Systems and methods for providing an integrated cyber threat defense exchange platform

1. A computer-implemented method, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

receiving, at an integrated cyber threat defense exchange platform, unnormalized security data from a plurality of disparate security data sources, wherein the disparate security data sources generate the unnormalized security data in differing formats;

normalizing, by the integrated cyber threat defense exchange platform using a security data schema, the unnormalized security data into normalized security data;

identifying, by the integrated cyber threat defense exchange platform, a security action that is responsive to at least one security event identified within the normalized security data; and

coordinating, by the integrated cyber threat defense exchange platform, performance of the security action within a plurality of networked computing devices;

wherein:

the plurality of disparate security data sources comprises at least three of a web security service (WSS) device, a cloud access security broker (CASB) device, an endpoint detection and response (EDR) device, a security analytics device, a malware analysis (MA) device, a data loss prevention (DLP) device, a data center security (DCS) device, and an endpoint protection (EP) device;

an integrated cyber threat defense exchange bus communicatively couples the integrated cyber threat defense exchange platform with a security information event management integration device and a secure ecosystem; and

the security data schema provides a target data structure onto which values and corresponding fields from different mutually-inconsistent security data sources are mapped.

2. The computer-implemented method of claim 1 , further comprising enabling the integrated cyber threat defense exchange platform to leverage knowledge of a threat from a first security data source to improve the security of a second security data source.

3. The computer-implemented method of claim 2 , wherein the first security data source and the second security data source are provided by different vendors.

4. The computer-implemented method of claim 1 , further comprising filtering the normalized security data onto a data storage device.

5. The computer-implemented method of claim 1 , wherein the integrated cyber threat defense exchange platform is in communication with a Security Operations Center (SOC).

6. The computer-implemented method of claim 5 , wherein the Security Operations Center exchanges security event data, security action data, and security intelligence data with the plurality of disparate security data sources through the integrated cyber threat defense exchange platform.

7. The computer-implemented method of claim 6 , wherein an administrator is enabled to interface with the Security Operations Center using a Security Operations Center front-end.

8. The computer-implemented method of claim 1 , wherein the integrated cyber threat defense exchange bus communicatively couples the integrated cyber threat defense exchange platform with a Security Operations Center workbench.

9. The computer-implemented method of claim 1 , wherein the unnormalized security data comprises data from the plurality of disparate security data sources that records values for one or more of the same attributes in different formats such that data recorded by one of the plurality of disparate security data sources is not readable by another one of the plurality of disparate security data sources.

10. The computer-implemented method of claim 1 , wherein the security data schema provides a consistent and unified security data recording convention for recording security data that was previously recorded using different and mutually-inconsistent recording formats.

11. A system comprising:

at least one physical processor;

a physical memory comprising computer-executable instructions that, when executed by the physical processor, cause the physical processor to:

receive, at an integrated cyber threat defense exchange platform, unnormalized security data from a plurality of disparate security data sources, wherein the disparate security data sources generate the unnormalized security data in differing formats;

normalize, by the integrated cyber threat defense exchange platform using a security data schema, the unnormalized security data into normalized security data;

identify, by the integrated cyber threat defense exchange platform, a security action that is responsive to at least one security event identified within the normalized security data; and

coordinate, by the integrated cyber threat defense exchange platform, performance of the security action within a plurality of networked computing devices;

wherein:

the plurality of disparate security data sources comprises at least three of a web security service (WSS) device, a cloud access security broker (CASB) device, an endpoint detection and response (EDR) device, a security analytics device, a malware analysis (MA) device, a data loss prevention (DLP) device, a data center security (DCS) device, and an endpoint protection (EP) device;

an integrated cyber threat defense exchange bus communicatively couples the integrated cyber threat defense exchange platform with a security information event management integration device and a secure ecosystem; and

the security data schema provides a target data structure onto which values and corresponding fields from different mutually-inconsistent security data sources are mapped.

12. The system of claim 11 , wherein the unnormalized security data comprises at least one of security event data, security action data, and security intelligence data.

13. The system of claim 11 , wherein the computer-executable instructions further cause the physical processor to:

parse, the unnormalized security data received from the plurality of disparate security data sources;

filter, the normalized security data onto a first data storage device; and

archive, the normalized security data onto a second data storage device.

14. The system of claim 11 , wherein receiving the unnormalized security data comprises receiving the unnormalized security data from at least one networked computing device that:

detects the security event;

records the unnormalized security data based at least in part on detection of the security event; and

transmits the unnormalized security data to the integrated cyber threat defense exchange platform.

15. The system of claim 14 , wherein the security event is triggered at least in part by a cyberattack.

16. The system of claim 11 , wherein the unnormalized security data comprises at least one of a license activity report, a software application behavior report, a report of user activity at a management console, a report of a user-specified configuration change at the management console, a device activity report, a network activity report, a result from a diagnostic routine, an evidence of compromise (EoC) event report including an EoC query, and an EoC event report including a remediation record.

17. The system of claim 11 , wherein the unnormalized security data schema comprises a superset of security data attributes from a plurality of different security data points.

18. The system of claim 17 , wherein each attribute from the superset of security data attributes is listed in an attribute dictionary stored in a data storage device.

19. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

receive, at an integrated cyber threat defense exchange platform, unnormalized security data from a plurality of disparate security data sources, wherein the disparate security data sources generate the unnormalized security data in differing formats;

normalize, by the integrated cyber threat defense exchange platform, using a security data schema, the unnormalized security data into normalized security data;

identify, by the integrated cyber threat defense exchange platform, a security action that is responsive to at least one security event identified within the normalized security data; and

coordinate, by the integrated cyber threat defense exchange platform, performance of the security action within a plurality of networked computing devices;

wherein:

the plurality of disparate security data sources comprises at least three of a web security service (WSS) device, a cloud access security broker (CASB) device, an endpoint detection and response (EDR) device, a security analytics device, a malware analysis (MA) device, a data loss prevention (DLP) device, a data center security (DCS) device, and an endpoint protection (EP) device;

an integrated cyber threat defense exchange bus communicatively couples the integrated cyber threat defense exchange platform with a security information event management integration device and a secure ecosystem; and

the security data schema provides a target data structure onto which values and corresponding fields from different mutually-inconsistent security data sources are mapped.

20. The non-transitory computer-readable medium of claim 19 , wherein the computer-executable instructions further cause the computing device to:

parse the unnormalized security data received from the plurality of disparate security data sources;

filter the normalized security data onto a first data storage device; and

archive the normalized security data onto a second data storage device.