Systems and methods for security process analysis

A non-transitory computer-readable medium storing a set of instructions for cyber-security processes mining, the set of instructions comprising:

• one or more instructions that, when executed by one or more processors of a device, cause the device to:
• correlate events received from a plurality of data sources into a plurality of flows, wherein a flow of the plurality of flows is a sequence of events having a same identifier, and wherein at least one of the plurality of data sources is a cyber-security system;
• correlate the plurality of flows into a plurality of variants, wherein a variant out of the plurality of variants includes one or more flows having the same repeatable pattern;
• correlate flows having a repeatable pattern into a variant, wherein a repeatable pattern includes a same number of events of the same type;
• associate the plurality of variants with at least one cyber-security process based on a predefined template defining the cyber-security process;
• and
• cause a display of the least one cyber-security process and its plurality of variants.

A system for cyber-security processes mining comprising:

• one or more processors configured to:
• correlate events received from a plurality of data sources into a plurality of flows, wherein a flow of the plurality of flows is a sequence of events having a same identifier, and wherein at least one of the plurality of data sources is a cyber-security system;
• correlate the plurality of flows into a plurality of variants, wherein a variant out of the plurality of variants includes one or more flows having the same repeatable pattern;
• correlate flows having a repeatable pattern into a variant, wherein a repeatable pattern includes a same number of events of the same type;
• associate the plurality of variants with at least one cyber-security process based on a predefined template defining the cyber-security process;
• and
• cause a display of the least one cyber-security process and its plurality of variants.