Connected security system
First Claim
1. A system comprising:
- an event management device adapted to;
receive, for a network of an organization, network domain activity that includes first domain activity data from a first network domain and second domain activity from a second network domain;
identify malicious activity present on at least one of the first network domain or the second network domain based on the received network domain activity;
determine whether the malicious activity indicates a new attack pattern that is not identified by data in a pattern database by comparing the malicious activity with attack patterns identified by data in the pattern database; and
in response to determining that the malicious activity indicates a new attack pattern that is not identified by data in the pattern database;
generate one or more first data constructs of a predefined data structure that each include data that identifies the malicious activity; and
store the one or more first data constructs in the pattern database;
a threat intelligence device connected to the event management device and adapted to;
receive, from the event management device, the one or more first data constructs of the predefined data structure that identify the malicious activity;
in response to receiving the one or more first data constructs of the predefined data structure that identify the malicious activity;
determine, using the one or more first data constructs that identify the malicious activity, whether additional data related to the identified malicious activity is available from one or more third party sources; and
in response to determining that additional data related to the identified malicious activity is available from the one or more third party sources, generate, using the data identifying the malicious activity and the additional data, one or more second data constructs of the predefined data structure that include data describing (i) a campaign of related malicious activity in which at least a portion of the malicious activity is involved and (ii) one or more courses of action for mitigating the campaign of related malicious activity, wherein each of the one or more second data constructs are different data constructs from and comprise different data than each of the one or more first data constructs, and the campaign of related malicious activity is a) by a common malicious actor as an actor for the malicious activity, b) with common tactics, techniques, and procedures as those of the malicious activity, c) with common observables as those of the malicious activity, or d) with common security incidents to those of the malicious activity; and
a course of action device connected to the threat intelligence device and adapted to;
receive the one or more second data constructs from the threat intelligence device; and
implement, for the network for the organization and using the one or more second data constructs, a given course of action of the one or more courses of action.
1 Assignment
0 Petitions
Accused Products
Abstract
Systems, methods, and apparatus, including computer programs encoded on computer storage media, for obtaining, processing, and presenting data related to security events, and for implementing courses of action to protect assets in response to the security events. An event management module identifies malicious activity present on a first network domain and/or a second network domain based on received network domain activity. A threat intelligence module receives data identifying the malicious activity in first data constructs of a predefined data structure. The threat intelligence module obtains additional data related to the identified malicious activity and generates second data constructs that include enriched data regarding the malicious activity. The enriched data includes data describing a campaign in which at least a portion of the malicious activity is involved and one or more courses of action. A course of action module receives the second data constructs and implements a given course of action.
-
Citations
17 Claims
-
1. A system comprising:
-
an event management device adapted to; receive, for a network of an organization, network domain activity that includes first domain activity data from a first network domain and second domain activity from a second network domain; identify malicious activity present on at least one of the first network domain or the second network domain based on the received network domain activity; determine whether the malicious activity indicates a new attack pattern that is not identified by data in a pattern database by comparing the malicious activity with attack patterns identified by data in the pattern database; and in response to determining that the malicious activity indicates a new attack pattern that is not identified by data in the pattern database; generate one or more first data constructs of a predefined data structure that each include data that identifies the malicious activity; and store the one or more first data constructs in the pattern database; a threat intelligence device connected to the event management device and adapted to; receive, from the event management device, the one or more first data constructs of the predefined data structure that identify the malicious activity; in response to receiving the one or more first data constructs of the predefined data structure that identify the malicious activity; determine, using the one or more first data constructs that identify the malicious activity, whether additional data related to the identified malicious activity is available from one or more third party sources; and in response to determining that additional data related to the identified malicious activity is available from the one or more third party sources, generate, using the data identifying the malicious activity and the additional data, one or more second data constructs of the predefined data structure that include data describing (i) a campaign of related malicious activity in which at least a portion of the malicious activity is involved and (ii) one or more courses of action for mitigating the campaign of related malicious activity, wherein each of the one or more second data constructs are different data constructs from and comprise different data than each of the one or more first data constructs, and the campaign of related malicious activity is a) by a common malicious actor as an actor for the malicious activity, b) with common tactics, techniques, and procedures as those of the malicious activity, c) with common observables as those of the malicious activity, or d) with common security incidents to those of the malicious activity; and a course of action device connected to the threat intelligence device and adapted to; receive the one or more second data constructs from the threat intelligence device; and implement, for the network for the organization and using the one or more second data constructs, a given course of action of the one or more courses of action. - View Dependent Claims (2, 3, 4, 13, 14, 15, 16, 17)
