System and method for SIEM rule sorting and conditional execution

A SIEM system for processing security events by applying a rule-based alarm scheme for determining whether a received security event is considered as offense, the system comprising:

• a processor;
• one or more computer readable storage medium;
• and
• program instructions stored on the one or more computer readable storage medium, the program instructions being executable by the processor to:
• process an incoming security event by sequentially applying rules in a rule index, wherein processing the incoming security event comprises:
• increasing a current rule counter relating to a triggered rule and increasing a current indicator of compromise counter pertaining to the triggered rule, wherein the current indicator of compromise counter comprises a different counter than the current rule counter;
• sort the rules in the rule index according to a rule likelihood of triggering an offense, wherein the sorting the rules is based on respective weighted rule counter values;
• sort, for each rule, indicators of compromise in a respective indicator of compromise index according to an indicator of compromise likelihood of triggering an offense, wherein the sorting the indicators of compromise is based on weighted current indicator of compromise counter values;
• and
• process another incoming security event by sequentially applying the sorted rules contained in the rule index.

A computer program product for processing security events by applying a rule-based alarm scheme for determining whether a received security event is considered as offense, the computer program product comprising:

• one or more computer readable storage medium and program instructions stored on at least one of the one or more computer readable storage medium, the program instructions executable by a processor to:
• process an incoming security event by sequentially applying rules in a rule index, wherein processing the incoming security event comprises:
• increasing a current rule counter relating to a triggered rule and increasing a current indicator of compromise counter pertaining to the triggered rule, wherein the current indicator of compromise counter comprises a different counter than the current rule counter;
• sort the rules in the rule index according to a rule likelihood of triggering an offense, wherein the sorting the rules is based on respective weighted rule counter values;
• sort, for each rule, indicators of compromise in a respective indicator of compromise index according to an indicator of compromise likelihood of triggering an offense, wherein the sorting the indicators of compromise is based on weighted current indicator of compromise counter values;
• and
• process another incoming security event by sequentially applying the sorted rules contained in the rule index.