DEVICE, SYSTEM AND METHOD FOR PROVISIONING AND UPDATE OF SECURITY INFORMATION AND EVENT MANAGEMENT ARTIFACTS FOR MULTIPLE TENANTS - Patent application

Abstract

A security information and event management ("SIEM") provider server is disclosed herein. The SIEM provider server is configured to enhance network security on behalf of a tenant network by autonomously generating and providing a SIEM configuration to the tenant network. The SIEM provider server includes a processor and a memory configured to store a managed security service provider (MSSP) management system that, when executed by the processor, causes the processor to autonomously retrieve SIEM artifacts associated with the tenant network from a content repository, generate a tenant-specific SIEM configuration for the tenant network including the SIEM artifacts, and deploy the tenant-specific SIEM configuration to the tenant-specific repository.

Description

[Technical field]

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS This application is related to U.S. Provisional Patent Application No. 63 / 294,570, filed December 29, 2021, entitled “DEVICES, SYSTEMS, AND METHODS FOR PROVISIONING AND UPDATING SECURITY INFORMATION & EVENT MANAGEMENT ARTIFACTS FOR MULTIPLE TENANTS,” the disclosure of which is incorporated by reference in its entirety herein.

[0002] The present disclosure relates generally to network security, and more particularly, to improved devices, systems, and methods for issuing security information and event management (SIEM) client updates. Summary of the Invention

[0003] The following summary is provided to facilitate understanding of some of the innovative features unique to the aspects disclosed herein and is not intended to be a complete description, A complete understanding of the various aspects can be obtained by taking the specification, claims, and abstract in their entirety.

[0004] In various aspects, a security information and event management ("SIEM") provider server is disclosed. The SIEM provider server may be configured to enhance network security on behalf of a tenant network by autonomously generating and providing a SIEM configuration to the tenant network. The SIEM provider server may include a processor and a memory configured to store a managed security service provider ("MSSP") management system that, when executed by the processor, causes the processor to autonomously retrieve SIEM artifacts associated with the tenant network from a content repository, generate a tenant-specific SIEM configuration for the tenant network including the SIEM artifacts, and deploy the tenant-specific SIEM configuration to the tenant-specific repository.

[0005] In various aspects, a method for enhancing network security on behalf of a tenant network is disclosed. The method may include autonomously generating and providing a SIEM configuration to the tenant network via a security information and event management ("SIEM") provider server, displaying a plurality of widgets via a graphical user interface, where at least one widget of the plurality of widgets is associated with the tenant network, autonomously retrieving SIEM artifacts associated with the tenant network from a content repository communicatively coupled to the SIEM provider server via the SIEM provider server, generating a tenant-specific SIEM configuration for the tenant network including the SIEM artifacts via the SIEM provider server, deploying the tenant-specific SIEM configuration to the tenant network via the SIEM provider server via a tenant-specific repository communicatively coupled to the SIEM provider server, continuously monitoring the tenant network for security events via the SIEM configuration, and autonomously taking action to protect the tenant network upon detecting a security event via the SIEM configuration.

[0006] In various aspects, a system for enhancing network security is disclosed. The system may include a centralized content repository, a plurality of tenant-specific repositories, a plurality of tenants configured to host a plurality of clients, and a security information and event management (SIEM) provider server communicatively coupled to the plurality of tenants, the SIEM provider server including a processor and a memory configured to store a MSSP management platform that, when executed by the processor, causes the processor to provide a graphical user interface displaying a plurality of widgets, where each widget of the plurality of widgets is associated with one of the plurality of tenants, receive user input via the graphical user interface associated with a target tenant of the plurality of tenants, autonomously retrieve SIEM artifacts associated with the target tenant from the content repository, generate a tenant-specific SIEM configuration for the target tenant including the SIEM artifacts, where the tenant-specific SIEM configuration is configured to continuously monitor the target tenant for security events and, upon detecting a security event, autonomously take action to protect the target tenant, and deploy the tenant-specific SIEM configuration to the tenant-specific repository of the plurality of tenant-specific repositories associated with the target tenant.

[0007] These and other objects, features, and characteristics of the invention as well as the method of operation, function of the associated structural elements, combination of parts, and economies of manufacture will become more apparent from a consideration of the following description and appended claims which refer to the accompanying drawings, all of which form a part hereof, and in which like reference characters indicate corresponding parts in the various views, It is to be expressly understood, however, that the drawings are for the purpose of illustration and description only and are not intended as a definition of the limits of the invention. [Brief description of the drawings]

[0008] Various features of the aspects described herein are set forth with particularity in the appended claims, however the various aspects, both as to organization and method of operation, and their advantages may be understood from the following description taken in conjunction with the accompanying drawings, as follows:

[0009] [Figure 1] FIG. 1 illustrates a diagram of a system configured to standardize and streamline the deployment of security information and event management artifacts for multiple tenants in accordance with at least one non-limiting aspect of the present disclosure.

[0010] [Diagram 2] FIG. 2 illustrates a block diagram of a deployment architecture employed by the system of FIG. 1 in accordance with at least one non-limiting embodiment of the present disclosure.

[0011] [Diagram 3] FIG. 3 illustrates a method for provisioning and updating security information and event management artifacts in accordance with at least one non-limiting aspect of the present disclosure.

[0012] Corresponding reference characters indicate corresponding parts throughout the several views. The embodiments described herein are illustrative of various aspects of the present invention in one form only, and such embodiments should not be construed as limiting the scope of the present invention in any manner. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] The applicant of this application owns the following US provisional patent applications, the disclosures of each of which are incorporated herein by reference in their entirety: -U.S. Provisional Patent Application No. 63 / 295,150, filed on December 30, 2021, entitled DEVICES, SYSTEMS, AND METHODS FOR STREAMLINING AND STANDARDIZING THE INGEST OF SECURITY DATA ACROSS MULTIPLE TENANTS; -U.S. Provisional Patent Application No. 63 / 302,828, filed on January 25, 2022, entitled DEVICES, SYSTEMS, AND METHODS FOR REMOTELY MANAGING ANOTHER ORGANIZATION'S SECURITY ORCHESTRATION, AUTOMATION, AND RESPONSE; -U.S. Provisional Patent Application No. 63 / 313,422, filed on February 24, 2022, entitled DEVICES, SYSTEMS, AND METHODS FOR IDENTIFYING CYBER ASSETS AND GENERATING CYBER RISK MITIGATION ACTION BASED ON DOMAIN REDIRECTS; -U.S. Provisional Patent Application No. 63 / 341,264, filed May 12, 2022, entitled DEVICES, SYSTEMS, AND METHODS FOR SUMMARIZING ANALYTIC OBSERVATIONS; -U.S. Provisional Patent Application No. 63 / 344,305, filed May 20, 2022, entitled DEVICES, SYSTEMS, AND METHODS FOR INGESTING & ENRICHING SECURITY INFORMATION TO AUTONOMOUSLY SECURE A PLURALITY OF TENANT NETWORKS; -U.S. Provisional Patent Application No. 63 / 345,679, filed May 25, 2022, entitled DEVICES, SYSTEMS, AND METHODS FOR IDENTIFYING CYBER ASSETS AND GENERATING CYBER RISK MITIGATION ACTIONS BASED ON A DEMOCRATIC MATCHING ALGORITHM; -International Patent Application No. PCT / US22 / 72739, filed on June 3, 2022, entitled DEVICES, SYSTEMS, AND METHODS FOR ENHANCING SECURITY INFORMATION & EVENT MANAGEMENT UPDATES FOR MULTIPLE TENANTS BASED ON CORRELATED, AND SYNERGISTIC DEPLOYMENT NEEDS; -International Patent Application No. PCT / US22 / 72743, entitled DEVICES, SYSTEMS, AND METHODS FOR STANDARDIZING & STREAMLINING THE DEPLOYMENT OF SECURITY INFORMATION & EVENT MANAGEMENT ARTIFACTS FOR MULTIPLE TENANTS, filed on June 3, 2022; - U.S. Provisional Patent Application No. 63 / 365,819, filed June 3, 2022, entitled DEVICES, METHODS, AND SYSTEMS FOR GENERATING A HIGHLY-SCALABLE, EFFICIENT COMPOSITE RECORD INDEX -U.S. Provisional Patent Application No. 63 / 353,992, filed June 21, 2022, entitled DEVICES, SYSTEMS, AND METHODS FOR CATEGORIZING, PRIORITIZING, AND MITIGATING CYBER SECURITY RISKS; -U.S. Provisional Patent Application No. 63 / 366,903, filed June 23, 2022, entitled DEVICES, SYSTEMS, AND METHOD FOR GENERATING AND USEING A QUERYABLE INDEX IN A CYBER DATA MODEL TO ENHANCE NETWORK SECURITY; -U.S. Provisional Patent Application No. 63 / 368,567, filed July 15, 2022, entitled DEVICES, SYSTEMS, AND METHODS FOR UTWORKED, COMPUTER-ASSISED, THREAT HUNTING PLATFORM TO ENHANCE NETWORK SECURITY; -U.S. Provisional Patent Application No. 63 / 369,582, filed on July 27, 2022, entitled AUTONOMOUS THREAT SCORING AND SECURITY ENHANCEMENT; -U.S. Provisional Patent Application No. 63 / 377,304, filed on September 27, 2022, entitled DEVICES, SYSTEMS, AND METHODS FOR CONULOUSLY ENHANCING THE IMPLEMENT OF CODE CHANGES VIA ENRICHED PIPELINES.

