal satisfying the set of alerting conditions of the one of the computer-executable detection instructions.
3. The computer-implemented method according to claim 1 , further comprising:
assessing, via the one or more processors, the prospective security alert against a corpus of computing environment data of the subscriber;
determining, via the one or more processors, the prospective security alert involves a critical computing asset of the subscriber based on assessing the prospective security alert against the corpus of computing environment data of the subscriber; and
routing, via the one or more processors, the prospective security alert to an alert queue based on the prospective security alert being a valid security alert.
4. The computer-implemented method according to claim 1 , further comprising:
assessing, via the one or more processors, the prospective security alert against one or more alert suppression instructions configured for the subscriber;
identifying, via the one or more processors, the prospective security alert as a suppressible alert based on the prospective security alert satisfying one of the one or more alert suppression instructions; and
routing, via the one or more processors, the prospective security alert to an alert disposal queue based on the prospective security alert being identified as the suppressible alert.
5. The computer-implemented method according to claim 1 , wherein:
the third-party security event is one of:
a raw security event obtained from a security information and event management (SIEM) security device associated with the subscriber,
a raw security event obtained from a third-party security device or third-party security application, and
a raw security event obtained from a cloud-based security device that is configured to monitor a cloud environment of the subscriber.
6. The computer-implemented method according to claim 1 , wherein:
each distinct computer-executable detection instruction of the corpus of computer-executable detection instructions is configured to assess the technology source-agnostic security event signal against a distinct set of predefined alerting conditions, and
each distinct computer-executable detection instruction of the corpus of computer-executable detection instructions is configured to generate a corresponding prospective security alert based on satisfying the distinct set of predefined alerting conditions associated with that distinct computer-executable detection instruction.
7. The computer-implemented method according to claim 6 , wherein:
the corpus of computer-executable detection instructions includes a first computer-executable detection instruction, a second computer-executable detection instruction, and a third computer-executable detection instruction,
the first computer-executable detection instruction is configured to generate a first type of prospective security alert based on the technology source-agnostic security event signal satisfying the distinct set of predefined alerting conditions of the first computer-executable detection instruction,
the second computer-executable detection instruction is configured to generate a second type of prospective security alert based on the technology source-agnostic security event signal satisfying the distinct set of predefined alerting conditions of the second computer-executable detection instruction,
the third computer-executable detection instruction is configured to generate a third type of prospective security alert based on the technology source-agnostic security event signal satisfying the distinct set of predefined alerting conditions of the third computer-executable detection instruction, and
the first type of prospective security alert, the second type of prospective security alert, and the third type of prospective security alert each correspond to a distinct type of prospective security alert.
8. The computer-implemented method according to claim 1 , wherein:
the corpus of computer-executable detection instructions digitally mapped to the technology source-agnostic security event signal type includes a first plurality of computer-executable detection instructions,
a second corpus of computer-executable detection instructions digitally mapped to a second technology source-agnostic security event signal type includes a second plurality of computer-executable detection instructions, and
a total number of computer-executable detection instructions included in the corpus of computer-executable detection instructions is different from a total number of computer-executable detection instructions included in the second corpus of computer-executable detection instructions.
9. The computer-implemented method according to claim 1 , wherein:
querying the detection instructions retrieval application programming interface (API) includes automatically constructing, via the one or more processors, an API call that includes the technology source-agnostic security event signal type as a search parameter, and
receiving the corpus of computer-executable detection instructions digitally mapped to the technology source-agnostic security event signal type is further based on executing the API call.
10. The computer-implemented method according to claim 1 , wherein:
a first subset of computer-executable detection instructions of the corpus of computer-executable detection instructions includes a set of heuristics-based detection instructions, and
a second subset of computer-executable detection instructions of the corpus of computer-executable detection instructions includes a set of machine learning-based detection instructions that includes using one or more machine learning models.
11. The computer-implemented method according to claim 1 , wherein:
the detection-building graphical user interface further includes an automated investigations control button that, when selected, is configured to display a drop-down menu element of a plurality of alert taxonomies,
the automated investigations control button is configured to receive a selection, from the user, of one of the plurality of alert taxonomies, and
the target automated detection instruction, when executed, is configured to execute a set of automated investigation workflows digitally mapped to the one of the plurality of alert taxonomies based on receiving the selection of the one of the plurality of alert taxonomies from the user.
