Security information and event management system employing security business objects and workflows
A security information and event management (SIEM) system includes a data storage sub-system that stores (1) security data pertaining to security-related events and states of a production computer system, (2) security business objects (SBOs) as an abstraction layer over the security data, and (3) workflows which each include a set of the SBOs organized in a workflow-specific manner. Each SBO represents a security-related aspect of the production system and includes data queries to generate output data pertaining to the security-related aspect. Each workflow embodies a complex multi-step security analysis operation. In operation, security users of the SIEM system execute the workflows including the respective security business objects, resulting in a set of result data which identifies security threats and vulnerabilities of the production computer system. A workflow can provide additional contextualization for detected events, including asset data regarding the configuration of hosts in the data processing system which can be used to generate recommendations for remedial action, such as applying certain software patches to address a threat.
1. A security information and event management system, comprising:
a data storage sub-system operative to store (1) security data from one or more sources, the security data pertaining to security-related events and states of a production computer system, (2) a collection of security business objects serving as an abstraction layer over the security data, each security business object representing a respective security-related aspect of the production system and including a respective set of queries of the sources of security data to generate respective output security data pertaining to the respective security-related aspect, the security business objects including (i) threat/attack objects including respective queries and logical operations on event data describing events in the production computer system, (ii) vulnerability objects including respective queries and logical operations on vulnerability data describing vulnerabilities of the production computer system, and (iii) asset objects including respective queries and logical operations on asset data describing configuration of assets in the production computer system, and (3) a collection of security workflows each including a respective set of the security business objects organized in a respective workflow-specific manner, each security workflow embodying a respective complex and multi-step security analysis operation with respect to the production computer system, at least one of the security workflows including a threat/attack object, a vulnerability object and an asset object arranged in user-specified sequence with output security data of one object serving as input security data to a next succeeding object; and
processing circuitry operative in response to user input to execute the security workflows including the respective security business objects, the execution of each security workflow resulting in a corresponding set of result data stored in the data storage sub-system, the result data identifying one or more security threats and system-specific vulnerability information regarding vulnerability of the production computer system to the security threats.
2. A security information and event management system according to claim 1 , employing a unified data ontology by which the security business objects reference the security data, the unified data ontology providing a single set of content, meaning and structure for the security data across all the sources.
3. A security information and event management system according to claim 1 , wherein the security business objects include respective processing routines providing respective functions selected from data filtering, data seeking, and data transformation.
4. A security information and event management system according to claim 1 , wherein each security workflow includes one or more context security business objects providing system-specific contextualization of a respective threat, the contextualization including vulnerability context data from which the vulnerability information in the result data is derived.
5. A security information and event management system according to claim 1 , wherein the security business objects of each workflow are functionally arranged such that output data from one or more of the security business objects serves as input data to a respective other one or ones of the security business objects, and each security business object performs a respective logical operation on its input data to generate its output data.
6. A security information and event management system according to claim 1 , wherein the security data is collected from the production computer system and includes data describing detected activities in the production computer system that may have security implications.
7. A security information and event management system according to claim 3 , wherein the security business objects are each arranged to obtain and process the security data pertaining to a respective distinct one of the security threats or a respective distinct one of a set of vulnerabilities of the production computer system to the security threats.
8. A security information and event management system according to claim 3 , wherein the security business objects include trigger-type security business objects and context-type security business objects, the processing routine of each trigger-type security business object employing gathered security data to direct continuing operation to a next step in a workflow, the processing routine of each context-type security business object operating to enrich security data gathered in one or more trigger-type security business objects in a workflow.
9. A security information and event management system according to claim 3 , wherein the security business objects are user-definable by user of the system.
10. A security information and event management system according to claim 4 , wherein the contextualization includes software asset data regarding a software configuration of a computer of the production computer system, the asset data identifying a patch level of the software configuration and used by a security business object of the workflow to generate a recommendation regarding installation of a software patch to address the respective security threat.
11. A security information and event management system according to claim 5 , wherein the workflows are user-definable by users of the system by selection and arrangement of existing security business objects.
12. A security information and event management system according to claim 6 , wherein the security data includes data collected from network event sources in the production computer system including application firewalls and intrusion detection sensors.
13. A method of operating a security information and event management system, comprising:
storing, in a data storage sub-system, (1) security data from one or more sources, the security data pertaining to security-related events and states of a production computer system, (2) a collection of security business objects serving as an abstraction layer over the security data, each security business object representing a respective security-related aspect of the production system and including a respective set of queries of the sources of security data to generate respective output security data pertaining to the respective security-related aspect, the security business objects including (i) threat/attack objects including respective queries and logical operations on event data describing events in the production computer system, (ii) vulnerability objects including respective queries and logical operations on vulnerability data describing vulnerabilities of the production computer system, and (iii) asset objects including respective queries and logical operations on asset data describing configuration of assets in the production computer system, and (3) a collection of security workflows each including a respective set of the security business objects organized in a respective workflow-specific manner, each security workflow embodying a respective complex and multi-step security analysis operation with respect to the production computer system, at least one of the security workflows including a threat/attack object, a vulnerability object and an asset object arranged in a user-specified sequence with output security data of one object serving as input security data to a next succeeding object; and
by processing circuitry in response to user input, executing the security workflows including the respective security business objects, the execution of each security workflow resulting in a corresponding set of result data stored in the data storage sub-system, the result data identifying one or more security threats and system-specific vulnerability information regarding vulnerability of the production computer system to the security threats.
14. A method according to claim 13 , employing a unified data ontology by which the security business objects reference the security data, the unified data ontology providing a single set of content, meaning and structure for the security data across all the sources.
15. A method according to claim 13 , wherein the security business objects include respective processing routines providing respective functions selected from data filtering, data seeking, and data transformation.
16. A method according to claim 13 , wherein each security workflow includes one or more context security business objects providing system-specific contextualization of a respective threat, the contextualization including vulnerability context data from which the vulnerability information in the result data is derived.
17. A method according to claim 13 , wherein the security business objects of each workflow are functionally arranged such that output data from one or more of the security business objects serves as input data to a respective other one or ones of the security business objects, and each security business object performs a respective logical operation on its input data to generate its output data.
18. A method according to claim 15 , wherein the security business objects are each arranged to obtain and process the security data pertaining to a respective distinct one of the security threats or a respective distinct one of a set of vulnerabilities of the production computer system to the security threats.
19. A method according to claim 15 , wherein the security business objects include trigger-type security business objects and context-type security business objects, the processing routine of each trigger-type security business object employing gathered security data to direct continuing operation to a next step in a workflow, the processing routine of each context-type security business object operating to enrich security data gathered in one or more trigger-type security business objects in a workflow.
20. A method according to claim 15 , wherein the security business objects are user-definable by user of the system.
21. A method according to claim 16 , wherein the contextualization includes software asset data regarding a software configuration of a computer of the production computer system, the asset data identifying a patch level of the software configuration and used by a security business object of the workflow to generate a recommendation regarding installation of a software patch to address the respective security threat.
22. A method according to claim 17 , wherein the workflows are user-definable by users of the system by selection and arrangement of existing security business objects.