[0014] Numerous specific details are described in this disclosure to provide a thorough understanding of the overall structure, function, manufacture, and use of the embodiments described in the accompanying drawings. Well-known operations, components, and elements have not been described in detail so as not to obscure the embodiments described herein. The reader will understand that the embodiments described and illustrated herein are non-limiting embodiments. It will therefore be understood that the specific structural and functional details disclosed herein may be representative and illustrative. Changes and modifications can be made without departing from the scope of the claims. Furthermore, it should be understood that such terms as "front", "back", "left", "right", "upper", "lower", and similar terms are terms of convenience and should not be construed as limiting terms.

[0015] Numerous specific details are described in this disclosure to provide a thorough understanding of the overall structure, function, manufacture, and use of the embodiments described in the accompanying drawings. Well-known operations, components, and elements have not been described in detail so as not to obscure the embodiments described herein. The reader will understand that the embodiments described and illustrated herein are non-limiting embodiments. It will therefore be understood that the specific structural and functional details disclosed herein may be representative and illustrative. Changes and modifications can be made without departing from the scope of the claims. Furthermore, it should be understood that such terms as "front", "back", "left", "right", "upper", "lower", and similar terms are terms of convenience and should not be construed as limiting terms.

[0016] In the following description, like reference numerals indicate like or corresponding parts throughout the several views of the drawings, and it should be understood that in the following description, such terms as "front," "rear," "left," "right," "upper," "lower," etc. are terms of convenience and should not be construed as terms of limitation.

[0017] Before describing in detail the various aspects and methods of the system disclosed herein, it should be noted that the exemplary aspects are not limited in application or use to the details disclosed in the accompanying drawings and description. It should be understood that the exemplary aspects may be implemented or incorporated in other aspects, variations, and modifications, and may be practiced or carried out in various ways. Furthermore, unless otherwise indicated, the terms and expressions used herein have been selected for the purpose of describing the exemplary aspects for the convenience of the reader, and are not intended to be limiting thereof. For example, it will be understood that any reference to a particular manufacturer, software suite, application, or development platform disclosed herein is merely intended to illustrate some of the many aspects of the disclosure. This includes any reference to trademarks. Thus, it should be understood that the devices, systems, and methods disclosed herein can be implemented to enhance any software update according to any intended use and / or user preference.

[0018] As used herein, the term "server" may refer to or include one or more computing devices that operate through or facilitate communication and processing for multiple parties in a network environment, such as the Internet or any public or private network. As used herein, references to a "server" or "processor" may refer to the previously enumerated servers and / or processors that are enumerated as performing the previous steps or functions, different servers and / or processors and / or combinations of servers and / or processors.

[0019] As used herein, the term "tenant" may refer to one or more client organizations managed by a managed security service provider ("MSSP"). A tenant may include one or more servers configured to manage a network, such as an intranet, to which multiple client instances are connected. For example, as used herein, a "client" or "client instance" may include a computing device (e.g., a laptop, a desktop computer, a mobile phone, etc.) connected to the tenant's network. According to some non-limiting aspects, a "client" or "client instance" may be a software agent or a computing device outside the tenant's network that is connected via a virtual private network (VPN) connection.

[0020] As used herein, the term "constant" may refer to one or more SIEM functions that do not change during the issuance of an alert. For example, the constants may include Azure Sentinel Log Analytics functions, among others. According to some non-limiting aspects, the constants may be specifically configured according to the preferences and / or requirements of an individual client. For example, as described herein, the alert rules may be the same for all client deployments. However, the apparatus uses, systems, and methods disclosed herein may use client-specific constants to "fine-tune" how alerts are managed for each particular client. In other words, each constant may include a whitelist of specific protocols, accounts, etc., where the alert rule manages those constants separately (e.g., skips them).

[0021] As used herein, the term "network" may include the entire enterprise information technology (IT) system deployed by a tenant. For example, a network may include a group of two or more nodes (e.g., assets) connected by any physical and / or wireless connection and configured to communicate and share information with one or more other nodes. However, the term network is not limited to any particular node or any particular means of connecting the nodes. A network may include any combination of assets (e.g., devices, servers, desktop computers, laptop computers, personal digital assistants, mobile phones, wearables, smart appliances, etc.) connected to an Ethernet, intranet, and / or extranet and configured to communicate with each other via ad-hoc connections (e.g., Bluetooth, Near Field Communication (NFC), etc.), local area connections ("LANs"), wireless local area networks ("WLANs"), and / or virtual private networks ("VPNs") regardless of the physical location of each device. A network may further include any tools, applications, and / or services deployed by devices or otherwise utilized by enterprise IT systems, such as firewalls, email clients, document management systems, office systems, etc. In some non-limiting aspects, the "network" may include third-party devices, applications, and / or services that are owned and controlled by a third party, but that a tenant is authorized to access corporate IT systems.

[0022] As used herein, the term "platform" may include software architecture, hardware architecture, and / or combinations thereof. A platform may include any of a standalone software product, a network architecture, and / or a software product configured to be integrated into a software architecture and / or a hardware architecture as necessary to provide its technical benefits to the software product. For example, a platform may include any combination of chipsets, processors, logic-based devices, memory, storage, graphical user interfaces, graphics subsystems, applications, and / or communication modules (e.g., transceivers). In other words, a platform may provide the resources necessary to enable the technical benefits provided by the software. According to some non-limiting aspects, the technical benefits provided by the software are provided to the physical resources of the ecosystem or to other software employed by the physical resources (e.g., APIs, services, etc.) in the ecosystem. According to other non-limiting aspects, a platform may include a framework of several software applications intended and designed to function together.

[0023] Security information and event management ("SIEM") includes software configured to aggregate and analyze activity from many different resources across an information technology (IT) infrastructure. For example, a SIEM may be implemented to aggregate data from multiple systems and analyze the data to catch anomalous behavior or potential cyber attacks. For example, a SIEM may collect security data from network devices, servers, domain controllers, etc. A SIEM may be implemented to store, normalize, aggregate, and apply analytics to the data to detect trends, detect threats, and enable an organization to investigate any alerts. While known SIEM tools offer great functionality, including monitoring events, collecting data, and issuing security alerts across a network, such tools are typically customized to the implementing organization, or more specifically, to a particular network architecture, which can often be complex. Thus, SIEM can be expensive, resource intensive, and often difficult to resolve issues with SIEM data.

[0024] One example of a SIEM is Azure Sentinel, a widely used cloud-based tool. However, the deployment of Azure Sentinel requires advanced skills and at the same time is very time-consuming and can be error-prone. Each organization needing a security solution has specific needs regarding monitoring and alerting, such as ingest log sources, detection / alert rules, response automation, and reporting. Microsoft (MSFT) is often used by security service providers ("MSSPs") to manage multiple clients, but the complexity of the initial configuration, deployment, and ongoing maintenance of artifacts (e.g., resource groups, log analysis workspaces, alert rules, workbooks, playbooks, etc.) has increased significantly. This can result in high costs for both the MSSPs, who have to employ more expensive specialists, and the clients, who often bear at least part of the increasing expenses. However, there is often an overlap between some deployment needs of various clients. For example, many organizations may need similar firewall monitoring solutions. In such cases, reusing and redeploying (and updating) assets can lead to significant cost savings and operational simplification. Unfortunately, known SIEM tools are not technically capable of taking advantage of these synergies. As a result, from initial provisioning to automating incident response, MSSPs have limited opportunities for reuse across multiple clients and are unable to capture efficiencies.

[0025] Additionally, the need for scalable SIEM services entails a new need to rapidly provision or configure SIEM platforms so that MSSPs can immediately begin monitoring the security of new clients. Once configured, SIEMs must also be updated on a recurring (e.g., daily, weekly, monthly, etc.) and / or ad-hoc basis. As information technology requirements and security threats continually evolve, such SIEM updates must be able to accommodate new client needs (e.g., new log sources) and include new security content (e.g., alerts, playbooks, etc.). Thus, there is a need for improved devices, systems, and methods for provisioning and updating SIEM artifacts for multiple tenants. Such improvements may be provided via a hybrid platform configured to provision and update SIEMs for multiple tenants, regardless of scale. The platform should be able to easily configure SIEMs for new clients and manage SIEMs for existing clients using one or more repositories and scripting infrastructures generated and maintained by a graphical user interface without the need for manual revision of scripts. In other words, the systems and platforms disclosed herein should be fully automated to enable large-scale operations without the need for advanced operator expertise. Such systems and platforms can therefore reduce the level of maintenance and expense required by traditional MSSP and SIEM platforms.

