BACKGROUND

The present disclosure relates in general to the field of computers and similar technologies, and in particular to software utilized in this field. Still more particularly, it relates to a method, system, and computer-usable medium for an optimized platform and framework to analyze captured data.

Various entities, such as private businesses and companies, government institutions, universities, research institutions, military facilities, etc. have secure information technology (IT) infrastructures. Such IT infrastructures support multiple users who regularly access resources outside of or external to the IT infrastructures. For example, users may perform searches and download data from external websites and sources outside of an IT infrastructure and control of IT administrators.

Because externally downloaded data may be outside the IT infrastructure and control of IT administrators, there can be a concern as to the security of the data. Security information and event management (SIEM) is a field of computer security, where software products and services combine security information management (SIM) and security event management (SEM). Real-time analysis of security alerts can be generated by applications and network hardware. Downloaded data may present a security threat or incident to the entity. In certain cases, downloaded data may not in of themselves be a threat, but in a particular sequence or workflow, downloaded data as tasks in a workflow may present a security threat or incident.

In other instances, an entity may desire to analyze downloaded data to determine particular workflows that may not necessarily present security threats or incidents. For example, a workflow may be directed to observed user patterns.

To properly investigate security threats or incidents, security analysts and administrators may need data science experience and resources to properly assess downloaded data and the context of downloaded data in particular workflows. Tasks in a workflow are based on the downloaded data and may run a particular platform. Analysts and administrators may have to determine and run such tasks on specific platforms in the workflow.

SUMMARY

A method, system, and computer-usable medium are disclosed for analyzing security data formatted in a Structured Threat Information eXpression (STIX)™ (a trademarked product of OASIS Cyber Threat Intelligence TC, for automated information sharing for cybersecurity) format. Data related to actions performed by one or more users is captured. Individual tasks, such as analytics or extract, transform, load (ETL) tasks related to the captured data is created. Individual task is registered to a workflow for executing a particular security threat or incident analysis. The workflow is executed and visualized to perform a security threat or incident analysis.

