System and method for contextually analyzing potential cyber security threats

1. A method implemented by a computer for contextually analyzing potential cyber security threats in a computer network, comprising:

receiving at least one security event for the computer network, wherein the at least one security event is associated with at least one entity, wherein an entity is a computing arrangement coupled to the network and associated with an organization;

parsing the at least one security event;

modeling, based on at least one modeling rule selected from a set of a plurality of modeling rules, the at least one parsed security event, the modeling being such as to identify each of the at least one entity involved in an event, and to determine at least one characteristic of the at least one security event, the at least one characteristic including at least one relationship characteristic of relationships among each of the at least one entity identified as being involved in the event;

retrieving, based on the modeled events and by interfacing with external systems, enrichment information respective of the at least one characteristic;

enriching the determined at least one characteristic using the enrichment information;

unifying the at least one characteristic and the enrichment information into a data set having a single unified format; and

generating a graph based on the unified format data set, wherein the graph represents the relationships among the at least one entity.

2. The method of claim 1 , further comprising:

upon receiving a new event, gradually updating the generated graph based on the received new security event.

3. The method of claim 1 , further comprising:

generating an analysis report based on the graph.

4. The method of claim 2 , further comprising:

causing a display of the generated graph; and

causing a display of a drilled-down portion of the graph, wherein drilled-down portion includes at least one entity of interest.

5. The method of claim 1 , further comprising:

receiving a plurality of cases; and

grouping the plurality of cases, the grouping being based on the generated graph.

6. The method of claim 1 , wherein the at least one relationship characteristic includes at least one relationship type, wherein each relationship type is any of: user to user, user to host, host to host, and self event.

7. The method of claim 6 , wherein the modeling includes determining the at least one relationship type based on a connection type between primary entities involved in each event.

8. A non-transitory computer readable medium having stored thereon instructions for causing one or more processing units to execute a process for contextually analyzing potential cyber security threats in a computer network, the process comprising:

receiving at least one security event for the computer network, wherein the at least one security event is associated with at least one entity, wherein an entity is a computing arrangement coupled to the network and associated with an organization;

parsing the at least one security event;

modeling, based on at least one modeling rule selected from a set of a plurality of modeling rules, the at least one parsed security event, the modeling being such as to identify each of the at least one entity involved in an event, and to determine at least one characteristic of the at least one security event, the at least one characteristic including at least one relationship characteristic of relationships among each of the at least one entity identified as being involved in the event;

retrieving, based on the modeled events and by interfacing with external systems, enrichment information respective of the at least one characteristic;

enriching the determined at least one characteristic using the enrichment information;

unifying the at least one characteristic and the enrichment information into a data set having a single unified format; and

generating a graph based on the unified format data set, wherein the graph represents the relationships among the at least one entity.

9. A system for contextually analyzing potential security threats in a computer network, comprising:

a hardware processing unit; and

a memory, the memory containing instructions that, when executed by the processing unit, configure the system to:

receiving at least one security event for the computer network, wherein the at least one security event is associated with at least one entity, wherein an entity is a computing arrangement coupled to the network and associated with an organization;

parsing the at least one security event;

modeling, based on at least one modeling rule selected from a set of a plurality of modeling rules, the at least one parsed security event, the modeling being such as to identify each of the at least one entity involved in an event, and to determine at least one characteristic of the at least one security event, the at least one characteristic including at least one relationship characteristic of relationships among each of the at least one entity identified as being involved in the event;

retrieving, based on the modeled events and by interfacing with external systems, enrichment information respective of the at least one characteristic;

enriching the determined at least one characteristic using the enrichment information;

unifying the at least one characteristic and the enrichment information into a data set having a single unified format; and

generating a graph based on the unified format data set, wherein the graph represents the relationships among the at least one entity.

10. The system of claim 9 , wherein the system is further configured to:

upon receiving a new security event, gradually update the generated graph based on the received new event.

11. The system of claim 9 , wherein the system is further configured to:

generate an analysis report based on the graph.

12. The system of claim 10 , wherein the system is further configured to:

cause a display of the generated graph; and

cause a display of a drilled-down portion of the graph, wherein drilled-down portion includes at least one entity of interest.

13. The system of claim 9 , wherein the system is further configured to:

receive a plurality of cases; and

group the plurality of cases using the generated graph.