Computerized system and method for providing cybersecurity detection and response functionality

A non-transitory computer-readable storage medium tangibly encoded with computer-executable instructions, that when executed by a processor associated with a computing device, performs a method comprising:

• receiving, at the computing device, an alert notification indicating a security event with at least one component of a computerized network, said computerized network comprising a plurality of nodes associated with devices and networked services available to such devices;
• analyzing, via the computing device, said alert notification by parsing the data associated with said alert, and based on said parsing, identifying event data related to said security event, said event data providing an indication of a location within the network where said alert originated and a type of security event that triggered said alert;
• retrieving, via the computing device from an asset database associated with the computing device, information associated with assets related to said event data, said retrieving comprising searching said asset database, identifying assets related to said event data and performing said retrieval of said information for said identified assets;
• creating, via the computing device, a hierarchy of related elements based on the event data and the retrieved asset information, said element hierarchy comprising an ontology of the security event and the identified assets, said ontology structured such that relationships between the security event, the assets and their respective information is retrievable from the hierarchy;
• executing, via the computing device, cybertagging testing on the created hierarchy of elements, said cybertagging testing comprising cybertagging the security event by determining, via analysis of the hierarchy of elements in view of cybertagging tests associated with asset and network controls, a validation indication of the security event, a risk assessment and incident categorization of the security event are determined;
• determining, via the computing device based on results of said cybertagging, a value representing an impact of the security event on each of the assets identified in said element hierarchy;
• determining, via the computing device, an impact model indicating how the security event has impacted the computerized network based on said determined values of impact, said impact model comprising identification of vulnerabilities on the network and their associated mitigation strategies;
• and
• generating and communicating, via the computing device, a user interface (UI) that displays information related to the impact model, said communication of the UI enabling a node on said network to execute at least one of the mitigation strategies in order to thwart a future security event related to said security event.

A computing device comprising:

• a processor;
• a non-transitory computer-readable storage medium for tangibly storing thereon program logic for execution by the processor, the program logic comprising:
• logic executed by the processor for receiving, at the computing device, an alert notification indicating a security event with at least one component of a computerized network, said computerized network comprising a plurality of nodes associated with devices and networked services available to such devices;
• logic executed by the processor for analyzing, via the computing device, said alert notification by parsing the data associated with said alert, and based on said parsing, identifying event data related to said security event, said event data providing an indication of a location within the network where said alert originated and a type of security event that triggered said alert;
• logic executed by the processor for retrieving, via the computing device from an asset database associated with the computing device, information associated with assets related to said event data, said retrieving comprising searching said asset database, identifying assets related to said event data and performing said retrieval of said information for said identified assets;
• logic executed by the processor for creating, via the computing device, a hierarchy of related elements based on the event data and the retrieved asset information, said element hierarchy comprising an ontology of the security event and the identified assets, said ontology structured such that relationships between the security event, the assets and their respective information is retrievable from the hierarchy;
• logic executed by the processor for executing, via the computing device, cybertagging testing on the created hierarchy of elements, said cybertagging testing comprising cybertagging the security event by determining, via analysis of the hierarchy of elements in view of cybertagging tests associated with asset and network controls, a validation indication of the security event, a risk assessment and incident categorization of the security event are determined;
• logic executed by the processor for determining, via the computing device based on results of said cybertagging, a value representing an impact of the security event on each of the assets identified in said element hierarchy;
• logic executed by the processor for determining, via the computing device, an impact model indicating how the security event has impacted the computerized network based on said determined values of impact, said impact model comprising identification of vulnerabilities on the network and their associated mitigation strategies;
• and
• logic executed by the processor for generating and communicating, via the computing device, a user interface (UI) that displays information related to the impact model, said communication of the UI enabling a node on said network to execute at least one of the mitigation strategies in order to thwart a future security event related to said security event.