Method for verifying configurations of security technologies deployed on a computer network

A method for verifying configurations of security technologies deployed on a computer network comprising:

• deploying a phase, within an attack validation scenario analogous to a network security threat, to a target asset on the network, the phase and associated with a polling window and a target response type and executed by the target asset during a phase window;
• during the polling window following the phase window, polling a log of a security technology deployed on the network for a sequence of events associated with the target asset and a second log of a second security technology deployed on the network for a second sequence of events associated with the target asset;
• calculating correlation scores for events, in the sequence of events and the second sequence of events, based on proximities of timestamps of events, in the sequence of events and the second sequence of events, respectively, to the phase window;
• in response to a first correlation score of a first event, in the sequence of events, exceeding a threshold score:
• confirming logging of the phase by a suite of security technologies, comprising the security technology and the second security technology, deployed on the network in response to at least one event, in the sequence of events and the second sequence of events, exceeding the threshold score;
• and
• in response to confirming logging of the phase by the security technology, in response to a difference between a first event type of the first event and the target response type of the phase, and in response to absence of at least one event, in the sequence of events and the second sequence of events, exceeding the threshold score and representing an event type matching the target response type:
• generating a prompt to reconfigure the security technology to respond to behaviors analogous to the phase, on the computer network, according to the target response type.

A method for verifying configurations of security technologies deployed on a computer network comprising:

• deploying a phase, within an attack validation scenario analogous to a network security threat, to a target asset on the network, the phase and associated with a polling window and a target response type and executed by the target asset during a phase window;
• at the target asset, executing an action according to the phase during the phase window, the action associated with the target response type;
• during the polling window following the phase window:
• polling a log of a security technology deployed on the network for a sequence of events associated with the target asset;
• and
• pooling the sequence of events written to the log of the security technology and published to an alert feed by the security technology;
• calculating correlation scores for events, in the sequence of events, comprising calculating correlation scores for events, in the sequence of events, representing the action executed by the target asset during the phase window based on proximities of timestamps of events, in the sequence of events, to the phase window;
• in response to a first correlation score of a first event, in the sequence of events, exceeding a threshold score:
• selecting the first event in response to the first correlation score of the first event exceeding correlation scores of each other event in the sequence of events;
• and
• confirming logging of the phase by the security technology in response to the first correlation score of the first event exceeding the threshold score;
• and
• in response to confirming logging of the phase by the security technology and in response to the first event comprising a detection event:
• flagging the security technology for failing to alert on the action;
• and
• generating the prompt to reconfigure alerting parameters of the security technology to publish alerts for behaviors analogous to the action on the computer network.

A method for verifying configurations of security technologies deployed on a computer network comprising:

• deploying a phase, within an attack validation scenario analogous to a network security threat, to a target asset on the network, the phase and associated with a polling window and a target response type and executed by the target asset during a phase window;
• at the target asset, executing an action according to the phase during the phase window, the action associated with the target response type;
• during the polling window following the phase window, polling a log of a security technology deployed on the network for a sequence of events associated with the target asset;
• calculating correlation scores for events, in the sequence of events, comprising calculating correlation scores for events, in the sequence of events, representing the action executed by the target asset during the phase window based on proximities of timestamps of events, in the sequence of events, to the phase window;
• in response to a first correlation score of a first event, in the sequence of events, exceeding a threshold score, confirming logging of the phase by the security technology comprising:
• selecting the first event in response to the first correlation score of the first event exceeding correlation scores of each other event in the sequence of events;
• and
• confirming logging of the phase by the security technology in response to the first correlation score of the first event exceeding the threshold score;
• and
• in response to confirming logging of the phase by the security technology and in response to a difference between a first event type of the first event and the target response type of the phase:
• flagging the security technology for failing to prevent the action;
• and
• generating the prompt to adjust sensitivity of the security technology to autonomously execute prevention actions responsive to behaviors analogous to the action on the computer network.

A method for verifying configurations of security technologies deployed on a computer network comprising:

• deploying a phase, within an attack validation scenario analogous to a network security threat, to a target asset on the network, the phase and associated with a polling window and a target response type and executed by the target asset during a phase window;
• at the target asset, executing an action according to the phase during the phase window, the action associated with the target response type;
• and
• during the polling window following the phase window:
• pooling the sequence of events written to the log of the security technology and published to an alert feed by the security technology during the polling window;
• and
• calculating correlation scores for events, in the sequence of events, comprising calculating correlation scores for events, in the sequence of events, representing the action executed by the target asset during the phase window based on proximities of timestamps of events, in the sequence of events, to the phase window;
• in response to a first correlation score of a first event, in the sequence of events, exceeding a threshold score:
• selecting the first event in response to the first correlation score of the first event exceeding correlation scores of each other event in the sequence of events;
• and
• confirming logging of the phase by the security technology in response to the first correlation score of the first event exceeding the threshold score;
• and
• in response to a difference between a first event type of the first event and the target response type of the phase:
• flagging the security technology for failing to alert on the action;
• and
• generating the prompt to adjust sensitivity of the security technology to publish alerts, in place of prevention actions, responsive to behaviors analogous to the action on the computer network.