12. The computer-implemented method according to claim 1 , further comprising:
instantiating, via the detection-building graphical user interface, a detection instruction simulation container based on receiving an input, from the user, selecting a detection simulation addition control button of the detection-building graphical user interface, wherein the detection instruction simulation container is configured to receive, from the user, input of:
a sample raw event generated by a target third-party security service or a target third-party security application for validating that the target automated detection instruction is executed correctly in response to normalizing the sample raw event and providing the normalized sample raw event to the target automated detection instruction.
13. The computer-implemented method according to claim 1 , further comprising:
instantiating, via the detection-building graphical user interface, a detection instruction execution container based on receiving an input, from the user, selecting a detection instruction execution control button of the detection-building graphical user interface, wherein the detection instruction execution container includes:
a signal type user interface element that, when selected, displays a drop-down menu element of a plurality of technology source-agnostic event signal types provided by the cybersecurity event detection and response service, and
one or more condition-setting user interface elements being configured to receive inputs of characters that define one or more alert generation conditions that must be satisfied prior to generating a subject prospective security alert using the target automated detection instruction.
14. The computer-implemented method according to claim 1 , further comprising:
instantiating, via the detection-building graphical user interface, a detection instruction response container based on receiving an input, from the user, selecting a detection instruction response control button of the detection-building graphical user interface, wherein the detection instruction response container includes:
a set of user interface input elements configured to receive user input specifying alert attributes of the subject prospective security alert, wherein the set of user interface input elements includes:
a first user interface input element configured to receive an input of an alert name that is assigned to the subject prospective security alert when the one or more alert generation conditions are satisfied,
a second user interface input element configured to receive an input of a degree of threat severity that is assigned to the subject prospective security alert when the one or more alert generation conditions are satisfied, and
a third user interface input element configured to receive an input of a security threat classification or attack strategy that is assigned to the subject prospective security alert when the one or more alert generation conditions are satisfied.
15. A computer-program product embodied in a non-transitory machine-readable storage medium storing computer instructions that, when executed by one or more processors, perform operations comprising:
receiving a third-party security event that involves a digital asset or computing asset of a subscriber;
generating a technology source-agnostic security event signal for the third-party security event based on routing the third-party security event to an event normalization service;
identifying a technology source-agnostic security event signal type corresponding to the technology source-agnostic security event signal in response to generating the technology source-agnostic security event signal;
obtaining a corpus of computer-executable detection instructions digitally mapped to the technology source-agnostic security event signal type based on querying a detection instructions retrieval application programming interface (API);
assessing the technology source-agnostic security event signal against each computer-executable detection instruction included in the corpus of computer-executable detection instructions;
generating at least one prospective security alert based on the technology source-agnostic security event signal satisfying a set of alerting conditions of at least one of the computer-executable detection instructions of the corpus of computer-executable detection instructions; and
instantiating a detection-building graphical user interface for constructing a target automated detection instruction based on receiving a request from a user, wherein the detection-building graphical user interface includes:
a plurality of detection-identifying user interface input elements configured to receive, from the user, one or more strings of text that characterize the target automated detection instruction, and
a set of user interface buttons, that when operated, is configured to control whether the target automated detection instruction is used for only the subscriber or across all subscribers subscribing to a cybersecurity event detection and response service.
16. The computer-program product according to claim 15 , wherein:
generating the at least one prospective security alert includes generating a first prospective security alert of a first type and a second prospective security alert of a second type that is different than the first type,
the at least one of the computer-executable detection instructions of the corpus of computer-executable detection instructions generates the first prospective security alert and the second prospective security alert.
17. The computer-program product according to claim 15 , wherein:
generating the at least one prospective security alert includes:
generating a first prospective security alert of a first type based on satisfying a set of alerting conditions of a first computer-executable detection instruction of the corpus of computer-executable detection instructions,
generating a second prospective security alert of a second type based on satisfying a set of alerting conditions of a second computer-executable detection instruction of the corpus of computer-executable detection instructions, and
the first computer-executable detection instruction and the second computer-executable detection instruction are different computer-executable detection instructions.
18. The computer-program product according to claim 15 , wherein:
the corpus of computer-executable detection instructions only includes computer-executable detection instructions that are configured to evaluate subject technology source-agnostic security event signals of the technology source-agnostic security event signal type.
19. The computer-program product according to claim 15 , wherein:
the technology source-agnostic security event signal is processable by the cybersecurity event detection and response service irrespective of a third-party security device or service from which the third-party security event originated.