System and methods for cybersecurity analysis using ueba and network topology data and trigger - based network remediation

A system for cybersecurity analysis using user and entity behavioral analysis combined with trigger-based network remediation, comprising:

• a computing device comprising a memory and a processor;
• wherein network segmentation is used to reduce the number of nodes required to represent entities in a directed graph by:
• assigning computing devices in a computing network to logical segments wherein the computing devices in a logical segment are treated analogously with respect to access of the computer network;
• and
• representing all computing devices in a logical segment as a single entity in the directed graph;
• and
• a behavioral analysis engine comprising a first plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the first plurality of programming instructions, when operating on the processor, cause the computing device to:
• monitor the activity of a plurality of entities comprising the computer network;
• establish behavioral baseline data for each of the plurality of entities from the monitored activity over a defined period of time;
• identify anomalous behavior of one of the plurality of entities by comparing monitored activity for that entity to the associated behavioral baseline data and the one or more scores for that entity;
• and
• calculate a risk of the anomalous behavior using the directed graph by determining a relationship between the entity for which anomalous behavior has been identified and a different entity of the plurality of entities.