Method and apparatus for integrated network security alert information retrieval

An apparatus for use in a network comprising:

• means for detecting behavior indicative of a security threat associated with a destination network address, the behavior also associated with a source network address, the destination network address associated with a computing resource;
• means for generating an alert in response to detecting the behavior, the alert comprising a hyperlink configured to initiate a search of a first database and a second database;
• means for initiating the search of the first database to obtain first information, the first information comprising information relating to an organizational facility associated with the computing resource, a user assigned to the computing resource, and a physical location of the computing resource;
• means for initiating the search of the second database to obtain second information relating to the alert, the second information comprising a course of action for a security analyst for each type of security threat and information related to a routing registry configuration for the source network address, wherein the search of the second database is initiated upon completion of the search of the first database;
• means for scanning the computing resource, the scanning based on the first information, the scanning detecting a media access control address of the computing resource and detecting information related to routers through which the computing resource is connected to a local network;
• and
• means for displaying the first information and the second information and the media access control address of the computing resource and the information related to routers through which the computing resource is connected to the local network;
• wherein the first database is maintained by an organization operating the network and the second database is maintained by a third party.

A non-transitory computer readable medium storing computer program instructions which, when executed on a processor, define a method comprising:

• detecting behavior indicative of a security threat associated with a destination network address, the behavior also associated with a source network address, the destination network address associated with a computing resource;
• generating an alert in response to detecting the behavior, the alert comprising a hyperlink configured to initiate a search of a first database and a second database;
• initiating the search of the first database to obtain first information, the first information comprising information relating to an organizational facility associated with the computing resource, a user assigned to the computing resource, and a physical location of the computing resource;
• initiating the search of the second database to obtain second information relating to the alert, the second information comprising a course of action for a security analyst for each type of security threat and information related to a routing registry configuration for the source network address, wherein the search of the second database is initiated upon completion of the search of the first database;
• scanning the computing resource, the scanning based on the first information, the scanning detecting a media access control address of the computing resource and detecting information related to routers through which the computing resource is connected to a local network;
• and
• displaying the first information and the second information and the media access control address of the computing resource and the information related to routers through which the computing resource is connected to the local network, wherein the first database is maintained by an organization operating the network and the second database is maintained by a third party.