Security information and event management system employing security business objects and workflows

A method of operating a security information and event management system, comprising:

• storing, in a data storage sub-system, (1) security data from one or more sources, the security data pertaining to security-related events and states of a production computer system, (2) a collection of security business objects serving as an abstraction layer over the security data, each security business object representing a respective security-related aspect of the production system and including a respective set of queries of the sources of security data to generate respective output security data pertaining to the respective security-related aspect, the security business objects including (i) threat/attack objects including respective queries and logical operations on event data describing events in the production computer system, (ii) vulnerability objects including respective queries and logical operations on vulnerability data describing vulnerabilities of the production computer system, and (iii) asset objects including respective queries and logical operations on asset data describing configuration of assets in the production computer system, and (3) a collection of security workflows each including a respective set of the security business objects organized in a respective workflow-specific manner, each security workflow embodying a respective complex and multi-step security analysis operation with respect to the production computer system, at least one of the security workflows including a threat/attack object, a vulnerability object and an asset object arranged in a user-specified sequence with output security data of one object serving as input security data to a next succeeding object;
• and
• by processing circuitry in response to user input, executing the security workflows including the respective security business objects, the execution of each security workflow resulting in a corresponding set of result data stored in the data storage sub-system, the result data identifying one or more security threats and system-specific vulnerability information regarding vulnerability of the production computer system to the security threats.