Method and system for integrated cybersecurity operations

A non-transitory, computer-readable medium storing one or more instructions executable by a computer system to perform operations comprising:

• determining, by a cybersecurity data analytics system, a plurality of systems connected to a network, the plurality of systems comprising industrial systems and non-industrial systems;
• determining, by the cybersecurity data analytics system and using an asset inventory, a baseline activity of the plurality of systems, comprising monitoring the plurality of systems during a time in which cybersecurity is secure;
• generating, by the cybersecurity data analytics system and using the baseline activity, a real-time model of endpoints, wherein the real-time model of endpoints comprises endpoints communications between the plurality of systems in the network and reflects the baseline activity of, and communication among, the endpoints during the time, in which cybersecurity is secure;
• monitoring, by the cybersecurity data analytics system, the plurality of systems, comprising detecting, using the real-time model of endpoints and as detected cybersecurity-related anomalies relative to updated workflows, cybersecurity-related anomalies in the network that deviate from the baseline activity;
• and
• generating, by the cybersecurity data analytics system and using at least the detected cybersecurity-related anomalies, actionable alerts displayed in a user interface and notifying of potential and actual process disruptions, the actionable alerts being mapped to a cybersecurity profile.

A computer-implemented system, comprising:

• one or more processors;
• and
• a non-transitory computer-readable storage medium coupled to the one or more processors and storing programming instructions for execution by the one or more processors, the programming instructions instructing the one or more processors to perform operations comprising:
• determining, by a cybersecurity data analytics system, a plurality of systems connected to a network, the plurality of systems comprising industrial systems and non-industrial systems;
• determining, by the cybersecurity data analytics system and using an asset inventory, a baseline activity of the plurality of systems, comprising monitoring the plurality of systems during a time in which cybersecurity is secure;
• generating, by the cybersecurity data analytics system and using the baseline activity, a real-time model of endpoints, wherein the real-time model of endpoints comprises endpoints communications between the plurality of systems in the network and reflects the baseline activity of, and communication among, the endpoints during the time, in which cybersecurity is secure;
• monitoring, by the cybersecurity data analytics system, the plurality of systems, comprising detecting, using the real-time model of endpoints and as detected cybersecurity-related anomalies relative to updated workflows, cybersecurity-related anomalies in the network that deviate from the baseline activity;
• and
• generating, by the cybersecurity data analytics system and using at least the detected cybersecurity-related anomalies, actionable alerts displayed in a user interface and notifying of potential and actual process disruptions, the actionable alerts being mapped to a cybersecurity profile.