[0026] The present disclosure contemplates such devices, systems, and methods, all of which provide numerous technical benefits over traditional MSSP and SIEM platforms. For example, traditional MSSP devices, systems, and methods lack the automation, artifacts, and interfaces necessary to seamlessly scale an MSSP platform to provide SIEM services to hundreds, if not thousands, of tenant networks. Rather, traditional MSSP devices, systems, and methods require manual integration and management, i.e., they are less efficient and more expensive. Furthermore, traditional MSSP devices, systems, and methods require each tenant network to share the manual resources employed by the MSSP, making each tenant network less secure. In contrast, the devices, systems, and methods disclosed herein are highly automated and thus configured to allow an MSSP to continuously monitor its tenant networks and clients in real time. Not only are traditional MSSP devices, systems, and methods technically unable to perform such automation, but it is highly impractical, if not impossible, for an MSSP to manually and continuously monitor hundreds, if not thousands, of tenant networks in real time. The devices, systems, and methods disclosed herein are also technically configured to be adaptable. This adaptability, combined with the high degree of scalability, allows MSSPs to track changes across a large number of tenant deployments, monitor responses to those changes, and autonomously implement them for any suitable tenant deployment that can similarly benefit. In other words, traditional MSSP devices, systems, and methods are inherently susceptible to security events and are therefore technically less secure than the devices, systems, and methods disclosed herein.

[0027] For example, the devices, systems, and methods disclosed herein may include (1) solution bundles (e.g., JavaScript Object Notation ("JSON")-based bundles, Yet Another Markup Language (YEM)-based bundles, and the like) of various Sentinel artifacts (e.g., resource groups, log analysis workspaces, data connectors, alert rules, playbooks, workbooks, etc.), which shall be referred to herein as "sentinel-in-a-box." (2) a visual interface for authorized users to select the desired sentinel-in-a-box bundle; (3) an action button to "deploy" the selected bundle to the user's desired SIEM subscription, which essentially creates all the necessary artifacts (e.g., resource groups, log analytics workspaces, etc.), configures the appropriate data connectors (specific to the selected bundle), and creates the analysis / alert rules, and any playbooks, workbooks, queries required for the solution as required by the specific bundled configuration; (4) configuring a back-end service operating center (SOC) to onboard new clients with well-defined automation rules in response to events triggered by alerts / detections configured for a specific bundle; and (5) an MSSP / CSP model where service providers with access to the client's Azure environment (e.g., via Azure Lighthouse, etc.) can deploy bundles on behalf of the client into each of the client's workspaces. Thus, the bundle provider only manages the relationship with the MSSP / CSP with sufficient filtering by client workspace that corresponds to a specific alert / incident. This can be important for efficient billing, support, and avoiding unnecessary client interactions.

[0028] Referring now to FIG. 1, a diagram of a system 1000 configured to enforce SIEM updates is shown in accordance with at least one non-limiting embodiment of the present disclosure. For example, according to some non-limiting embodiments, the system 1000 of FIG. 1 is similar to that disclosed in U.S. Provisional Patent Application No. 63 / 196,991, filed June 4, 2021, entitled "DEVICES, SYSTEMS, AND METHODS FOR STANDARDIZING & STREAMLINING THE DEPLOYMENT OF SECURITY INFORMATION & EVENT MANAGEMENT ARTIFACTS FOR MULTIPLE TENANTS." According to a non-limiting embodiment of FIG. 1, the system 1000 may include a SIEM provider server 1002 comprising a memory 1006 configured to store a SIEM management application 102 and a processor 1004 configured to execute the stored SIEM management application 102, as further discussed with reference to FIG. 2. For example, the SIEM provider server 1002 may be a computing resource owned or leased by the MSSP. The SIEM provider server 1002 can be communicatively coupled to a number of tenants 1010a, 1010b-1010n via a network 1008. Each of the number of tenants 10101, 10102-1010n can represent a customer (e.g., an organization) that has a contract with the MSSP. According to a non-limiting embodiment of FIG. 1, the network 1008 can include any of a variety of wired, long-range wireless, and / or short-range wireless networks. For example, the network 1008 can include an internal intranet, a local area network (LAN), WiFi, a cellular network, a near field communication (NFC), and the like.

[0029] 1, each of the multiple tenants 10101, 10102-1010n can host one or more instances of one or more clients 1012, 1014, 1016. For example, a first tenant 10101 may include one or more machines implementing one or more client applications 10121, 10122-1012n, a second tenant 10102 may include one or more machines implementing one or more client applications 10141, 10142-1014n, and / or a third tenant 1010n may include one or more machines implementing one or more client applications 10161, 10162-1016n. Each tenant 10101, 10102, and 1010n may include, for example, an intranet in which each machine implements a client application, where each tenant 10101, 10102, and 1010n may each represent a customer, such as an organization that contracts with the MSSP for security services. Thus, the SIEM provider server 1002 may be configured to have oversight of each of the multiple tenants 10101, 10102, and 1010n, and therefore is responsible for monitoring and managing each client application 1012, 1014, and 1016 against threats. As previously mentioned, the differences and complexities in the tenant 10101, 10102, and 1010n architectures may make this complicated and inefficient for the MSSP. Thus, known SIEM tools may leave the tenants 10101, 10102, and 1010n technically exposed and therefore vulnerable to attacks. According to non-limiting aspects of the present disclosure, the SIEM provider server 1002 can implement a SIEM management application 102 that addresses these deficiencies technically and practically by enhancing the SIEM provider server's 1002 management and alert sending capabilities, as well as client application update capabilities, for multiple tenants based on correlation and synergistic development needs.

[0030] Referring now to Figure 2, a deployment architecture 2000 employed by the system 1000 of Figure 1 is illustrated in accordance with at least one non-limiting aspect of the present disclosure. According to the non-limiting aspect of Figure 2, a user 2002 (e.g., an MSSP) can access an MSSP platform 2004 that includes a graphical user interface with a number of widgets 2006a-e, 2008a-e through which the user 2002 can initiate provisioning and / or updates of SIEMs for a number of tenants 10101-n (Figure 1). The MSSP platform 2004 can be stored in the memory 1006 of the SIEM provider server 1002 (Figure 1), and when executed by the processor 1004 (Figure 1) of the SIEM provider server 1002 (Figure 1), the graphical user interface can be presented on a display communicatively coupled to the SIEM provider server 1002 (Figure 1). According to some non-limiting aspects, the MSSP platform 2004 of FIG. 2 may be similar to that disclosed in U.S. Provisional Patent Application No. 63 / 196,458, filed June 3, 2021, entitled “DEVICES, SYSTEMS, AND METHODS FOR ENHANCING SECURITY INFORMATION & EVENT MANAGEMENT UPDATES FOR MULTIPLE TENANTS BASED ON CORRELATED, AND SYNERGISTIC DEPLOYMENT NEEDS.” However, the MSSP platform 2004 of FIG. 2 may include alternative mechanisms for facilitating enhanced SIEM provisioning, management, and updates, as described in further detail herein. In other words, the MSSP management platform 2004 may include a visual representation, or “dashboard,” configured to display data, trends, and / or anomalies associated with security activities and events across multiple tenants 10101-n (FIG. 1). Further illustrated are different communication lines 2022, 2024 between the system components of the architecture.For example, the first communication line 2022 may represent one component of a hybrid-based approach in which a user interacts with a portal, such as that disclosed in U.S. Provisional Patent Application No. 63 / 196,458, filed June 3, 2021, entitled "DEVICES, SYSTEMS, AND METHODS FOR ENHANCING SECURITY INFORMATION & EVENT MANAGEMENT UPDATES FOR MULTIPLE TENANTS BASED ON CORRELATED, AND SYNERGISTIC DEPLOYMENT NEEDS," the disclosure of which is incorporated herein by reference in its entirety, to directly provision and manage content within the target SIEM. The other communication line 2024 can facilitate background processes. For example, according to one non-limiting aspect of the present disclosure, a command line utility such as a cron job can be scheduled to continually read the SIEM of tenants 10101-n (FIG. 1) and update the state of that tenant's 10101-n (FIG. 1) SIEM (e.g., updating deployed SIEM artifacts according to what is maintained in a client-specific repository such as content repository 2010).

