Cybersecurity system

A cybersecurity system for processing events to produce scores, alerts, and mitigation actions, the system comprising:

• a plurality of sensors, each of the plurality of sensors being configured to:
• receive sensor data from a network,
• process the sensor data to form events, and
• transmit the events;
• a distributed analytic platform, the distributed analytic platform configured to:
• receive the events from the plurality of sensors,
• process the events to form analytic workflows and distributed analytic platform messages, each of the distributed analytic platform messages associated with at least one of an alert, an update to a first analytic model, and cyber behavioral information, each of the analytic workflows:
• associated with one or more logical segments, and
• including at least one of the first analytic model, a second analytic model, a rule, a data transformation, and a data aggregation, and
• transmit the analytic workflows and distributed analytic platform messages;
• a plurality of scoring engines, each of the plurality of scoring engines being configured to:
• receive the analytic workflows from the distributed analytic platform,
• receive the events from at least one of the plurality of sensors,
• process the received events using the analytic workflows to produce scoring engine messages, and
• transmit the scoring engine messages;
• and
• a real time analytic engine, the real time analytic engine configured to:
• receive the analytic workflows from the distributed analytic platform,
• receive analytic workflow and event processing rules,
• receive the scoring engine messages from the plurality of scoring engines,
• receive the distributed analytic platform messages from the distributed analytic platform, and
• process the scoring engine messages and the distributed analytic platform messages using the analytic workflows from the distributed analytic platform and the analytic workflow and event processing rules to form a threat intelligence message, wherein the threat intelligence message comprises at least one of:
• a broadcast message, the real time analytic engine configured to transmit the broadcast message,
• a mitigation message, the real time analytic engine configured to transmit the mitigation message to a control plane engine for taking a mitigation action associated with a first logical segment of the one or more logical segments when the processing by the real time analytic engine indicates the mitigation action limits the impact of anomalous activity, and
• a model update message, the real time analytic engine configured to transmit the model update message for updating one or more analytic workflows when the processing by the real time analytic engine indicates the model update message improves at least one of a detection rate of the anomalous activity and a reduction in a false positive rate,
• each of the one or more logical segments associating:
• at least one of the first analytic model, the second analytic model, a third analytic model, a set of analytic models, and an analytic workflow,
• one or more sources of inputs about activity within the logical segment, and
• a set of actions for mitigating an impact of the anomalous activity occurring within the logical segment.