Threat mitigation system and method
A computer-implemented method, computer program product and computing system for receiving a plurality of detection events concerning a plurality of security events occurring on a security-relevant subsystem within a computing platform; identifying two or more associated detection events included within the plurality of detection events; and grouping the two or more associated detection events to define a security incident.
1 . A computer-implemented method, executed on a computing device, comprising:
receiving a plurality of detection events concerning a plurality of security events occurring on a security-relevant subsystem within a computing platform;
identifying two or more associated detection events included within the plurality of detection events;
grouping the two or more associated detection events to define a security incident;
receiving one or more additional detection events concerning one or more additional security events occurring on the security-relevant subsystem within the computing platform; and
adding the one or more additional detection events to the security incident if the one or more additional detection events are related to the two or more associated detection events;
normalizing the plurality of detection events into a common ontology, wherein the normalizing the plurality of detection events into a common ontology includes: translating a syntax of each of the plurality of detection events into a common syntax; and
translating the common syntax of a unified query to a syntax of each of plurality of subsystem-specific queries and each of the plurality of subsystem-specific queries has a specific structure and nomenclature;
distributing each of the plurality of subsystem-specific queries to the security relevant systems;
executing each of the plurality of subsystem-specific queries generates respective subsystem-specific result sets;
aggregating and combining, by a threat mitigation process, the respective subsystem-specific result sets to homogenize and produce a unified result set;
effectuating one or more remedial operations using the unified result set and based on an assigned threat level.
2 . The computer-implemented method of claim 1 wherein the plurality of security events includes one or more of:
Denial of Service (DoS) events;
Distributed Denial of Service DDoS events;
Man-in-the-Middle (MitM) events;
phishing events;
Password Attack events;
SQL Injection events;
Cross-Site Scripting (XSS) events;
Insider Threat events;
spamming events;
malware events;
web attacks; and
exploitation events.
3 . The computer-implemented method of claim 1 wherein the security-relevant subsystem includes one or more of:
CDN (i.e., Content Delivery Network) systems;
DAM (i.e., Database Activity Monitoring) systems;
UBA (i.e., User Behavior Analytics) systems;
MDM (i.e., Mobile Device Management) systems;
IAM (i.e., Identity and Access Management) systems;
DNS (i.e., Domain Name Server) systems;
Antivirus systems;
operating systems;
data lakes;
data logs;
security-relevant software applications;
security-relevant hardware systems; and
resources external to the computing platform.
4 . The computer-implemented method of claim 1 wherein one or more artifacts/log entries are associated with each of the plurality of detection events.
5 . The computer-implemented method of claim 4 wherein identifying two or more associated detection events included within the plurality of detection events includes:
identifying two or more detection events included within the plurality of detection events that have common artifacts/log entries.
6 . The computer-implemented method of claim 4 wherein grouping the two or more associated detection events into a security incident includes:
grouping the one or more artifacts/log entries associated with each of the two or more associated detection events to form an artifact/log entry set for the security incident.
7 . The computer-implemented method of claim 1 further comprising:
receiving one or more additional detection events concerning one or more additional security events occurring on the security-relevant subsystem within the computing platform; and
adding the one or more additional detection events to the security incident if the one or more additional detection events are related to the two or more associated detection events.
8 . The computer-implemented method of claim 1 wherein the plurality of security events are detected on the security-relevant subsystem using one or more detection rules executed on the security-relevant subsystem.
9 . A computer program product residing on a non-transitory computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:
receiving a plurality of detection events concerning a plurality of security events occurring on a security-relevant subsystem within a computing platform;
identifying two or more associated detection events included within the plurality of detection events; grouping the two or more associated detection events to define a security incident;
receiving one or more additional detection events concerning one or more additional security events occurring on the security-relevant subsystem within the computing platform; and
adding the one or more additional detection events to the security incident if the one or more additional detection events are related to the two or more associated detection events;
normalizing the plurality of detection events into a common ontology, wherein normalizing the plurality of detection events into a common ontology includes: translating a syntax of each of the plurality of detection events into a common syntax; and
translating the common syntax of a unified query to a syntax of each of plurality of subsystem-specific queries and each of the plurality of subsystem-specific queries has a specific structure and nomenclature;
distributing each of the plurality of subsystem-specific queries to the security relevant systems;
executing each of the plurality of subsystem-specific queries generates respective subsystem-specific result sets;
aggregating and combining, by a threat mitigation process, the respective subsystem-specific result sets to homogenize and produce a unified result set;
effectuating one or more remedial operations using the unified result set and based on an assigned threat level.
