Enterprise graph method of threat detection

A system for analyzing security alerts, comprising:

• an enterprise graph service, executed by a processor of a server associated with the enterprise, that generates an enterprise graph based on information associated with an enterprise for identifying relationships between computers of the enterprise, wherein the relationship are based on an architecture and function performed in the enterprise;
• a first computer comprising:
• a first memory;
• and
• a first processor in communication with the first memory, wherein the first processor executes a first security component, wherein the first security component generates a first security alert regarding the enterprise;
• a second computer comprising:
• a second memory;
• and
• a second processor in communication with the second memory, wherein the second processor executes a second security component, wherein the second security component generates a second security alert regarding the enterprise;
• a server in communication with the first computer and the second computer, the server comprises:
• a third memory;
• and
• a third processor in communication with the third memory, wherein the third processor:
• identifies a significant relationship, based on the enterprise graph, between the first security alert and the second security alert, wherein the significant relationship is identified in the enterprise graph and corresponds with at least the first security alert and the second security alert;
• and
• executes a kill chain interpreter, wherein the kill chain interpreter:
• identifies a potential security incident based on the significant relationship between the first security alert and the second security alert and based on a strength of the relationship between the first computer and the second computer;
• ranks the first security alert, the second security alert, and a third security alert, wherein the third security alert is not associated with the potential security incident;
• prioritizes the first security alert and the second security alert over the third security alert based on identifying the first security alert and the second security alert with the potential security incident;
• presents the first and second security alerts of the potential security incident as a chain of events, wherein the first security alert and the second security alert form the chain of events, which is compared to a criteria of attack to determine the security incident, and wherein the relationship helps define the chain of events;
• and
• concludes that the potential security incident is an actual attack.

A non-transitory computer-readable storage medium including instructions for analyzing security alerts, which when executed by a processor are operable to execute a method, the method comprising:

• generating an enterprise graph based on information associated with an enterprise, wherein the enterprise graph identifies relationships between computers of the enterprise, wherein the relationships are based on an architecture and function performed in the enterprise;
• receiving a first security alert produced by a first security component associated with a first computer of the enterprise;
• receiving a second security alert produced by a second security component associated with a second computer of the enterprise;
• based on the enterprise graph, determining a strength of a relationship between the first computer and the second computer;
• identifying a significant relationship between the first and second security alerts and based on the strength of the relationship between the first computer and the second computer;
• identifying a potential security incident based on the significant relationship between the first and second security alerts;
• ranking the first security alert, the second security alert, and a third security alert, wherein the third security alert is not associated with a potential security incident;
• prioritizing the first security alert and the second security alert over the third security alert based on identifying the first security alert and the second security alert with the potential security incident;
• presenting the first and second security alerts of the potential security incident as a chain of events, wherein the first security alert and the second security alert form the chain of events, which is compared to a criteria of attack to determine the security incident, and wherein the relationship helps define the chain of events;
• and
• concluding that the potential security incident is an actual attack.