Threat mitigation system and method

A computer program product residing on a non-transitory computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:

• obtaining one or more artifacts concerning a detected security event from at least a portion of a plurality of security-relevant subsystems within a computing platform;
• obtaining artifact information concerning the one or more artifacts;
• generating a conclusion concerning the detected security event based, at least in part, upon the detected security event, the one or more artifacts, and the artifact information;
• and
• executing a remedial action plan based upon, at least in part, the conclusion, wherein executing the remedial action plan includes:
• determining a threat level associated with the detected security event;
• and
• executing a remedial action based upon, at least in part, the determined threat level associated with the detected security event;
• and
• allowing the third party to manually search through the one or more artifacts within the computing platform, using a single search operation including:
• parsing a unified query to provide a plurality of security-relevant subsystem specific queries to the plurality of security-relevant subsystems;
• and
• effectuating at least a portion of the plurality of security-relevant subsystem specific queries on respective security-relevant subsystems of the plurality of security-relevant subsystems.

A computing system including a processor and memory configured to perform operations comprising:

• obtaining one or more artifacts concerning a detected security event from at least a portion of a plurality of security-relevant subsystems within a computing platform;
• obtaining artifact information concerning the one or more artifacts;
• generating a conclusion concerning the detected security event based, at least in part, upon the detected security event, the one or more artifacts, and the artifact information;
• and
• executing a remedial action plan based upon, at least in part, the conclusion, wherein executing the remedial action plan includes:
• determining a threat level associated with the detected security event;
• and
• executing a remedial action based upon, at least in part, the determined threat level associated with the detected security event;
• and
• allowing the third party to manually search through the one or more artifacts within the computing platform, using a single search operation including:
• parsing a unified query to provide a plurality of security-relevant subsystem specific queries to the plurality of security-relevant subsystems;
• and
• effectuating at least a portion of the plurality of security-relevant subsystem specific queries on respective security-relevant subsystems of the plurality of security-relevant subsystems.