Threat mitigation system and method

A computer program product residing on a non-transitory computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:

• monitoring and logging, by a security-relevant subsystem, activity with respect to a computing platform;
• detecting, by the security-relevant subsystem, a plurality of detection events;
• receiving the plurality of detection events concerning a plurality of security events occurring on the security-relevant subsystem within the computing platform;
• wherein the plurality of security events are detected on the security-relevant subsystem using one or more detection rules executed on the security-relevant subsystem, including defining a universal detection rule and translating the universal detection rule into a technology-specific detection rule for the security-relevant subsystem;
• identifying two or more associated detection events included within the plurality of detection events;
• grouping the two or more associated detection events to define a security incident;
• receiving one or more additional detection events concerning one or more additional security events occurring on the security-relevant subsystem within the computing platform;
• adding the one or more additional detection events to the security incident if the one or more additional detection events are related to the two or more associated detection events;
• normalizing the plurality of detection events into a common ontology, wherein normalizing the plurality of detection events into a common ontology includes:
• translating a syntax of each of the plurality of detection events into a common syntax;
• generating comparison information that compares current security-relevant capabilities of the computing platform to comparative platform information determined for a comparative platform to identify a threat context indicator and assign a threat level;
• and
• effectuating one or more remedial operations concerning one or more know conditions and assigned threat level.

A computing system including a processor and memory configured to perform operations comprising:

• monitoring and logging, by a security-relevant subsystem, activity with respect to a computing platform;
• detecting, by the security-relevant subsystem, a plurality of detection events;
• receiving the plurality of detection events concerning a plurality of security events occurring on the security-relevant subsystem within the computing platform;
• wherein the plurality of security events are detected on the security-relevant subsystem using one or more detection rules executed on the security-relevant subsystem, including defining a universal detection rule and translating the universal detection rule into a technology-specific detection rule for the security-relevant subsystem;
• identifying two or more associated detection events included within the plurality of detection events;
• grouping the two or more associated detection events to define a security incident;
• receiving one or more additional detection events concerning one or more additional security events occurring on the security-relevant subsystem within the computing platform;
• adding the one or more additional detection events to the security incident if the one or more additional detection events are related to the two or more associated detection events;
• normalizing the plurality of detection events into a common ontology, wherein normalizing the plurality of detection events into a common ontology includes:
• translating a syntax of each of the plurality of detection events into a common syntax;
• generating comparison information that compares current security-relevant capabilities of the computing platform to comparative platform information determined for a comparative platform to identify a threat context indicator and assign a threat level;
• and
• effectuating one or more remedial operations concerning one or more know conditions and assigned threat level.