Using a security analytics map to trace entity interaction

A system comprising:

• a processor;
• a data bus coupled to the processor;
• and
• a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
• monitoring a plurality of electronically-observable actions of a first entity, the plurality of electronically-observable actions of the first entity corresponding to a respective first plurality of events enacted by the first entity;
• monitoring a plurality of electronically-observable actions of a second entity, the plurality of electronically-observable actions of the second entity corresponding to a respective second plurality of events enacted by the second entity;
• determining whether a first event of the respective first plurality of events and a second event of the respective second plurality of events comprise an entity interaction between the first entity and the second entity;
• generating an entity interaction map, the entity interaction map providing a representation of the entity interaction between the first entity and the second entity;
• using the entity interaction map to trace the entity interaction between the first entity and the second entity;
• and,
• performing, via a security analytics system, a security analytics operation, the security analytics operation using the trace of the entity interaction between the first entity and the second entity to determine when the first entity and the second entity are directly or indirectly involved in an occurrence of an anomalous event, the anomalous event comprising an interaction with a particular data file by the first entity and the second entity, the security analytics operation using the trace to identify when the first entity and the second entity interact with the particular data file prior to detection of the particular data file being associated with the occurrence of the anomalous event.

A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:

• monitoring a plurality of electronically-observable actions of a first entity, the plurality of electronically-observable actions of the first entity corresponding to a respective first plurality of events enacted by the first entity;
• monitoring a plurality of electronically-observable actions of a second entity, the plurality of electronically-observable actions of the second entity corresponding to a respective second plurality of events enacted by the second entity;
• determining whether a first event of the respective first plurality of events and a second event of the respective second plurality of events comprise an entity interaction between the first entity and the second entity;
• generating an entity interaction map, the entity interaction map providing a representation of the entity interaction between the first entity and the second entity;
• using the entity interaction map to trace the entity interaction between the first entity and the second entity;
• and,
• performing, via a security analytics system, a security analytics operation, the security analytics operation using the trace of the entity interaction between the first entity and the second entity to determine when the first entity and the second entity are directly or indirectly involved in an occurrence of an anomalous event, the anomalous event comprising an interaction with a particular data file by the first entity and the second entity, the security analytics operation using the trace to identify when the first entity and the second entity interact with the particular data file prior to detection of the particular data file being associated with the occurrence of the anomalous event.