Systems and methods for providing integrated security management

A system for providing integrated security management, the system comprising:

• an identification module, stored in memory, that identifies a computing environment protected by a plurality of security systems and monitored by a security management system that receives event signatures from each of the plurality of security systems, wherein the plurality of security systems includes a first security system and a second security system that respectively use a first naming scheme and a second naming scheme to name event signatures, the first and second naming schemes differing from each other;
• an observation module, stored in memory, that observes a first event signature that originates from the first security system, the first event signature having been given a first event signature name by the first security system according to the first naming scheme;
• a determination module, stored in memory, that determines that the first event signature is equivalent to a second event signature that has been given a second event signature name by the second security system according to the second naming scheme, the second event signature name being different than the first event signature name;
• a performing module, stored in memory, that performs, in connection with observing the first event signature, a security action associated with the second event signature and directed to the computing environment based on determining that the first event signature is equivalent to the second event signature even though the first and second event signature names are different;
• and
• at least one physical processor configured to execute the identification module, the observation module, the determination module, and the performing module.

A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

• identify a computing environment protected by a plurality of security systems and monitored by a security management system that receives event signatures from each of the plurality of security systems, wherein the plurality of security systems includes a first security system and a second security system that respectively use a first naming scheme and a second naming scheme to name event signatures, the first and second naming schemes differing from each other;
• observe a first event signature that originates from the first security system, the first event signature having been given a first event signature name by the first security system according to the first naming scheme;
• determine that the first event signature is equivalent to a second event signature that has been given a second event signature name by the second security system according to the second naming scheme, the second event signature name being different than the first event signature name;
• and
• perform, in connection with observing the first event signature, a security action associated with the second event signature and directed to the computing environment based on determining that the first event signature is equivalent to the second event signature even though the first and second event signature names are different.