10 . The computer program product of claim 9 wherein the plurality of security events includes one or more of:
Denial of Service (DoS) events;
Distributed Denial of Service DDoS events;
Man-in-the-Middle (MitM) events;
phishing events;
Password Attack events;
SQL Injection events;
Cross-Site Scripting (XSS) events;
Insider Threat events;
spamming events;
malware events;
web attacks; and
exploitation events.
11 . The computer program product of claim 9 wherein the security-relevant subsystem includes one or more of:
CDN (i.e., Content Delivery Network) systems;
DAM (i.e., Database Activity Monitoring) systems;
UBA (i.e., User Behavior Analytics) systems;
MDM (i.e., Mobile Device Management) systems;
IAM (i.e., Identity and Access Management) systems;
DNS (i.e., Domain Name Server) systems;
Antivirus systems;
operating systems;
data lakes;
data logs;
security-relevant software applications;
security-relevant hardware systems; and
resources external to the computing platform.
12 . The computer program product of claim 9 wherein one or more artifacts/log entries are associated with each of the plurality of detection events.
13 . The computer program product of claim 12 wherein identifying two or more associated detection events included within the plurality of detection events includes:
identifying two or more detection events included within the plurality of detection events that have common artifacts/log entries.
14 . The computer program product of claim 12 wherein grouping the two or more associated detection events into a security incident includes:
grouping the one or more artifacts/log entries associated with each of the two or more associated detection events to form an artifact/log entry set for the security incident.
15 . The computer program product of claim 9 further comprising:
receiving one or more additional detection events concerning one or more additional security events occurring on the security-relevant subsystem within the computing platform; and
adding the one or more additional detection events to the security incident if the one or more additional detection events are related to the two or more associated detection events.
16 . The computer program product of claim 9 wherein the plurality of security events are detected on the security-relevant subsystem using one or more detection rules executed on the security-relevant subsystem.
17 . A computing system including a processor and memory configured to perform operations comprising:
receiving a plurality of detection events concerning a plurality of security events occurring on a security-relevant subsystem within a computing platform;
identifying two or more associated detection events included within the plurality of detection events; grouping the two or more associated detection events to define a security incident;
receiving one or more additional detection events concerning one or more additional security events occurring on the security-relevant subsystem within the computing platform; and
adding the one or more additional detection events to the security incident if the one or more additional detection events are related to the two or more associated detection events;
normalizing the plurality of detection events into a common ontology, wherein normalizing the plurality of detection events into a common ontology includes: translating a syntax of each of the plurality of detection events into a common syntax; and
translating the common syntax of a unified query to a syntax of each of plurality of subsystem-specific queries and each of the plurality of subsystem-specific queries has a specific structure and nomenclature;
distributing each of the plurality of subsystem-specific queries to the security relevant systems;
executing each of the plurality of subsystem-specific queries generates respective subsystem-specific result sets;
aggregating and combining, by a threat mitigation process, the respective subsystem-specific result sets to homogenize and produce a unified result set;
effectuating one or more remedial operations using the unified result set and based on an assigned threat level.
18 . The computing system of claim 17 wherein the plurality of security events includes one or more of:
Denial of Service (DoS) events;
Distributed Denial of Service DDoS events;
Man-in-the-Middle (MitM) events;
phishing events;
Password Attack events;
SQL Injection events;
Cross-Site Scripting (XSS) events;
Insider Threat events;
spamming events;
malware events;
web attacks; and
exploitation events.
19 . The computing system of claim 17 wherein the security-relevant subsystem includes one or more of:
CDN (i.e., Content Delivery Network) systems;
DAM (i.e., Database Activity Monitoring) systems;
UBA (i.e., User Behavior Analytics) systems;
MDM (i.e., Mobile Device Management) systems;
IAM (i.e., Identity and Access Management) systems;
DNS (i.e., Domain Name Server) systems;
Antivirus systems;
operating systems;
data lakes;
data logs;
security-relevant software applications;
security-relevant hardware systems; and
resources external to the computing platform.
20 . The computing system of claim 17 wherein one or more artifacts/log entries are associated with each of the plurality of detection events.
21 . The computing system of claim 20 wherein identifying two or more associated detection events included within the plurality of detection events includes:
identifying two or more detection events included within the plurality of detection events that have common artifacts/log entries.
22 . The computing system of claim 20 wherein grouping the two or more associated detection events into a security incident includes:
grouping the one or more artifacts/log entries associated with each of the two or more associated detection events to form an artifact/log entry set for the security incident.
23 . The computing system of claim 17 further comprising:
receiving one or more additional detection events concerning one or more additional security events occurring on the security-relevant subsystem within the computing platform; and
adding the one or more additional detection events to the security incident if the one or more additional detection events are related to the two or more associated detection events.
24 . The computing system of claim 17 wherein the plurality of security events are detected on the security-relevant subsystem using one or more detection rules executed on the security-relevant subsystem.