Attack kill chain generation and utilization for threat analysis

A computer program product comprising a non-transitory computer useable medium including a computer readable code, wherein the computer readable code when executed using one or more computing device processors, causes the one or more computing device processors to:

• receive a first security event captured by a first security operation associated with a computing device, and a second security event captured by a second security operation associated with the computing device, the first security event and the second security event being associated with an attack campaign;
• determine a first identifier associated with the first security event;
• determine a second identifier associated with the second security event;
• map, based on the first identifier, the first security event to first security data in an attack repository;
• map, based on the second identifier, the second security event to second security data in the attack repository;
• determine, based on the mapping, one or more attack execution operations for executing the attack campaign associated with the first security event and the second security event;
• sequence the one or more attack execution operations to form an attack kill chain, based on a relationship between the first security event and the second security event, the attack kill chain indicating the one or more attack execution operations for executing the attack campaign associated with the first security event and the second security event;
• and
• initiate generation of a visual representation of the attack kill chain, the visual representation indicating a sequence of the one or more attack execution operations for executing the attack campaign associated with the first security event and the second security event.

A system comprising:

• one or more computing system processors;
• and
• memory storing instructions that, when executed by the one or more computing system processors, causes the system to:
• receive a first security event captured by a first security operation associated with a computing device, and a second security event captured by a second security operation associated with the computing device, the first security event and the second security event being associated with an attack campaign;
• determine a first identifier associated with the first security event;
• determine a second identifier associated with the second security event;
• map, based on the first identifier, the first security event to first security data in an attack repository;
• map, based on the second identifier, the second security event to second security data in the attack repository;
• determine, based on the mapping, one or more attack execution operations for executing the attack campaign associated with the first security event or the second security event;
• sequence the one or more attack execution operations to form an attack kill chain, based on the first security event occurring relative to the second security event, the attack kill chain indicating the one or more attack execution operations for executing the attack campaign associated with the first security event and the second security event;
• and
• initiate generation of a visual representation of the attack kill chain, the visual representation indicating a sequence of the one or more attack execution operations for executing the attack campaign associated with the first security event and the second security event.