Configurable cyber-attack trackers

A computer-implemented method comprising:

• detecting, with a signal processor operably coupled to at least one of a messaging component and an application component, a signal relevant to a threat;
• categorizing, with a threat categorization component, the detected signal to generate a categorized threat according to a type of threat, wherein the type of threat is a threat selected from the group comprising malware, viruses, and phishing attacks;
• storing the categorized threat in a threat data store;
• providing a user interface that include a threat parameter selection component configured to receive a threat parameter user input;
• receiving, via the threat parameter selection component, a selected threat parameter;
• providing a threat value user input element configured to receive user input specifying a threat value for the threat parameter user input;
• receiving, via the threat value user input component, a threat value for the selected threat parameter;
• providing a timing user input element configured to receive user input specifying a time window;
• receiving, via the timing user input element, a timing input specifying a specific time window;
• saving a tracker defined by the selected threat parameter, the threat value, and the timing input;
• in response to detecting a tracker triggering event,
• executing, by the saved tracker, a query against the threat data store, the query selecting categorized threat data in the threat data store based on the selected threat parameter and the threat value for the selected threat parameter;
• and
• based on the query, determining a number of threat instances, within the specified time window in the detected computing activity, that correspond to the selected threat parameter and the threat value for the selected threat parameter;
• and
• selectively generating an action based on whether the number of threat instances within the specified time window exceeds a user-defined threshold.

A computer-implemented method comprising:

• detecting, with a signal processor operably coupled to at least one of a messaging component and an application component, a threat signal relevant to a threat;
• categorizing, with a threat categorization component, the threat signal according to a type of threat to generate a categorized threat, wherein the type of threat is a threat selected from the group comprising malware, viruses, and phishing attacks;
• storing the categorized threat in a threat data store;
• accessing a tracker definition to identify a threat parameter, threat parameter value, and specific threat timing information;
• using the tracker definition to query the threat data store and identify categorized threat information in the threat data store as a tracker result that indicates a number of threat instances, in the threat data store, that correspond to the threat parameter, the threat parameter value, and the threat timing information;
• determining that the number of threat instances exceeds a user-defined threshold;
• and selectively generating a remedial action based on the determination.