[0031] According to non-limiting aspects of FIG. 2, the SIEM provider server 1002 (FIG. 1) may be communicatively coupled to a content repository 2010 that may be accessed by a user 2002 via an MSSP platform 2004. The content repository 2010 may enable the user 2002 to search and retrieve such content via the MSSP management platform 2004. Additionally, the content repository 2010 may be configured to actively interface with the MSSP management platform 2004 such that the MSSP platform 2004 may autonomously access, correlate, and implement content in the repository 2010 for tenant-specific configuration. The MSSP platform 2004, in conjunction with the content repository 2010, may provide visibility into available artifacts for tenant 10101-n (FIG. 1)-specific SIEM deployments, available changes for SIEM deployments, and various other deployment tasks. According to some non-limiting aspects, the content repository 2010 may be client-specific. However, according to other non-limiting aspects, the content repository 2010 may be provided via a third party (e.g., Splunk, Sentinel, GitHub, etc.) In any case, the content repository 2010 may be a database configured to store digital content such as artifacts and / or SIEM configuration and management solutions (e.g., resource groups, log analysis workspaces, data connectors, alert rules, playbooks, workbooks, etc.).For example, the artifacts may include alert rules, playbooks, workbooks, data connectors, and / or parsers disclosed in U.S. Provisional Patent Application No. 63 / 196,458, entitled "DEVICES, SYSTEMS, AND METHODS FOR ENHANCING SECURITY INFORMATION & EVENT MANAGEMENT UPDATES FOR MULTIPLE TENANTS BASED ON CORRELATED, AND SYNERGISTIC DEPLOYMENT NEEDS," filed June 3, 2021, the disclosure of which is incorporated herein by reference in its entirety. According to other non-limiting aspects, the artifacts may include Splunk artifacts such as correlations, dashboards, searches, etc.

[0032] For example, the content repository 2010 can store a workbook that can assist in visualizing data associated with each of the clients 1012a-n, 1014a-n, 1016a-n of the multiple tenants 10101-n (FIG. 1). Additionally and / or alternatively, the content repository 2010 can store playbooks or protocols that can be executed by the SIEM provider server 1002 and / or the tenants 10101-n (FIG. 1) in response to security events and / or alerts toward the MSSP platform 2004. Generally, the SIEM configuration 2018 can be configured to protect a network on behalf of each of the tenants 10101-n (FIG. 1). For example, the SIEM configuration 2018 can monitor the network for security events and take action to protect the network. According to some non-limiting aspects, the action can include issuing an alert to the MSSP user 2002 and / or an administrative account for the tenants 10101-n (FIG. 1). However, according to some non-limiting aspects, the SIEM configuration 2018 can identify and remove suspicious accounts from the tenant 1010n-1 network based on one or more artifacts.

[0033] For example, according to certain non-limiting aspects, an artifact may include an alert rule (e.g., a Sentinel alert) or a correlation (e.g., a Splunk correlation), any of which may query certain logs for certain anomalies on a set schedule and alert a SIEM accordingly (e.g., issue an alert and / or generate a security incident upon triggering the rule and / or correlation). According to a hybrid approach contemplated by the present disclosure, the aforementioned mechanisms may be applied to any of the artifacts disclosed herein, although certain provisioning details may be attenuated (e.g., an API may be used to push the artifact to a SIEM, on-the-fly variable substitution / customization may be employed, etc.).

[0034] As previously discussed, the MSSP management platform 2004 may include a graphical user interface including a number of widgets 2006a-e, 2008a-e that allow the user 2002 to initiate SIEM provisioning and / or updates for the multiple tenants 10101-n (FIG. 1). For example, according to certain non-limiting aspects, the graphical user interface of the MSSP management platform 2004 of FIG. 2 is similar to any of the graphical user interfaces disclosed in U.S. Provisional Patent Application No. 63 / 196,991, filed June 4, 2021, and entitled “DEVICES, SYSTEMS, AND METHODS FOR STANDARDIZING AND STREAMLINING THE DEPLOYMENT OF SECURITY INFORMATION AND EVENT MANAGEMENT ARTIFACTS FOR MULTIPLE TENANTS.” 2, the graphical user interface can include a first plurality of widgets 2006a-e, where each widget 2006a-e of the first plurality of widgets 2006a-e corresponds to a tenant 10101-n (FIG. 1) of the plurality of tenants 10101-n (FIG. 1). Additionally, the graphical user interface can include a second plurality of widgets 2008a-e, where each widget 2008a-e of the second plurality of widgets 2008a-e corresponds to a SIEM configuration and / or a SIEM status for each tenant 10101-n (FIG. 1) of the plurality of tenants 10101-n (FIG. 1).

[0035] With further reference to FIG. 2, the MSSP management platform 2004 and the SIEM provider server 1002 can be configured to provision the SIEM configuration 2018 to the tenant network 2020 of one or more new tenants 10101-n (FIG. 1). For example, according to a non-limiting embodiment of FIG. 2, the MSSP management platform 2004 can prompt the user 2002 to select and / or create a desired tenant 10101-n (FIG. 1) profile, as well as specific artifacts (e.g., alert rules, playbooks, workbooks, etc.) to deploy from the content repository 2010 for the configuration on the selected tenant 10101-n (FIG. 1). Upon receiving input from the user 2002, the MSSP management platform 2004 can autonomously generate and aggregate the required scripts, customized content, and any other artifacts required into the tenant-specific repository 2012.

[0036] For example, the content repository 2010 can store a catalog of artifacts (e.g., alert rules, workbooks, etc.) either in a form directly consumable by the target SIEM or at a level of abstraction that allows the portal to convert to the target SIEM format via direct conversion (e.g., YAML to JSON). According to other non-limiting aspects, more complex conversions can pull client-specific information from the target SIEM (e.g., subscription identifiers, workspace names, Sentinel resource group names, etc.) and perform necessary customization during conversion. When the target SIEM artifact format changes, the conversion can be updated once and automatically applied to all applicable tenants 10101-n (FIG. 1) without the need to manually update each deployed artifact. In essence, the architecture 2000 allows connected portals to access and retrieve all of the target SIEM information, so that artifact preparation can be fully automated across multiple tenants 10101-n (FIG. 1) based on defined mappings and conversions of artifact types. Thus, regardless of the number of instances of each artifact, architecture 2000 can simultaneously prepare and deploy a large number (e.g., 500) of alert rules regardless of the identity of tenants 10101-n (Figure 1) (e.g., client-specific values ​​are parameterized and substituted during the conversion from catalog artifact to deployable artifact).

[0037] The use of the tenant-specific repository 2012 distinguishes the SIEM provider server 1002 and the MSSP management platform 2004 from traditional MMSP tools because instead of actually deploying content from the repository 2010 directly to the tenants 10101-n (FIG. 1), the tenants 10101-n (FIG. 1) pull content from the tenant-specific repository 2012 that has been intelligently and autonomously curated by the MSSP management platform 2004 for the particular tenant 10101-n (FIG. 1). Alternatively, the MSSP management platform 2004 may include a scripting engine configured to push content from the tenant-specific repository 2012 to the tenants 10101-n (FIG. 1). For example, the scripting engine may include code that takes content from the repository 2010 and pushes it to the SIEM provider server 1002. This may be accomplished via APIs in a variety of languages ​​(e.g., Python, JavaScript, Node JavaScript, Terraform scripts, PowerShell scripts with ARM templates, etc.).

[0038] In other words, the MSSP management platform 2004 may be specifically configured to autonomously deploy an initial SIEM configuration 2018 on behalf of the tenants 10101-n (FIG. 1) or to provide the SIEM configuration 2018 in a tenant-specific repository 2012 for spontaneous deployment by the tenants 10101-n (FIG. 1) depending on the preferences of the tenants 10101-n (FIG. 1). In either case, the MSSP management platform 2004 may generate a custom SIEM configuration 2018 for a particular tenant 10101-n (FIG. 1) that is provisioned to the tenants 10101-n (FIG. 1). In particular, the MSSP management platform 2004 and SIEM provider server 1002 of FIG. 2 may facilitate provisioning of the SIEM configuration 2018 to new tenants 10101-n (FIG. 1) without the need for the user 2002 to write new scripts or modify existing scripts to match the particular environment and / or deployment needs of the tenants 10101-n (FIG. 1).

[0039] Additionally, the architecture 2000 of FIG. 2 may further include a SIEM update engine 2014 of the MSSP management platform 2004, and the SIEM provider server 1002 of FIG. 2 may be configured to update artifacts stored in the tenant-specific repository 2012 and / or the content repository 2010.

[0040] For example, according to some non-limiting aspects, a content repository 2010, such as Gitlab, can be configured with a WebHook that can notify the portal of any content changes (e.g., new alert rules, new playbooks, etc.) that are being added to the content repository 2010. Thus, the architecture 2000 of FIG. 2 can update files of existing artifacts, and the portal can read the changes in the content repository 2010, analyze those changes, and depending on what the specific needs of each tenant 10101-n (FIG. 1) are, the architecture 2000 can perform the appropriate compare / merge and preparation of delta updates for each tenant repository. In other words, in response to the WebHook notification from the content repository 2010, the portal can generate and push these updates to each tenant 10101-n (FIG. 1) repository, so that each tenant 10101-n (FIG. 1) artifact is updated based on the changes in the SIEM content repository 2010.

