Back to results
US 10,834,120 B2Granted
Identifying related communication interactions to a security threat in a computing environment
AssigneeSplunk Inc.
InventorsSourabh Satish, Oliver Friedrichs, Atif Mahadik, Govind Salinas
Life of this patent
Estimating the term…
Abstract
Systems, methods, and software described herein provide security actions based on related security threat communications. In one example, a method of operating an advisement system includes identifying a security threat within the computing environment, wherein the computing environment comprises a plurality of computing assets. The method further provides obtaining descriptor information for the security threat, and retrieving related communication interactions based on the descriptor information. The method also includes generating a response to the security threat based on the related communication interactions.
Claims20
A computer-implemented method comprising:
- receiving, from a first computing asset of a computing environment comprising a plurality of computing assets, data indicating a security threat within the computing environment, the data identifying a first communication interaction associated with the security threat;
- identifying a characteristic of the first communication interaction;
- obtaining, from a second computing asset of the computing environment, one or more second communication interactions related to the first communication interaction, the one or more second communication interactions identified by the second computing asset based at least in part on the characteristic of the first communication interaction;
- identifying a network location contained in the one or more second communication interactions;
- obtaining enrichment information for the network location from a service external to the computing environment, the enrichment information indicating whether the network location is malicious;
- identifying an automated response based at least in part on the enrichment information;
- and
- initiating the automated response to mitigate the security threat in the computing environment, wherein initiating the automated response includes:
- identifying a connector associated with a computing asset involved in the automated response,
- using the connector to translate at least a portion of the automated response into an action to be performed by the computing asset in the computing environment, and
- causing the computing asset in the computing environment to perform the action.
8 more elements
An apparatus, comprising:
- one or more non-transitory computer readable media;
- and
- processing instructions stored on the one or more computer readable media that, when executed by a processing system, direct the processing system to:
- receive, from a first computing asset of a computing environment comprising a plurality of computing assets, data indicating a security threat within the computing environment, the data identifying a first communication interaction associated with the security threat;
- identify a characteristic of the first communication interaction;
- obtain, from a second computing asset of the computing environment, one or more second communication interactions related to the first communication interaction, the one or more second communication interactions identified by the second computing asset based at least in part on the characteristic of the first communication interaction;
- identify a network location contained in the one or more second communication interactions;
- obtain enrichment information for the network location from a service external to the computing environment, the enrichment information indicating whether the network location is malicious;
- identifying an automated response based at least in part on the enrichment information;
- and
- initiate the automated response to mitigate the security threat in the computing environment, wherein initiating the automated response includes:
- identifying a connector associated with a computing asset involved in the automated response,
- using the connector to translate at least a portion of the automated response into an action to be performed by the computing asset in the computing environment, and
- causing the computing asset in the computing environment to perform the action.
11 more elements
A non-transitory computer-readable storage medium storing instructions which, when executed by one or more processors, cause performance of operations comprising:
- receiving, from a first computing asset of a computing environment comprising a plurality of computing assets, data indicating a security threat within the computing environment, the data identifying a first communication interaction associated with the security threat;
- identifying a characteristic of the first communication interaction;
- obtaining, from a second computing asset of the computing environment, one or more second communication interactions related to the first communication interaction, the one or more second communication interactions identified based at least in part on the characteristic of the first communication interaction;
- identifying a network location contained in the one or more second communication interactions;
- obtaining enrichment information for the network location from a service external to the computing environment, the enrichment information indicating whether the network location is malicious;
- identifying an automated response based at least in part on the enrichment information;
- and
- initiating an automated response to the security threat in the computing environment, wherein initiating the automated response includes:
- identifying a connector associated with a computing asset involved in the automated response,
- using the connector to translate at least a portion of the automated response into an action to be performed by the computing asset in the computing environment, and
- causing the computing asset in the computing environment to perform the action.
8 more elements
Dependencies are inferred from the claim text.