Automated security analysis and response of container environments

A non-transitory computer-readable medium comprising instructions that are executable by a processing device for causing the processing device to perform operations comprising:

• retrieving logs of data from a computer network;
• parsing the logs of data and filtering the logs of data into one or more data sets, wherein the filtering of the logs of data includes:
• creating an event timeline of the computer network;
• identifying:
• known events based on malicious or suspicious indicators on the logs of data,
• key events linked to same processes, users, files, network connections as events highlighted by the malicious or the suspicious indicators,
• incident events with a time period matching the known events and the key events, and
• primary events from the known events, key events, and incident events;
• analyzing using a data analysis system, the event timeline of the computer network from the one or more data sets to identify whether data from the logs of data is accessed by an unauthorized computing system, wherein the primary events are associated with the unauthorized computing system;
• and
• generating, based on a result of the identification of whether the data from the logs of data is accessed by the unauthorized computing system, a set of suggested tasks, wherein each suggested task of the set of suggested tasks represents techniques for isolating a host connected to the computer network if the data has been compromised.

A cloud-based response system for analyzing data for remediating security incidents in a cloud environment, comprising:

• a data acquisition system configured to:
• retrieve logs of data from a computer network;
• a data analysis system configured to:
• parse the logs of data and filter the logs of data into a plurality of data sets,
• wherein the logs of data are filtered by the data analysis system further configured to:
• create an event timeline of the computer network;
• identify:
• known events based on malicious or suspicious indicators on the logs of data,
• key events linked to same processes, users, files, network connections as events highlighted by the malicious or the suspicious indicators,
• incident events with a time period matching the known events and the key events, and
• primary events from the known events, key events, and incident events;
• analyze using a data analysis system, the event timeline of the computer network from the plurality of data sets to identify whether data from the logs of data is accessed by an unauthorized computing system, wherein the primary events are associated with the unauthorized computing system;
• and
• an action recommendation system configured to:
• generate, based on a result of the identification of whether the data from the logs of data is accessed by the unauthorized computing system, a set of suggested tasks, wherein each suggested task of the set of suggested tasks represents techniques for isolating a host connected to the computer network if the data has been compromised.