[0041] According to a non-limiting aspect of FIG. 2, the update engine 2014 may be configured to evaluate an existing SIEM configuration 2018, compare one or more SIEM configurations 2018 deployed across one or more tenants 10101-n (FIG. 1), notify the MSSP, and autonomously determine whether to retain or reject any proposed changes to the existing tenant-specific SIEM configuration 2018. As content is updated, the changes are registered via the MSSP management platform 2004 and displayed via a graphical user interface and / or by a job scheduling engine 2016, such as a cron command line utility or equivalent. In some non-limiting aspects, the job scheduling engine 2016 may be provided by a third party. Thus, the MSSP management platform 2004 and SIEM provider server 1002 can autonomously ensure that the tenant-specific repository 2012 has the most up-to-date SIEM configuration 2018 for the tenants' 10101-n (FIG. 1) specific environments and / or deployment needs, thereby preparing the tenant-specific repository 2012 for the provision of future SIEM configurations 2018 and / or updates.

[0042] 2, the SIEM provider server 1002 may be configured to monitor the tenant-specific repositories 2012 and / or the content repositories 2010 for content changes via custom callbacks. For example, according to some non-limiting aspects, the MSSP management server 1002 may autonomously initiate periodic webhooks and / or queries for content changes in the tenant-specific repositories 2012 and / or the content repositories 2010, correlate and evaluate any detected changes for applicability to each tenant-specific repository 2012, and facilitate programmatically pushing each change to the applicable tenant-specific repositories 2012 upon determining that the detected changes are applicable to the tenant-specific repositories 2012. Further differentiating the MSSP management platform 2004 and the SIEM provider server 1002 from traditional devices is the ability to update the tenant-specific repositories 2012 without requiring custom code. Additionally, the MSSP management platform 2004 and SIEM provider server 1002 provide a simultaneous “one-click” SIEM update process for multiple tenants 10101-n (FIG. 1) regardless of their particular environments or deployment needs, due to the highly scalable nature of the system 1000 (FIG. 1), as further described in U.S. Provisional Patent Application No. 63 / 196,458, entitled “DEVICES, SYSTEMS, AND METHODS FOR ENHANCING SECURITY INFORMATION & EVENT MANAGEMENT UPDATES FOR MULTIPLE TENANTS BASED ON CORRELATED, AND SYNERGISTIC DEPLOYMENT NEEDS,” filed on June 3, 2021, the disclosure of which is incorporated by reference in its entirety herein.

[0043] Similar to the initial provisioning of the SIEM configuration 2018 to the tenants 10101-n (FIG. 1), when content and / or artifacts in the tenant-specific repository 2012 are updated, the deployment of the system 1000 (FIG. 1) may be configured to update artifacts for any of the previously provisioned SIEM configurations 2018 for any of the multiple tenants 10101-n. Specifically, the tenants 10101-n (FIG. 1) may intelligently and autonomously pull updated content from the tenant-specific repository 2012 via the update engine 2014 of the particular tenant 10101-n (FIG. 1). Alternatively, the MSSP management platform 2004 may include a scripting engine configured to push updated content from the tenant-specific repository 2012 to the tenants 10101-n (FIG. 1). In other words, the MSSP management platform 2004 may be specifically configured to autonomously update the SIEM on behalf of the tenants 10101-n (FIG. 1) or provide the SIEM configuration 2018 to the tenant-specific repository 2012 for spontaneous deployment by the tenants 10101-n (FIG. 1) according to the preferences of the tenants 10101-n (FIG. 1). According to some non-limiting aspects, updates to the SIEM configuration 2018 may be managed according to the lifecycle management of the tenants 10101-n (FIG. 1), meaning that the 10101-n (FIG. 1) may approve the changes to be first pushed to the tenant-specific repository 2012 before being deployed to the SIEM configuration 2018 itself. In either case, the MSSP management platform 2004 may customize and deploy updates to the SIEM configuration 2018 for a particular tenant 10101-n (FIG. 1).

[0044] For example, according to certain non-limiting aspects, the MSSP management server 1002 may include a scripting engine configured to generate scripts (e.g., repository command references, repository “commit” commands, etc.) that autonomously initiate periodic web hooks and / or queries for content changes in the tenant-specific repositories 2012 and / or content repositories 2010, and correlate and evaluate any detected changes for applicability to each tenant-specific repository 2012. Upon determining that the detected changes are applicable to the tenant-specific repositories 2012, the MSSP management server 1002 may programmatically push each change to the tenant-specific repository 2012 where it is applied. This approach may be further enhanced to allow the tenant-specific repositories 2012 to be shared among a group of tenants 10101-n (FIG. 1) having similar environments and / or deployment needs.

[0045] According to some non-limiting aspects, tenants 10101-n (FIG. 1) may want to make changes in their own environments. For example, tenants 10101-n (FIG. 1) may choose to modify and / or remove deployed alert rules, workbooks, etc. The job scheduling engine 2016, e.g., a regular cron job, can detect tenant 10101-n (FIG. 1) initiated profile changes and notify the MSSP via the MSSP management platform 2004. The MSSP can then decide whether to keep the tenant 10101-n (FIG. 1) initiated changes by providing input via a graphical user interface. Additionally, the MSSP management platform 2004 can allow the MSSP to lock tenant 10101-n (FIG. 1) initiated changes from automatic updates or overtly reject them such that future implemented updates to the SIEM configuration 2018 override the tenant 10101-n (FIG. 1) initiated changes.

[0046] With further reference to FIG. 2, the architecture 2000 and the system 1000 in which it is implemented (FIG. 1) may enable a user 2002 to perform large-scale deployments and updates of SIEM configurations 2018 and monitor changes to the deployed SIEM configurations 2018 across multiple tenants 10101-n (FIG. 1) via a tenant-specific repository 2012. In conjunction with other SIEM portals, such as those disclosed in U.S. Provisional Patent Application No. 63 / 196,458, filed June 3, 2021, entitled “DEVICES, SYSTEMS, AND METHODS FOR ENHANCING SECURITY INFORMATION & EVENT MANAGEMENT UPDATES FOR MULTIPLE TENANTS BASED ON CORRELATED, AND SYNERGISTIC DEPLOYMENT NEEDS,” the disclosure of which is incorporated herein by reference in its entirety, may provide the user 2002 with complete management of the deployed SIEM configurations 2018. However, the architecture 2000 of FIG. 2 provides a further enhancement, integrating the portal and user interface with a scripted approach that allows updates without user 2002 intervention. According to certain non-limiting aspects, the approach can be audited by tenants 10101-n (FIG. 1). Thus, user 2002 can track changes per deployment and / or roll back previously deployed changes in a much more efficient and scalable manner than conventional systems.

[0047] Additionally and / or alternatively, the architecture 2000 and the system 1000 (FIG. 1) in which it is implemented may enable tenants 10101-n (FIG. 1) to control their own SIEM configuration 2018 and modify artifacts deployed by the MSSP management platform 2004. However, the MSSP management platform 2004 may detect tenant 10101-n (FIG. 1) initiated changes, capture them in a tenant-specific repository 2012, and generate and maintain an update history of the SIEM configuration 2018, while allowing users 2002 to easily review and lock tenant 10101-n (FIG. 1) initiated changes.

[0048] Currently, virtually all deployments are done manually or, if done via code (e.g., scripts), the MSSP must update the code with client-specific information. This makes the traditional system prone to errors and requires a high degree of skill and understanding of the content being updated. As previously mentioned, initial provisioning of a SIEM via a traditional SIEM platform requires the MSSP to manually input client-specific information such as deployment location, certificates, and deployment content (e.g., alert rules, etc.). However, while traditional SIEM platforms provide clients with a graphical user interface through which the initial SIEM provisioning and configuration is performed, the MSSP platform 2004 of FIG. 2 can autonomously generate custom deployment scripts (e.g., via ARM templates, terraform, powershell, etc.) to programmatically perform the initial SIEM provisioning and configuration.

[0049]

[0036] Referring now to Figure 3, a method 3000 for provisioning and updating security information and event management artifacts according to at least one non-limiting aspect of the present disclosure. According to the non-limiting aspect of Figure 3, the method 3000 may be performed by the SIEM provider server 1002 (Figures 1 and 2). Specifically, the MSSP management platform 2004 (Figure 2) stored in the memory 1006 (Figure 1) may cause the processor 1004 (Figure 1) of the SIEM provider server 1002 (Figures 1 and 2) to perform the method 3000. Referring now to Figures 1-3, in one aspect of the method 3000, the MSSP platform 2004 (Figure 2) may include a 3002 graphical user interface that displays a plurality of widgets, at least one widget of the plurality of widgets being associated with a tenant network 2020 (Figure 2). The SIEM provider server 1002 (FIGS. 1 and 2) autonomously retrieves 3004 SIEM artifacts associated with the tenant network 2020 (FIG. 2) from a content repository 2010 (FIG. 2) communicatively coupled to the SIEM provider server 1002 (FIGS. 1 and 2). The SIEM provider server 1002 (FIGS. 1 and 2) generates 3006 a tenant-specific SIEM configuration for the tenant network 2020 (FIG. 2) including the SIEM artifacts. The SIEM provider server 1002 (FIGS. 1 and 2) deploys 3008 the tenant-specific SIEM configuration to the tenant network 2020 (FIG. 2) via a tenant-specific repository 2012 (FIG. 2) communicatively coupled to the SIEM provider server 1002 (FIGS. 1 and 2). According to some non-limiting aspects, method 3000 may further include updating tenant-specific SIEM configurations, continuously monitoring tenant network 2020 (FIG. 2) for security events, and / or autonomously taking action to protect tenant network 2020 (FIG. 2) upon detecting a security event.

