Platform and method for performing cybersecurity analyses employing an intelligence hub with a modular architecture

A system for determining whether an artifact is associated with a cyber-attack, the system comprising:

• one or more network devices operating as one or more cybersecurity sensors, each of the one or more network devices including a hardware processor;
• and
• a cybersecurity intelligence hub remotely located from and communicatively coupled to the one or more cybersecurity sensors over a network, the cybersecurity intelligence hub comprises
• a data store to store meta-information for prior evaluated artifacts,
• interface logic operating as a customer portal or as an administrator portal,
• a plurality of plug-ins, and
• analytics logic communicatively coupled to the data store and the plurality of plug-ins, the analytics logic configured to (i) receive a request message including meta-information associated with an artifact from a cybersecurity sensor of the one or more cybersecurity sensors, (ii) select at least one plug-in of the plurality of plug-ins to analyze a portion of the stored meta-information for the prior evaluated artifacts, and (iii) determine, using the meta-information associated with the artifact, a consolidated verdict for the artifact to be provided to the cybersecurity sensor,
• wherein the plurality of plug-ins comprise (i) a first set of plug-ins including a first plug-in configured to analyze the stored meta-information for prior evaluated artifacts and provide the consolidated verdict for the artifact to the cybersecurity sensor within a first latency threshold and during a same communication session as the request message, and (ii) a second set of plug-ins each being configured to analyze the stored meta-information for the prior evaluated artifacts and allow cybersecurity intelligence to be provided in response to a second request message received by the analytics logic, the cybersecurity intelligence being provided within a second latency threshold that is greater than the first latency threshold.

A cybersecurity intelligence hub for collecting and distributing cybersecurity intelligence, the cybersecurity intelligence hub comprising:

• a non-transitory storage medium;
• analytics logic stored within the non-transitory storage medium, the analytic logic being configured to (i) receive a request message to conduct a cybersecurity analysis and (ii) select at least one module of a plurality of modules to conduct the cybersecurity analysis;
• and
• the plurality of modules including at least a first set of modules and a second set of modules, wherein
• responsive to selecting at least one module of the first set of modules by the analytics logic, conducting and completing the cybersecurity analysis while a communication session between the at least one module of the first set of modules and a network device initiating the request message remains open, and
• responsive to selecting at least one module of the second set of modules by the analytics logic, conducting and completing the cybersecurity analysis while allowing the cybersecurity intelligence to be provided in response to the request message during a different and subsequent communication session than the communication session during which the request message is received.