Entity context-based security threat detection by a security analytics platform

A system comprising:

• a memory;
• and
• a processing device, coupled to the memory, configured to perform operations comprising:
• receiving a plurality of heterogeneous data items associated with a specified enterprise computing environment;
• cross-validating a first subset of the plurality of heterogeneous data items and a second subset of the plurality of heterogeneous data items;
• generating, based on the plurality of heterogeneous data items, an entity context data structure comprising a plurality of vertices connected by a plurality of edges, wherein each vertex of the plurality of vertices corresponds to an entity of a plurality of entities and each edge corresponds to a relationship between a first vertex and a second vertex connected by the edge;
• receiving telemetry data associated with the specified enterprise computing environment;
• extracting, from the entity context data structure, context data comprising a plurality of context data items associated with at least a subset of the entities referenced by the telemetry data;
• and
• producing one or more security outcomes by applying, to the telemetry data and the context data, a set of detection rules.

A non-transitory computer readable storage medium comprising instructions that, when executed by a processing device, cause the processing device to perform operations comprising:

• receiving a plurality of heterogeneous data items associated with a specified enterprise computing environment;
• cross-validating a first subset of the plurality of heterogeneous data items and a second subset of the plurality of heterogeneous data items;
• generating, based on the plurality of heterogeneous data items, an entity context data structure comprising a plurality of vertices connected by a plurality of edges, wherein each vertex of the plurality of vertices corresponds to an entity of a plurality of entities and each edge corresponds to a relationship between a first vertex and a second vertex connected by the edge;
• receiving telemetry data associated with the specified enterprise computing environment;
• extracting, from the entity context data structure, context data comprising a plurality of context data items associated with at least a subset of the entities referenced by the telemetry data;
• and
• producing one or more security outcomes by applying, to the telemetry data and the context data, a set of detection rules.