Determining insights in an electronic environment
AssigneeRapid7, Inc.
InventorsRoy Hodgman, Wah-Kwan Lin, Vasudha Shivamoggi
Life of this patent
Estimating the term…
Abstract
Approaches provide for securing an electronic environment. A threat analysis service can obtain data for devices, users, and threats from disparate sources and can correlate users to devices and threats to build an understanding of an electronic environment's operational, organizational, and security concerns in order to provide customized security strategies and remediations. Additionally, the threat analysis service can develop a model of an electronic environment's behavior by monitoring and analyzing various the data from the data sources. The model can be updated such that the threat analysis service can tailor its orchestration to complement existing operational processes.
Claims20
A computing system, comprising:
- at least one computing device processor;
- a memory device including instructions that, when executed by the at least one computing device processor, enables the computing system to:
- cause at least one data store in a service provider environment to maintain at least three data sets from a plurality of data sources, each data set including information for one of assets, users, or security threats;
- correlate at least one entry in a first data set with a second data set of the three data sets;
- receive a query associated with a subject, the subject being at least one of an asset, a user, or a security threat;
- determine a correlator of a set of correlators based at least in part on the subject;
- identify at least one of an asset, a user, or security threat associated with the subject;
- and
- perform a security action affecting the subject and an identified one of the asset, the user, or the security threat.
A computer-implemented method, comprising:
- causing at least one data store in a service provider environment to maintain at least three data sets from a plurality of data sources, each data set including information for one of assets, users, or security threats;
- correlating at least one entry in a first data set with a second data set of the three data sets;
- receiving a query associated with a subject, the subject being at least one of an asset, a user, or a security threat;
- determining a correlator of a set of correlators based at least in part on the subject;
- identifying at least one of an asset, a user, or security threat associated with the subject;
- and
- performing a security action affecting the subject and an identified one of the asset, the user, or the security threat.
A non-transitory computer readable storage medium storing instructions that, when executed by at least one processor of a computing system, causes the computing system to:
- cause at least one data store in a service provider environment to maintain at least three data sets from a plurality of data sources, each data set including information for one of assets, users, or security threats;
- correlate at least one entry in a first data set with a second data set of the three data sets;
- receive a query associated with a subject, the subject being at least one of an asset, a user, or a security threat;
- determine a correlator of a set of correlators based at least in part on the subject;
- identify at least one of an asset, a user, or security threat associated with the subject;
- and
- perform a security action affecting the subject and an identified one of the asset, the user, or the security threat.
Dependencies are inferred from the claim text.