Security Event Lineage for Immediate Threat Timeline Visualization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems lack effective tools for visualizing threat development in enterprise networks, necessitating improved techniques for managing security events and facilitating immediate visualization and exploration of security events.
Innovation Solution
A threat management system that creates a lineage for security events, including process identifiers and timestamps, which is transmitted to a threat management facility for immediate visualization and progressively augmented with additional data from a data lake.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If a lineage is created immediately upon detecting a security event, then the speed of threat visualization is improved, but the completeness of threat information is worsened due to lack of additional data from data lake
Solution Approach 1:
The system performs preliminary action by immediately creating and transmitting a lineage upon detecting a security event, before additional data is retrieved from the data lake. This enables fast initial visualization while the lineage structure is established, and subsequent data enrichment is performed asynchronously to complete the information without delaying the initial response.
Solution Approach 2:
The system maintains continuity of useful action by progressively augmenting the lineage with additional data from the data lake after initial transmission. The threat management facility continuously retrieves and integrates supplementary information, ensuring the visualization remains updated and complete without interrupting the initial fast response or requiring complete data availability beforehand.
2Loss of information
If additional data is retrieved from data lake to augment the lineage, then the completeness of threat information is improved, but the time required for visualization is worsened due to data retrieval latency
Solution Approach 1:
The system performs preliminary action by creating and transmitting the lineage immediately upon event detection, before retrieving additional data from the data lake. This ensures fast initial visualization while the lineage structure is established, and data enrichment occurs subsequently without delaying the critical initial response time.
Solution Approach 2:
The system maintains continuity of useful action by progressively augmenting the lineage with additional data from the data lake after initial transmission. The threat management facility continuously retrieves and integrates supplementary information, ensuring the visualization remains updated and complete without interrupting the initial fast response or requiring complete data availability beforehand.
3Ease of operation
If the lineage includes detailed process information immediately, then the ease of operation for threat analysis is improved, but the device complexity increases due to need for multiple data sources and progressive updates
Solution Approach 1:
The system applies segmentation by dividing the data retrieval process into two distinct parts: immediate lineage creation with essential process information, and subsequent progressive augmentation with additional data from the data lake. This segmentation allows the system to provide basic functionality quickly while maintaining the option to enhance detail on demand, reducing the complexity burden on the initial response mechanism.
Solution Approach 2:
The system implements dynamics by making the lineage progressively augmentable rather than static. The lineage can evolve from a basic structure with essential process information to a more comprehensive view as additional data is retrieved from the data lake. This dynamic approach allows the system to adapt its complexity level based on operational needs, providing simple initial views and detailed analyses when required.
Data Source
AI summary
A compute instance is managed by a threat management facility that provides security for an enterprise network associated with the compute instance, and that stores event data in a data lake for use in threat detection. In response to a security event on a compute instance, the compute instance creates a lineage for the security event that facilitates immediate presentation to a technician for review. The lineage may include data for one or more related processes so that an event graph or the like can be immediately displayed in the user interface upon receipt of the lineage. The user interface may be subsequently augmented as additional data becomes available from the data lake, or in response to requests from a user investigating the security event in the user interface.