[0050] Various aspects of the subject matter described herein are set forth in the following numbered sections.

[0051] Section 1 1. A security information and event management ("SIEM") provider server configured to enhance network security on behalf of a tenant network by autonomously generating and providing a SIEM configuration to the tenant network, the SIEM provider server comprising: a processor; and a memory storing machine-executable instructions that, when executed by the processor, implement a managed security service provider ("MSSP") management system that causes the processor to provide a graphical user interface displaying a plurality of widgets, at least one widget of the plurality of widgets being associated with the tenant network; autonomously retrieve SIEM artifacts associated with the tenant network from a content repository communicatively coupled to the SIEM provider server; generate a tenant-specific SIEM configuration for the tenant network including the SIEM artifacts, the tenant-specific SIEM configuration being configured to continuously monitor the tenant network for security events and, upon detecting a security event, autonomously take action to protect the tenant network; and deploy the tenant-specific SIEM configuration to a tenant-specific repository associated with the tenant network for configuration on the tenant network.

[0052] Section 2 13. The SIEM provider server of claim 1, wherein the tenant network is one of a plurality of tenant networks, the tenant-specific SIEM configuration is one of a plurality of tenant-specific SIEM configurations generated by the SIEM provider server, and the SIEM provider server is configured to simultaneously deploy and update each SIEM configuration of the plurality of SIEM configurations on behalf of each tenant network of the plurality of tenant networks.

[0053] Section 3 3. The SIEM provider server of claim 1 or 2, wherein the action includes autonomously removing the suspicious account from the tenant network.

[0054] Section 4 4. The SIEM provider server of any of claims 1 to 3, wherein a target tenant is configured to pull tenant-specific SIEM configuration from a tenant-specific repository.

[0055] Section 5 5. The SIEM provider server of any of claims 1 to 4, wherein the MSSP management platform is configured to push tenant-specific SIEM configurations from the tenant-specific repository to target tenants.

[0056] Section 6 6. The SIEM provider server of any one of claims 1 to 5, further comprising a scripting engine configured to generate scripts configured to autonomously initiate periodic queries for content changes in a tenant-specific repository.

[0057] Section 7 7. The SIEM provider server of any of claims 1 to 6, wherein the script is a repository "commit" command.

[0058] Section 8 8. The SIEM provider server of any of claims 1 to 7, wherein when executed by the processor, the MSSP management platform further causes the processor to receive a response to the query generated by the script engine, determine that the SIEM configuration includes a tenant-initiated change based on the received response, and autonomously determine to reject the tenant-initiated change to the existing tenant-specific SIEM configuration.

[0059] Section 9 1. A method for enhancing network security on behalf of a tenant network by autonomously generating and providing a SIEM configuration to the tenant network via a security information and event management (SIEM) provider server, the method including: displaying, via a graphical user interface, a plurality of widgets, at least one widget of the plurality of widgets being associated with the tenant network; autonomously retrieving, via the SIEM provider server, SIEM artifacts associated with the tenant network from a content repository communicatively coupled to the SIEM provider server; generating, via the SIEM provider server, a tenant-specific SIEM configuration for the tenant network including the SIEM artifacts; deploying, via the SIEM provider server, the tenant-specific SIEM configuration to the tenant network via a tenant-specific repository communicatively coupled to the SIEM provider server; continuously monitoring the tenant network for security events via the SIEM configuration; and upon detecting a security event via the SIEM configuration, autonomously taking action to protect the tenant network.

[0060] Section 10 10. The method of claim 9, wherein the tenant network is one of a plurality of tenant networks and the tenant-specific SIEM configuration is one of a plurality of tenant-specific SIEM configurations generated by a SIEM provider server, the method further including: simultaneously deploying, via the SIEM provider server, each SIEM configuration of the plurality of SIEM configurations to each tenant network of the plurality of tenant networks; and simultaneously updating, via the SIEM provider server, each SIEM configuration of the plurality of SIEM configurations on behalf of each tenant network of the plurality of tenant networks.

[0061] Section 11 11. The method of any of clauses 9 or 10, wherein autonomously taking action includes autonomously removing suspicious accounts from the tenant network via a SIEM configuration.

[0062] Section 12 12. The method of any of clauses 9-11, further comprising: pulling, via the target tenant, a tenant-specific SIEM configuration from a tenant-specific repository.

[0063] Section 13 13. The method of any of clauses 9 to 12, further comprising pushing tenant-specific SIEM configuration from the tenant-specific repository to the target tenant via a SIEM provider server.

[0064] Section 14 14. The method of any of clauses 9 to 13, further comprising autonomously generating, via a scripting engine, a script configured to autonomously initiate periodic queries for content changes in a tenant-specific repository.

[0065] Section 15 15. The method of any of clauses 9 to 14, wherein the script is a repository commit command.

[0066] Section 16 16. The method of any of claims 9 to 15, further comprising: receiving, via the SIEM provider server, a response to at least one query initiated by the script engine; determining, via the SIEM provider server, that the SIEM configuration includes a tenant-initiated change based on the received response; and autonomously determining, via the SIEM provider server, to reject the tenant-initiated change to an existing tenant-specific SIEM configuration.

[0067] Section 17 11. A system for enhancing network security, the system comprising: a centralized content repository; a plurality of tenant-specific repositories; a plurality of tenants configured to host a plurality of clients; and a security information and event management (SIEM) provider server communicatively coupled to the plurality of tenants, the SIEM provider server comprising: a processor; and a memory configured to store, when executed by the processor, a graphical user interface displaying a plurality of widgets, where each widget of the plurality of widgets is associated with a tenant of the plurality of tenants, receive user input via the graphical user interface associated with a target tenant of the plurality of tenants, autonomously retrieve SIEM artifacts associated with the target tenant from the content repository, generate a tenant-specific SIEM configuration for the target tenant including the SIEM artifacts, the tenant-specific SIEM configuration configured to continuously monitor the target tenant for security events and, upon detecting a security event, autonomously take action to protect the target tenant, and deploy the tenant-specific SIEM configuration to the tenant-specific repository of a plurality of tenant-specific repositories associated with the target tenants.

[0068] Section 18 18. The system of clause 17, wherein the tenant-specific SIEM configuration is one of a plurality of tenant-specific SIEM configurations generated via the SIEM provider server for each tenant of the plurality of tenants, and the SIEM provider server is configured to simultaneously deploy and update the plurality of tenant-specific SIEM configurations on behalf of each tenant of the plurality of tenants.

[0069] Section 19 19. The system of claim 17 or 18, wherein the measures to protect the target tenant include autonomously removing suspicious accounts from the target tenant's network.

[0070] Section 20 20. The system of any of claims 17 to 19, wherein the memory of the SIEM provider server is further configured to store a scripting engine that, when executed by the processor, causes the processor to generate a script configured to autonomously initiate periodic queries for content changes in multiple tenant-specific repositories.

[0071] All patents, patent applications, publications, or other disclosure materials described herein are incorporated herein by reference in their entirety, as if each individual reference were expressly incorporated by reference. All references and any material, or portions thereof, that are said to be incorporated herein by reference are incorporated herein only to the extent that the incorporated material does not contradict existing definitions, descriptions, or other disclosed material set forth in this disclosure. Therefore, and to the extent necessary, the present disclosure set forth herein takes precedence over any conflicting material incorporated herein by reference, and the present disclosure is expressly set forth within the control of this application.

[0072] Various exemplary and illustrative embodiments have been described. The embodiments described herein are understood to provide illustrative features of various details of the various embodiments of the present disclosure, and therefore, unless otherwise specified, it is to be understood that, to the extent possible, one or more features, elements, components, ingredients, materials, structures, modules, and / or aspects of the embodiments of the present disclosure may be combined, separated, substituted, and / or rearranged with or for one or more other features, elements, components, ingredients, materials, structures, modules, and / or aspects of the embodiments of the present disclosure without departing from the scope of the present disclosure. Thus, one skilled in the art will recognize that various substitutions, modifications, or combinations of any of the exemplary embodiments may be made without departing from the claimed subject matter. Moreover, one skilled in the art will recognize or be able to ascertain, upon review of this specification, many equivalents to the various embodiments of the present disclosure using no more than routine experimentation. Thus, the present disclosure is not limited by the description of the various embodiments, but only by the scope of the claims.

