Systems and methods for asset based event prioritization for remote endpoint security
Systems and methods for event threat prioritization are provided. In some embodiments, an event priority engine receives event data detected by event agents executing on devices. The events are prioritized and ranked according to threat scores for events generated according to threat indicators which are fed event data and threat data. In some embodiments, security systems may take the approach of prioritizing events based on the endpoints from which they originate using attributes associated with those endpoints. In this way, events can be prioritized at least in part based on the damage to the enterprise that may occur if those events were to compromise security, not just the likelihood of those events actually resulting in a security breach.
1. A system for evaluating event priority for events on devices, comprising:
a processor;
a non-transitory computer-readable medium; and
stored instructions translatable by the processor for executing an event priority engine, wherein the event priority engine is coupled over a network to a plurality of devices, wherein the event priority engine is configured to:
receive events from the plurality of devices, the events occurring over the plurality of devices, each device executing an event agent to detect the events on the plurality of devices;
receive threat data from a plurality of threat data systems, the plurality of threat data systems generating the threat data;
define a plurality of threat indicators, each threat indicator being associated with a threat indicator weight, wherein the plurality of threat indicators being designed to detect and prioritize event threats;
for each received event:
determine a count of occurrences of sensitive data on each device by scanning each device;
generate a threat score for each received event based on values of the threat indicators and the threat indicator weights;
modify the threat score for each received event based on the count of occurrences of sensitive data on a respective device associated with the received event;
rank the events by priority according to the modified threat score generated for each received event.
2. The system of claim 1 , wherein each threat indicator has a threat indicator criticality set to critical or non-critical, each threat indicator value further modified by the threat indicator criticality.
3. The system of claim 2 , wherein the event priority engine receives input indicating at least one of: a modification to one of the threat indicator weights and, a modification to one of the threat indicator criticalities.
4. The system of claim 1 , wherein the modified threat score for each received event is a final threat score, the event priority engine further generating an initial threat score for each received event based on the event data:
the event priority engine querying at least one threat data system for threat data and, in response to the querying, receiving the threat data from the at least one threat data system;
the event priority engine regenerating the values of the threat indicators based on the received threat data; and
the event priority engine further generating the final threat score based on the initial threat score and the regenerated values of the threat indicators.
5. The system of claim 4 , wherein the received threat data is stored in a threat database coupled to the event priority engine, the event priority engine copying the threat data into the threat database and querying the threat database for the threat data.
6. The system of claim 4 , wherein the received threat data is stored in a threat data cache of the event priority engine, the event priority engine copying the threat data into the threat data cache and querying the threat data cache for the threat data.
7. The system of claim 1 , wherein one of the events reflects a modification to one of the devices, the event priority engine sending the modification to at least one of the threat data systems and, in response, the event priority engine receiving modified threat data based on the modification.
8. A method for evaluating event priority for events-on devices, comprising:
receiving events from a plurality of devices, each device executing an event agent to detect the events on the plurality of devices;
receiving, at an event priority engine, threat data from a plurality of threat data systems coupled to the event priority engine;
defining a plurality of threat indicators, each threat indicator being associated with a threat indicator weight, the threat indicators being designed to detect and prioritize event threats;
for each received event:
determine a count of occurrences of sensitive data on each device by scanning each device;
generate a threat score for each received event based on values of the threat indicators and the threat indicator weights;
modify the threat score for each received event based on the count of occurrences of sensitive data on a respective device associated with the received event;
rank the events by priority according to the modified threat score generated for each received event.
9. The method of claim 8 , wherein each threat indicator has a threat indicator criticality set to critical or non-critical, each threat indicator value further modified by the threat indicator criticality.
10. The method of claim 9 , further comprising:
receiving, at the event priority engine, input indicating at least one of: a modification to one of the threat indicator weights and, a modification to one of the threat indicator criticalities.
11. The method of claim 8 , wherein the modified threat score for each received event is a final threat score, further comprising:
generating an initial threat score for each received event based on the event data;
querying at least one threat data system for threat data and, in response, receiving the threat data from the at least one threat data system;
regenerating the values of the threat indicators based on the received threat data; and
generating the final threat score based on the initial threat score and the regenerated values of the threat indicators.
12. The method of claim 11 , wherein the received threat data is stored in a threat database coupled to the event priority engine, further comprising: copying the threat data into the threat database; and querying the threat database for the threat data.
13. The method of claim 11 , wherein the received threat data is stored in a threat data cache of the event priority engine, further comprising: copying the threat data into the threat data cache; and querying the threat data cache for the threat data.
14. The method of claim 8 , wherein one of the events reflects a modification to one of the devices, further comprising: sending the modification to at least one of the threat data systems, the event priority engine, in response, receiving modified threat data based on the modification.
15. A computer programming product comprising a non-transitory computer-readable medium storing instructions translatable by a processor for:
receiving events from a plurality of devices, each device executing an event agent to detect the events on the plurality of devices;
receiving, at an event priority engine, threat data from a plurality of threat data systems coupled to the event priority engine;
defining a plurality of threat indicators, each threat indicator being associated with a threat indicator weight, the threat indicators being designed to detect and prioritize event threats;
for each received event:
determine a count of occurrences of sensitive data on each device by scanning each device;
generate a threat score for each received event based on values of the threat indicators and the threat indicator weights;
modify the threat score for each received event based on the count of occurrences of sensitive data on a respective device associated with the received event;
rank the events by priority according to the modified threat score generated for each received event.
16. The computer programming product of claim 15 , wherein each threat indicator has a threat indicator criticality set to critical or non-critical, each threat indicator value further modified by the threat indicator criticality.
17. The computer programming product of claim 16 , wherein the event priority engine receives input indicating at least one of: a modification to one of the threat indicator weights and, a modification to one of the threat indicator criticalities.
18. The computer programming product of claim 15 , wherein the modified threat score for each received event is a final threat score and the event priority engine further:
generates an initial threat score for each received event based on the event data, queries at least one threat data systems for threat data and, in response, receives the threat data from the at least one threat data system;
regenerates the values of the threat indicators based on the received threat data; and
generates the final threat score based on the initial threat score and the regenerated values of the threat indicators.
19. The computer programming product of claim 18 , wherein the received threat data is stored in a threat database coupled to the event priority engine and is stored in a threat data cache of the event priority engine, the event priority engine further: queries one of: the threat database for the threat data or, the threat data cache for the threat data.
20. The computer programming product of claim 15 , wherein one of the events reflects a modification to one of the devices, the modification sent to at least one of the threat data systems, the event priority engine, in response, receiving modified threat data based on the modification.