BACKGROUND

Security products, such as firewalls, endpoint detection and response (EDR) systems, user-entity behavior analytics (UEBA) systems, cloud access security brokers (CASB), and similar systems are often configured to log or report signs of potential security breaches. For example, firewalls can report attempts to access systems from unknown or unidentified sources, or repeated attempts to access a system or service from the same source. UEBA systems can report anomalous user behavior, such as unusually large data transfers, accessing systems or services at unusual times, or accessing systems or services that the user typically does not access. EDR systems can identify an unknown program acting in a suspicious manner on a client device.

When viewed individually, each anomaly could either be indicative of a security threat or a result of innocuous behavior. For example, a user unexpectedly working from home because the user is sick might register as an external connection from a previously unknown source. In this scenario, the user might also download an unusually large amount of data (e.g., project files) to work on from home. Likewise, poorly implemented device drivers might invoke system calls in a suspicious manner (e.g., a device driver for a user's personal keyboard or mouse making unnecessary system calls). However, an attacker might also register as an external connection from a previously unknown source. The attacker's malware might also be detected as an unknown program acting in a suspicious manner, with the attacker's malware also being detected by a UEBA system when it uses compromise user credentials to attempt to access and exfiltrate large amounts of data.

Typically, the anomalies are investigated by an enterprise's incident response team (IRT). The IRT often reviews the reported anomalies individually to see if they are indicative of a security problem. Likewise, the IRT can also evaluate anomalies to see if there appear to be any related anomalies. Because security products from different vendors are often incompatible, the IRT usually has to manually cross-reference anomalies to see if several anomalies are related, which can indicate that a security related incident has taken place. However, this analysis process is time-consuming and can often result in a security incident being identified and remediated after the incident has taken place instead of while the security incident is taking place.

