Systems and methods for automatically correlating digital events for actor attribution across disparate digital platforms

A computer-implemented system comprising:

• one or more processors;
• a memory;
• a computer-readable medium operably coupled to the one or more processors, the computer-readable medium having computer-readable instructions stored thereon that, when executed by the one or more processors, cause a computing device to perform operations comprising:
• obtaining digital event data that occurred on a plurality of disparate computing environments of a subscribing entity;
• in response to obtaining the digital event data, converting the digital event data into normalized digital event data that conforms to a target data schema specified by an identity-based threat detection and response service;
• constructing, for the subscribing entity in real-time or near real-time, a plurality of individual session objects detected across the plurality of disparate computing environments in response to executing one or more session construction instructions against the normalized digital event data, wherein:
• each individual session object of the plurality of individual session objects includes a distinct set of digital events performed in a respective computing environment of the plurality of disparate computing environments by a distinct digital account during a distinct time span;
• in response to constructing the plurality of individual session objects, generating, in real-time or near real-time, a plurality of session correlation links that selectively connect a target set of individual session objects of the plurality of individual session objects;
• generating, using the target set of individual session objects and the plurality of session correlation links, a cross-environment session artifact that graphically illustrates a directional access sequence associated with the target set of individual session objects;
• detecting, using the cross-environment session artifact, a root actor responsible for the distinct set of digital events performed across the target set of individual session objects;
• detecting that the root actor accessed the respective computing environment associated with one of the target set of individual session objects using multi-factor authentication (MFA);
• and
• displaying, within the cross-environment session artifact, an MFA user interface element that indicates MFA was used by the root actor to access the respective computing environment associated with the one of the target set of individual session objects.

A computer-implemented system comprising:

• one or more processors;
• a memory;
• a computer-readable medium operably coupled to the one or more processors, the computer-readable medium having computer-readable instructions stored thereon that, when executed by the one or more processors, cause a computing device to perform operations comprising:
• obtaining digital event data that occurred on a plurality of disparate computing environments of a subscribing entity;
• in response to obtaining the digital event data, converting the digital event data into normalized digital event data that conforms to a target data schema specified by an identity-based threat detection and response service;
• constructing, for the subscribing entity in real-time or near real-time, a plurality of individual session objects detected across the plurality of disparate computing environments in response to executing one or more session construction instructions against the normalized digital event data, wherein:
• each individual session object of the plurality of individual session objects includes a distinct set of digital events performed in a respective computing environment of the plurality of disparate computing environments by a distinct digital account during a distinct time span;
• in response to constructing the plurality of individual session objects, generating, in real-time or near real-time, a plurality of session correlation links that selectively connect a target set of individual session objects of the plurality of individual session objects, wherein the target set of individual session objects includes:
• a first individual session object of the plurality of individual session objects, wherein the distinct set of digital events of the first individual session object are performed on a first disparate computing environment of the plurality of disparate computing environments,
• a second individual session object of the plurality of individual session objects, wherein the distinct set of digital events of the second individual session object are performed on a second disparate computing environment of the plurality of disparate computing environments, and
• a third individual session object of the plurality of individual session objects, wherein the distinct set of digital events of the third individual session object are performed on a third disparate computing environment of the plurality of disparate computing environments;
• generating, using the target set of individual session objects and the plurality of session correlation links, a cross-environment session artifact that graphically illustrates a directional access sequence associated with the target set of individual session objects;
• detecting, using the cross-environment session artifact, a root actor responsible for the distinct set of digital events performed across the target set of individual session objects;
• and
• displaying, via a user interface (UI), the cross-environment session artifact, wherein the cross-environment session artifact includes:
• a first session UI card representing the first individual session object,
• a second session UI card representing the second individual session object,
• a third session UI card representing the third individual session object,
• a first directional graphical connector extending in a direction from the first session UI card to the second session UI card, and
• a second directional graphical connector extending in a direction from the second session UI card to the third session UI card, wherein:
• the first directional graphical connector and the second directional graphical connector graphically illustrate the directional access sequence, and
• the directional access sequence indicates a directional flow of access by the root actor across the first disparate computing environment, the second disparate computing environment, and the third disparate computing environment.