[0073] Those skilled in the art will recognize that the terms used herein in general, and in the appended claims in particular (e.g., the body of the appended claims), are generally intended as "open-ended" terms (e.g., the term "including" should be interpreted as "including but not limited to," the term "having" should be interpreted as "having at least," the term "includes" should be interpreted as "including but not limited to," etc.). It will be further understood by those skilled in the art that where recitation of a particular number of introduced claims is intended, such intent will be expressly recited in the claims, and in the absence of such recitation, no such intent exists. For example, as an aid to understanding, the following appended claims may include the use of the introductory phrases "at least one" and "one or more" to introduce the recitation of claims. However, the use of such phrases should not be construed as implying that the introduction of a claim recitation with the indefinite article "a" or "an" limits any particular claim that includes such an introduced claim recitation to claims that include only one of such recitations, even when the same claim includes the introductory phrases "one or more" or "at least one" and an indefinite article such as "a" or "an" (e.g., "a" and / or "an" should ordinarily be construed to mean "at least one" or "one or more").

[0074] Furthermore, even if a particular number of enumerations in an introduced claim are explicitly recited, one of ordinary skill in the art will recognize that such enumerations should typically be interpreted to mean at least the number recited (e.g., the mere enumeration of "two enumerations," without other modifiers, typically means at least two enumerations or more than two enumerations). Furthermore, in those cases where a convention similar to "at least one of A, B, and C, etc." is used, such a structure is generally intended in the sense that one of ordinary skill in the art would understand the convention (e.g., "a system having at least one of A, B, and C" includes, but is not limited to, A alone, B alone, C alone, a system having A and B together, a system having A and C together, a system having B and C together, and / or a system having A, B, and C together, etc.). In instances where a convention similar to "at least one of A, B, or C, etc." is used, such construction is generally intended in the sense that one of ordinary skill in the art would understand the convention (e.g., "a system having at least one of A, B, or C" includes, but is not limited to, A alone, B alone, C alone, a system having A and B together, a system having A and C together, a system having B and C together, and / or a system having A, B, and C together, etc.). It will be further understood by those of ordinary skill in the art that disjunctions and / or phrases, whether in the description, claims, or drawings, that typically present two or more alternative terms, should be understood to contemplate the possibility of including one of the terms, either of the terms, or both terms, unless the context dictates otherwise. For example, the phrase "A or B" will typically be understood to include the possibilities of "A" or "B" or "A and B."

[0075] With respect to the appended claims, those skilled in the art will appreciate that the actions recited therein may generally occur in any order. Also, while the claim recitations are presented in order(s), it should be understood that various actions may occur in other orders than those described, or may occur simultaneously. Examples of such alternative orders include overlapping, interleaving, interrupting, reordering, incremental, preparatory, supplementary, simultaneous, reverse, or other variant orders, unless the context dictates otherwise. Moreover, terms such as "responsive," "related to," or other past tense adjectives are generally not intended to exclude such variants, unless the context dictates otherwise.

[0076] It should be noted that any reference to "one embodiment," "embodiment," "exemplary," "one example," and the like means that a particular feature, structure, or characteristic described in connection with an embodiment is included in at least one embodiment. Thus, the appearances of the phrases "in one embodiment," "in an embodiment," "in an example," and "in one example" in various places throughout this specification do not necessarily all refer to the same embodiment. Furthermore, the particular features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0077] As used herein, the singular forms "a," "an," and "the" include plural references unless the context clearly dictates otherwise.

[0078] Directional terms used herein, such as, for example, but not limited to, up, down, left, right, below, above, front, back, and variations thereof, relate to the orientation of the elements as shown in the accompanying drawings and are not intended to be limiting with respect to the claims, unless expressly stated otherwise.

[0079] The term "about" or "approximately" as used in this disclosure, unless otherwise specified, refers to an acceptable error for a particular value as determined by one of ordinary skill in the art, which depends in part on how the value is measured or determined. In certain embodiments, the term "about" or "approximately" refers to within 1, 2, 3, or 4 standard deviations. In certain embodiments, the term "about" or "approximately" refers to within 50%, 200%, 105%, 100%, 9%, 8%, 7%, 6%, 5%, 4%, 3%, 2%, 1%, 0.5%, or 0.05% of a given value or range.

[0080] As used herein, unless otherwise indicated, all numerical parameters are to be understood as being predicated and, in all instances, the numerical parameter should be understood to be modified by the term "about" given the inherent variability characteristic of the underlying measurement technique used to determine the numerical value of the parameter. At the very least, and not as an attempt to limit the application of the doctrine of equivalents to the scope of the claims, each numerical parameter set forth herein should at least be construed in light of the number of reported significant digits and by applying ordinary rounding techniques.

[0081] Any numerical range recited herein includes all subranges subsumed within the recited range. For example, a range of 1 to 100 includes all subranges between (and including) the recited minimum value of 1 and the recited maximum value of 100, i.e., having a minimum value of 1 or more and a maximum value of 100 or less. Also, all ranges recited herein include the recited range endpoints. For example, a range of 1 to 100 includes the endpoints 1 and 100. Any maximum numerical limitation recited herein is intended to include all lower numerical limitations subsumed therein, and any minimum numerical limitation recited herein is intended to include all higher numerical limitations subsumed therein. Thus, applicants reserve the right to amend this specification, including the claims, to explicitly recite subranges that are subsumed within the explicitly recited ranges. All such ranges are inherently described herein.

[0082] Any patent application, patent, non-patent publication, or other disclosure material mentioned in this specification and / or listed in any application data sheet is incorporated herein by reference to the extent that the incorporated material does not contradict this specification. Thus, and to the extent necessary, the present disclosure as expressly set forth herein takes precedence over any conflicting material incorporated herein by reference. Any material or portion thereof that is said to be incorporated herein by reference but that contradicts an existing definition, statement, or other disclosure material set forth herein is incorporated only to the extent that no contradiction occurs between the incorporated material and the existing disclosure material.

[0083] The terms "comprise" (and any form of comprise, such as "comprises", "comprising"), "have" (and any form of have, such as "has" and "have"), "include" (and any form of include, such as "includes" and "including"), and "contain" (and any form of contain, such as "contains" and "containing") are open-ended linking verbs. As a result, a system that "comprises", "has", "contains", or "contains" one or more elements possesses those one or more elements, but is not limited to possessing only those one or more elements. Similarly, an element of a system, device, or apparatus that "comprises", "has", "contains", or "contains" one or more features possesses those one or more features, but is not limited to possessing only those one or more features.

[0084] The foregoing detailed description describes various aspects of devices and / or processes through the use of block diagrams, flow charts, and / or examples. Where such block diagrams, flow charts, and / or examples include one or more functions and / or operations, those skilled in the art will appreciate that each function and / or operation in such block diagrams, flow charts, and / or examples can be individually and / or collectively implemented by a wide range of hardware, software, firmware, or substantially any combination thereof. Those skilled in the art will recognize that some aspects of the aspects disclosed herein can be equivalently implemented in whole or in part in an integrated circuit as one or more computer programs running on one or more computers (e.g., as one or more programs running on one or more computer systems), as one or more programs running on one or more processors (e.g., as one or more programs running on one or more microprocessors), as firmware, or substantially any combination thereof, and that designing the circuitry and / or writing the code for the software and / or firmware is within the skill of those skilled in the art in light of this disclosure. Further, those skilled in the art will appreciate that the mechanisms of the subject matter described herein can be distributed as one or more program products in a variety of forms, and that the illustrative forms of the subject matter described herein apply regardless of the particular type of signal-bearing medium used to actually effect the distribution.

[0085] The instructions used to program the logic to implement the various disclosed aspects may be stored in a memory in the system, such as a dynamic random access memory (DRAM), cache, flash memory, or other storage device. Additionally, the instructions may be distributed over a network or via other computer-readable media. Thus, a machine-readable medium is any mechanism for storing or transmitting information in a form readable by a machine (e.g., a computer), including, but not limited to, a floppy diskette, an optical disk, a compact disk, a read-only memory (CD-ROM), and a magneto-optical disk, a read-only memory (ROM), a random access memory (RAM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic or optical card, a flash memory, or a tangible machine-readable storage device used in transmitting information over the Internet via an electrical, optical, acoustic, or other form of propagated signal (e.g., carrier wave, infrared signal, digital signal, etc.). Accordingly, non-transitory computer-readable media includes any type of tangible machine-readable medium suitable for storing or transmitting electronic instructions or information in a form readable by a machine (eg, a computer).

