Enterprise network threat detection
In a threat management platform, a number of endpoints log events in an event data recorder. A local agent filters this data and feeds a filtered data stream to a central threat management facility. The central threat management facility can locally or globally tune filtering by local agents based on the current data stream, and can query local event data recorders for additional information where necessary or helpful in threat detection or forensic analysis. The central threat management facility also stores and deploys a number of security tools such as a web-based user interface supported by machine learning models to identify potential threats requiring human intervention and other models to provide human-readable context for evaluating potential threats.
1. A computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, performs the steps of:
identifying a file within an enterprise network with an identifier based on a hash of the file;
monitoring activity within the enterprise network to obtain a record of activities for one or more instances of the file, the record including a history of execution for the file and information for identifying compute instances where the file was executed, and the record further including a number of locations of the file within the enterprise network and mapping a presence or absence of features in the file to one or more corresponding features from a set of similar safe samples and a set of similar unsafe samples;
storing the record in a database along with the identifier for the file;
detecting a suspicious activity associated with the file, the suspicious activity indicating a reputation of the file between safe and malicious;
presenting the identifier of the file to an analyst in a user interface, the user interface configured to present a list of suspicious files to the analyst and support investigation of the file by presenting to the analyst the mapping of the presence or absence of features in the file to one or more corresponding features from the set of similar safe samples and the set of similar unsafe samples;
receiving a disposition of the file as malicious or non-malicious from the analyst; and
in response to the disposition, removing the file from the list of suspicious files.
2. The computer program product of claim 1 further comprising code that performs the step of, when the analyst disposes of the file by indicating that the file is malicious, remediating a first location of execution of the file in the history of execution.
3. The computer program product of claim 1 further comprising code that performs the step of, when the analyst disposes of the file by indicating that the file is malicious, remediating each of the number of locations of the file stored in the record.
4. The computer program product of claim 1 wherein the number of locations include a machine and a path for each of the one or more instances of the file.
5. The computer program product of claim 1 wherein the history of execution includes a time and place of a first execution of the file in the enterprise network.
6. The computer program product of claim 1 wherein the record includes one or more network connections associated with the file.
7. The computer program product of claim 6 wherein the one or more network connections include at least one connection created by a process executing from the file.
8. The computer program product of claim 6 wherein the one or more network connections include at least one connection used to transfer the file to a location within the enterprise network.
9. The computer program product of claim 1 further comprising code that performs the step of aging the record out of the database after a predetermined interval.
10. The computer program product of claim 1 further comprising code that performs the step of returning the file to the list of suspicious files upon a detection of a second suspicious activity by the file occurring after the disposition.
11. The computer program product of claim 10 further comprising code that performs the step of presenting a history of dispositions and one or more associated analysts in the user interface.
12. The computer program product of claim 11 further comprising code that performs the step of receiving an override of the disposition by a second analyst.
13. A method comprising:
identifying a file within an enterprise network;
monitoring activity within the enterprise network to obtain a record of activities for the file, the record including a history of execution for the file and information for identifying compute instances where the file was executed, and the record further including a number of locations of the file within the enterprise network and mapping a presence or absence of features in the file to one or more corresponding features from a set of similar safe samples and a set of similar unsafe samples;
detecting a suspicious activity associated with the file;
presenting an identifier of the file to an analyst in a user interface, the user interface configured to present a list of suspicious files to the analyst and support investigation of the file by presenting to the analyst the mapping of the presence or absence of features in the file to one or more corresponding features from the set of similar safe samples and the set of similar unsafe samples;
receiving a disposition of the file as malicious or non-malicious from the analyst; and
in response to the disposition, removing the file from the list of suspicious files.
14. The method of claim 13 wherein the number of locations include a machine and a path for each instance of the file.
15. The method of claim 13 wherein the history of execution includes a time and place of a first execution of the file in the enterprise network.
16. The method of claim 13 further comprising monitoring one or more network connections associated with the file.
17. The method of claim 13 further comprising aging the record out of a database of monitored files after a predetermined interval.
18. The method of claim 13 further comprising returning the file to the list of suspicious files upon detection of a second suspicious activity by the file occurring after the disposition.
19. The method of claim 13 further comprising receiving an override of the disposition by a second analyst.
20. A system comprising:
a plurality of compute instances;
an enterprise network coupling the plurality of compute instances in a communicating relationship; and
a threat management facility for the enterprise network, the threat management facility including a processor and a memory storing code that, when executing on the processor, performs the steps of identifying a file within the enterprise network, monitoring activity within the enterprise network to obtain a record of activities for the file, the record including a history of execution for the file and information for identifying compute instances where the file was executed, mapping a presence or absence of features in the file to one or more corresponding features from a set of similar safe samples and a set of similar unsafe samples, detecting a suspicious activity associated with the file, presenting an identifier of the file to an analyst in a user interface, the user interface configured to present a list of suspicious files to the analyst and support investigation of the file by presenting to the analyst the mapping of the presence or absence of features in the file to one or more corresponding features from the set of similar safe samples and the set of similar unsafe samples, receiving a disposition of the file as malicious or non-malicious from the analyst, and in response to the disposition, removing the file from the list of suspicious files.