Incorporating software-as-a-service data into a cyber threat defense system

A non-transitory computer readable medium comprising computer readable code operable, when executed by one or more processing apparatuses in the cyber threat defense system to instruct a computing device to perform a method for a cyber threat defense system incorporating data from a Software-as-a-Service (SaaS) application hosted by a third-party operator platform to identify cyber threats related to that SaaS application, comprising:

• collecting, from one or more connectors deployed to a network entity representing at least one of a user and a network device that utilizes the SaaS application, third-party event data describing an administrative event of the SaaS application hosted by the third-party operator platform;
• comparing the third-party event data, received from the one or more connectors, to one or more machine-learning models trained on a normal benign behavior of that network entity using a normal behavior benchmark describing parameters corresponding to a normal pattern of activity for that network entity to spot behavior on the network deviating from the normal benign behavior;
• identifying whether the network entity that utilized the SaaS application is in a breach state of the normal behavior benchmark;
• identifying whether the breach state and a chain of relevant behavioral parameters deviating from the normal benign behavior of that network entity correspond to a cyber threat;
• and
• executing an autonomous response in response to the cyber threat using an autonomous response module,
• where the computing device is configured to direct i) the one or more connectors to request that the third-party SaaS application hosted by the third-party operator platform return the event data describing the administrative event once it is observed;
• ii) the third-party operator platform hosting the SaaS application to keep a connection open until an event is observed and the event data describing the administrative event is returned to the SaaS module, and iii) any combination of these two.

An apparatus for a cyber threat defense system, comprising:

• one or more processors communicatively coupled to a memory;
• one or more input ports to connect to one or more connectors and one or more probes deployed to a network entity representing at least one of a user and a network device that utilizes a third-party software-as-a-service (SaaS) application,
• a SaaS module configured to collect, from the one or more connectors, third-party event data describing an administrative event of the third-party SaaS application hosted by a third-party operator platform;
• a probe module configured to collect, from the one or more probes, probe data describing network-administrated activity, external to the SaaS application, executed by the network entity;
• a coordinator module configured to contextualize the third-party event data from the SaaS module with the probe data from the probe module to create a combined data set for analysis;
• a comparison module configured to execute a comparison of the combined data set, created by the coordinator module, to at least one machine-learning model trained on a normal benign behavior of that network entity using a normal behavior benchmark describing parameters corresponding to a normal pattern of activity for that network entity to spot behavior on the network deviating from the normal benign behavior to identify whether the network entity is in a breach state of the normal behavior benchmark;
• a cyber threat module configured to identify whether the breach state identified by the comparison module and a chain of relevant behavioral parameters deviating from the normal benign behavior of that network entity correspond to a cyber threat;
• and
• an autonomous response module configured to execute at least one autonomous response to the cyber threat identified by the cyber threat module,
• where the SaaS module is further configured to direct i) the one or more connectors to request that the third-party SaaS application hosted by the third-party operator platform return the event data describing the administrative event once it is observed;
• ii) the third-party operator platform hosting the SaaS application to keep a connection open until an event is observed and the event data describing the administrative event is returned to the SaaS module, and iii) any combination of these two, where the SaaS module, the probe module, the coordinator module, the cyber threat module, the comparison module, and the autonomous response module are implemented using logic.