[0086] As used in any aspect of the present specification, the term "control circuitry" may refer to, for example, hardwired circuitry, programmable circuitry (e.g., a computer processor with one or more individual instruction processing cores, a processing unit, a processor, a microcontroller, a microcontroller unit, a controller, a digital signal processor (DSP), a programmable logic device (PLD), a programmable logic array (PLA), or a field programmable gate array (FPGA), a state machine circuit, firmware that stores instructions executed by the programmable circuit, and any combination thereof. Control circuitry may be embodied, collectively or individually, as circuitry that forms part of a larger system, e.g., an integrated circuit (IC), an application specific integrated circuit (ASIC), a system on a chip (SoC), a desktop computer, a laptop computer, a tablet computer, a server, a smartphone, etc. Thus, as used herein, "control circuitry" may refer to, for example, a hardwired circuit, a programmable logic device (e.g., a hardwired circuit), a programmable logic array (PLA), a programmable logic device (PLA), a programmable logic array (FPGA), a programmable logic device (PLD), a programmable logic array (PLA), or a field programmable gate ...FPGA), a programmable logic device (FPGA), a programmable logic device (FPGA), a programmable logic device (FPGA), a programmable logic device (FPGA), a programmable logic device (FPGA), a programmable logic device ( includes, but is not limited to, electrical circuitry having at least one discrete electrical circuit, electrical circuitry having at least one integrated circuit, electrical circuitry having at least one application specific integrated circuit, electrical circuitry forming a general purpose computing device configured by a computer program (e.g., a general purpose computer configured by a computer program at least in part to execute a process and / or a device described herein, or a microprocessor configured by a computer program at least in part to execute a process and / or a device described herein), electrical circuitry forming a memory device (e.g., a form of random access memory), and / or electrical circuitry forming a communication device (e.g., a modem, a communication switch, or an optoelectronic device).Those skilled in the art will recognize that the subject matter described herein may be implemented in an analog or digital fashion or some combination thereof.

[0087] As used in any aspect herein, the term "logic" may refer to an application, software, firmware, and / or circuitry configured to perform any of the aforementioned operations. Software may be embodied as a software package, code, instructions, instruction sets, and / or data recorded on a non-transitory computer-readable storage medium. Firmware may be embodied as code, instructions, or instruction sets, and / or data hard-coded (e.g., non-volatile) within a memory device.

[0088] As used in any aspect of this specification, the terms "component," "system," "module," etc. may refer to a computer-related entity, hardware, a combination of hardware and software, software, or software in execution.

[0089] As used in any aspect of the present specification, an "algorithm" refers to a self-consistent sequence of steps leading to a desired result, where the "steps" refer to manipulations of physical quantities and / or logical states which may, but need not, take the form of electrical or magnetic signals that can be stored, moved, combined, compared, and otherwise manipulated. It is common to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, or the like. These and similar terms may be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities and / or states.

Claims

1. 1. A security information and event management ("SIEM") provider server, comprising: the SIEM provider server is configured to autonomously generate and provide a SIEM configuration to a tenant network to enhance network security on behalf of the tenant network; the SIEM provider server comprises a processor and a memory; the memory is configured to store machine-executable instructions implementing a managed security service provider ("MSSP") management platform; The MSSP management platform, when executed by the processor, causes the processor to: providing a graphical user interface displaying a plurality of widgets, at least one widget of the plurality of widgets being associated with the tenant network; autonomously retrieving SIEM artifacts associated with the tenant network from a content repository communicatively coupled to the SIEM provider server; generating a tenant-specific SIEM configuration for the tenant network that includes the SIEM artifact, the tenant-specific SIEM configuration being configured to continuously monitor the tenant network for security events and, upon detecting a security event, autonomously take action to protect the tenant network; A SIEM provider server that populates a tenant-specific SIEM configuration in a tenant-specific repository associated with the tenant network for configuration on the tenant network.

2. the tenant network is one of a plurality of tenant networks; the tenant-specific SIEM configuration is one of a plurality of tenant-specific SIEM configurations generated by the SIEM provider server; The SIEM provider server of claim 1 , wherein the SIEM provider server is configured to simultaneously deploy and update each SIEM configuration of the plurality of SIEM configurations on behalf of each tenant network of the plurality of tenant networks.

3. The SIEM provider server of claim 1 , wherein the action includes autonomously removing a suspect account from the tenant network.

4. The SIEM provider server of claim 1 , wherein a target tenant is configured to pull the tenant-specific SIEM configuration from the tenant-specific repository.

5. The SIEM provider server of claim 1 , wherein the MSSP management platform is configured to push the tenant-specific SIEM configuration from the tenant-specific repository to a target tenant.

6. 10. The SIEM provider server of claim 1, further comprising a script engine configured to generate scripts configured to autonomously initiate periodic queries for content changes in the tenant-specific repository.

7. The SIEM provider server of claim 6 , wherein the script is a repository commit command.

8. The MSSP management platform, when executed by the processor, further causes the processor to: receiving a response to at least one query initiated by the script engine; determining, based on the received response, that the SIEM configuration includes a tenant-initiated change; The SIEM provider server of claim 6 , further comprising an autonomous decision to reject tenant-initiated changes to an existing tenant-specific SIEM configuration.

9. 1. A method for enhancing network security on behalf of a tenant network by autonomously generating and providing a Security Information and Event Management ("SIEM") configuration to the tenant network via a SIEM provider server, the method comprising: displaying, via a graphical user interface, a plurality of widgets, at least one widget of the plurality of widgets being associated with the tenant network; autonomously retrieving SIEM artifacts associated with the tenant network from a content repository communicatively coupled to the SIEM provider server via a script engine hosted on the SIEM provider server; generating, via the SIEM provider server, a tenant-specific SIEM configuration for the tenant network that includes the SIEM artifact; deploying the tenant-specific SIEM configuration to the tenant network via the SIEM provider server via a tenant-specific repository communicatively coupled to the SIEM provider server; continuously monitoring the tenant network for security events via the SIEM configuration; Upon detecting a security event via the SIEM configuration, autonomously taking action to protect the tenant network; A method comprising:

10. the tenant network is one of a plurality of tenant networks; the tenant-specific SIEM configuration is one of a plurality of tenant-specific SIEM configurations generated by the SIEM provider server; The method further comprises: simultaneously deploying each SIEM configuration of the plurality of SIEM configurations to each tenant network of the plurality of tenant networks via the SIEM provider server; and concurrently updating each SIEM configuration of the plurality of SIEM configurations on behalf of each tenant network of the plurality of tenant networks via the SIEM provider server.

11. 10. The method of claim 9, wherein the autonomously taking action comprises autonomously removing a suspect account from the tenant network via the SIEM configuration.

12. The method of claim 9 , further comprising: retrieving the tenant-specific SIEM configuration from the tenant-specific repository via a target tenant.

13. The method of claim 9 , further comprising: pushing the tenant-specific SIEM configuration from the tenant-specific repository to a target tenant via the SIEM provider server.

14. 10. The method of claim 9, further comprising autonomously generating, via a scripting engine, a script configured to autonomously initiate periodic queries for content changes in the tenant-specific repository.

15. The method of claim 14 , wherein the script is a repository commit command.

16. receiving, via the SIEM provider server, a response to at least one query initiated by the script engine; determining, via the SIEM provider server, based on the received response, that the SIEM configuration includes a tenant-initiated change; 15. The method of claim 14, further comprising: autonomously deciding, via the SIEM provider server, to reject tenant-initiated changes to an existing tenant-specific SIEM configuration.

17. 1. A system for enhancing network security, comprising: A centralized content repository; Multiple tenant-specific repositories, Multiple tenants configured to host multiple clients; a security information and event management (SIEM) provider server communicatively coupled to the plurality of tenants, the SIEM provider server comprising a processor and a memory, the memory configured to store a managed security service provider ("MSSP") management platform; The MSSP management platform, when executed by the processor, causes the processor to: providing a graphical user interface displaying a plurality of widgets, each widget of the plurality of widgets being associated with one of the plurality of tenants; receiving user input via the graphical user interface associated with a target tenant of the plurality of tenants; autonomously retrieving SIEM artifacts associated with the target tenant from the centralized content repository; generating a tenant-specific SIEM configuration for the target tenant that includes the SIEM artifact, the tenant-specific SIEM configuration configured to continuously monitor the target tenant for security events and, upon detecting a security event, autonomously take action to protect the target tenant; The system causes the tenant-specific SIEM configuration to be deployed to a tenant-specific repository of the plurality of tenant-specific repositories associated with the target tenant.

18. the tenant-specific SIEM configuration is one of a plurality of tenant-specific SIEM configurations generated via the SIEM provider server for each tenant of the plurality of tenants; 20. The system of claim 17, wherein the SIEM provider server is configured to simultaneously deploy and update the multiple tenant-specific SIEM configurations on behalf of each tenant of the multiple tenants.

19. 20. The system of claim 17, wherein the action to protect the target tenant includes autonomously removing suspect accounts from the target tenant's network.

20. 20. The system of claim 17, wherein the memory of the SIEM provider server is further configured to store a script engine that, when executed by the processor, causes the processor to generate a script configured to autonomously initiate periodic queries for content changes in the multiple tenant-specific repositories.

Images