System and method for correlating log data to discover network vulnerabilities and assets

A method for correlating log data to discover vulnerable network assets, comprising:

• receiving, at a log correlation engine, one or more logs that contain events describing observed activity in a network;
• determining, at the log correlation engine, that the one or more logs contain at least one event that matches a regular expression in at least one correlation rule associated with the log correlation engine that indicates a vulnerability;
• obtaining, at the log correlation engine, information about the indicated vulnerability from at least one data source cross-referenced in the at least one correlation rule;
• and
• generating a report that the indicated vulnerability was discovered in the network, wherein the report includes the information about the indicated vulnerability obtained from the at least one data source cross-referenced in the at least one correlation rule.

A computer-readable storage medium having computer-executable instructions stored thereon for correlating log data to discover vulnerable network assets, wherein executing the computer-executable instructions a processor causes the processor to:

• receive one or more logs that contain events describing observed activity in a network;
• determine that the one or more logs contain at least one event that matches a regular expression in at least one correlation rule associated with a log correlation engine that indicates a vulnerability;
• obtain information about the indicated vulnerability from at least one data source cross-referenced in the at least one correlation rule;
• and
• generate a report that the indicated vulnerability was discovered in the network, wherein the report includes the information about the indicated vulnerability obtained from the at least one data source cross-referenced in the at least one correlation rule.