-
-
5. A computer-implemented method comprising:
-
receiving, by an event management device and for a network of an organization, network domain activity that includes first domain activity data from a first network domain and second domain activity from a second network domain; identifying, by the event management device, malicious activity present on at least one of the first network domain or the second network domain based on the received network domain activity; determining whether the malicious activity indicates a new attack pattern that is not identified by data in a pattern database by comparing the malicious activity with attack patterns identified by data in the pattern database; in response to determining that the malicious activity indicates a new attack pattern that is not identified by data in the pattern database; generating, by the event management device, one or more first data constructs of a predefined data structure that each include data that identifies the malicious activity; and storing, by the event management device, the one or more first data constructs in the pattern database; receiving, by a threat intelligence device and from the event management device, the one or more first data constructs of the predefined data structure that identify the malicious activity; in response to receiving the one or more first data constructs of the predefined data structure that identify the malicious activity; determining, by the threat intelligence device and using the one or more first data constructs that identify the malicious activity, whether additional data related to the identified malicious activity is available from one or more third party sources; and in response to determining that additional data related to the identified malicious activity is available from the one or more third party sources, generating, by the threat intelligence device and using the data identifying the malicious activity and the additional data, one or more second data constructs of the predefined data structure that include data describing (i) a campaign of related malicious activity in which at least a portion of the malicious activity is involved and (ii) one or more courses of action for mitigating the campaign of related malicious activity, wherein each of the one or more second data constructs are different data constructs from and comprise different data than each of the one or more first data constructs, and the campaign of related malicious activity is a) by a common malicious actor as an actor for the malicious activity, b) with common tactics, techniques, and procedures as those of the malicious activity, c) with common observables as those of the malicious activity, or d) with common security incidents to those of the malicious activity; receiving, by a course of action device, the one or more second data constructs from the threat intelligence device; and implementing, by the course of action device for the network for the organization and using the one or more second data constructs, a given course of action of the one or more courses of action. - View Dependent Claims (6, 7, 8)
-
-
9. A non-transitory computer-readable storage medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
-
receiving, by an event management device and for a network of an organization, network domain activity that includes first domain activity data from a first network domain and second domain activity from a second network domain; identifying, by the event management device, malicious activity present on at least one of the first network domain or the second network domain based on the received network domain activity; determining whether the malicious activity indicates a new attack pattern that is not identified by data in a pattern database by comparing the malicious activity with attack patterns identified by data in the pattern database; in response to determining that the malicious activity indicates a new attack pattern that is not identified by data in the pattern database; generating, by the event management device, one or more first data constructs of a predefined data structure that each include data that identifies the malicious activity; and storing, by the event management device, the one or more first data constructs in the pattern database; receiving, by a threat intelligence device and from the event management device, the one or more first data constructs of the predefined data structure that identify the malicious activity; in response to receiving the one or more first data constructs of the predefined data structure that identify the malicious activity; determining, by the threat intelligence device and using the one or more first data constructs that identify the malicious activity, whether additional data related to the identified malicious activity is available from one or more third party sources; and in response to determining that additional data related to the identified malicious activity is available from the one or more third party sources, generating, by the threat intelligence device and using the data identifying the malicious activity and the additional data, one or more second data constructs of the predefined data structure that include data describing (i) a campaign of related malicious activity in which at least a portion of the campaign of related malicious activity is involved and (ii) one or more courses of action for mitigating the malicious activity, wherein the one or more second data constructs are different data constructs from and comprise different data than each of the one or more first data constructs, and the campaign of related malicious activity is a) by a common malicious actor as an actor for the malicious activity, b) with common tactics, techniques, and procedures as those of the malicious activity, c) with common observables as those of the malicious activity, or d) with common security incidents to those of the malicious activity; receiving, by a course of action device, the one or more second data constructs from the threat intelligence device; and implementing, by the course of action device for the network for the organization and using the one or more second data constructs, a given course of action of the one or more courses of action. - View Dependent Claims (10, 11, 12)
-
Specification