Interactive analysis of multifaceted security threats within a compute environment

Patent metadata

Field	Value
Publication number	US-12500910-B1
Application number	US-202318129269-A
Country	US
Kind code	B1
Filing date	Mar 31, 2023
Priority date	Nov 27, 2017
Publication date	Dec 16, 2025
Grant date	Dec 16, 2025

Abstract

Data platforms described herein are configured to monitor a compute environment and facilitate interactive analysis of multifaceted security threats within the compute environment. Such a data platform may determine that one or more assets within the compute environment are possibly being targeted by a multifaceted security threat and present an interactive user interface. The user interface may be configured to display an identifier indicative of the multifaceted security threat, a set of selectable evidence items each associated with a different facet of the multifaceted security threat and assessed based on the monitoring of the compute environment, and a presentation pane for displaying information. As such, the data platform may detect a selection of a particular evidence item from the set of selectable evidence items and, in response to the selection, populate the presentation pane with information related to the particular evidence item. Corresponding methods, systems, and products are also disclosed.

First claim

What is claimed is:

1 . A method comprising:
determining, by a data platform monitoring a compute environment, that one or more assets within the compute environment are possibly being targeted by a multifaceted security threat; presenting, by the data platform, an interactive user interface configured to display:
an identifier indicative of the multifaceted security threat,
a set of selectable evidence items each associated with a different facet of the multifaceted security threat and assessed based on the monitoring of the compute environment, and
a presentation pane for displaying information;
detecting, by the data platform, a selection of a particular evidence item from the set of selectable evidence items; and populating, by the data platform and in response to the detecting of the selection, the presentation pane with information related to the particular evidence item;
wherein:
the interactive user interface is further configured to display, together with the presentation pane, an additional presentation pane for displaying additional information;
the method further comprises populating, by the data platform and in response to the detecting of the selection, the additional presentation pane with additional information related to the particular evidence item;
the information displayed in the populated presentation pane includes a graph comprising a plurality of nodes connected by a plurality of edges, each node of the plurality of nodes representing either an entity or an observation and each edge of the plurality of edges representing a behavioral relationship between nodes connected by the edge;
the additional information displayed in the populated additional presentation pane includes an event list that individually displays events that have been monitored to have occurred within the compute environment and that form a basis on which the particular evidence item is assessed; and
the graph and the event list are mutually interactive such that selecting an item from one influences what is displayed in the other.

2 . The method of claim 1 , wherein the interactive user interface is further configured to display, in connection with the identifier, a narrative description of the multifaceted security threat, the narrative description configured to provide context for the different facets of the multifaceted security threat by describing how the multifaceted security threat operates to target the one or more assets within the compute environment.

3 . The method of claim 1 , wherein:
the information displayed in the populated presentation pane includes a graph comprising a plurality of nodes connected by a plurality of edges; and each node of the plurality of nodes represents either an entity or an observation and each edge of the plurality of edges represents a behavioral relationship between nodes connected by the edge.

4 . The method of claim 3 , each entity represented by a node in the graph is of an entity type selected from: a user identity, a host machine, an address identity, a container, a process, or a file.

5 . The method of claim 1 , wherein:
the information displayed in the populated presentation pane includes an event list that individually displays events that have been monitored to have occurred within the compute environment; and the events individually displayed in the event list form a basis on which the particular evidence item is assessed.

6 . The method of claim 5 , wherein each of the events individually displayed in the event list are arranged along a timeline to indicate an order in which the events were observed to have occurred with respect to one another.

7 . The method of claim 5 , wherein each of the events individually displayed in the event list includes a descriptive identifier configured to indicate a nature of the event.

8 . The method of claim 1 , wherein:
a first subset of evidence items included in the set of selectable evidence items is determined, in the assessment, to suggest that the one or more assets are being targeted by the multifaceted security threat; a second subset of evidence items included in the set of selectable evidence items is determined, in the assessment, to not suggest that the one or more assets are being targeted by the multifaceted security threat; and the interactive user interface is configured to display the set of selectable evidence items in a manner that graphically differentiates the first subset of evidence items from the second subset of evidence items.

9 . The method of claim 8 , wherein the graphically differentiating of the first and second subsets of evidence items is performed by using a first color to display evidence items of the first subset of evidence items and by using a second color different from the first color to display evidence items of the second subset of evidence items.

10 . The method of claim 1 , wherein:
the determining that the one or more assets within the compute environment are possibly being targeted by the multifaceted security threat includes evaluating, in relation to a threat threshold, a likelihood that the one or more assets are in fact being targeted by the multifaceted security threat; the evaluating results in a determination that the likelihood surpasses the threat threshold; and the presenting of the interactive user interface with information related to the multifaceted security threat is automatically performed based on the determination that the likelihood surpasses the threat threshold.

11 . The method of claim 1 , wherein:
the determining that the one or more assets within the compute environment are possibly being targeted by the multifaceted security threat includes evaluating, in relation to a threat threshold, a likelihood that the one or more assets are in fact being targeted by the multifaceted security threat; the evaluating results in a determination that the likelihood fails to reach the threat threshold; and the presenting of the interactive user interface with information related to the multifaceted security threat is performed based on an explicit request for the interactive user interface to present the information related to the multifaceted security threat notwithstanding the determination that the likelihood fails to reach the threat threshold.

12 . The method of claim 1 , wherein the determining that the one or more assets within the compute environment are possibly being targeted by the multifaceted security threat includes:
detecting a first event that occurs within the compute environment and is associated with a first alert score; detecting a second event that occurs within the compute environment and is associated with a second alert score; and based on a determination that the first event and the second event are both affiliated with the particular evidence item, assessing the particular evidence item in accordance with a third alert score different from the first and second alert scores.

13 . A non-transitory computer program product embodied in a non-transitory computer-readable storage medium and comprising computer instructions configured to be executed by a data platform to perform a process comprising:
determining that one or more assets within a compute environment monitored by the data platform are possibly being targeted by a multifaceted security threat; presenting an interactive user interface configured to display:
an identifier indicative of the multifaceted security threat,
a set of selectable evidence items each associated with a different facet of the multifaceted security threat and assessed based on the monitoring of the comp

Assignees

• Lacework Inc
• Fortinet Inc

Inventors

• Adamson David Nellinger
• Yen Ting-Fang
• Twigg Andrew D
• Singhal Isha
• Chen Yijou
• Karmali Sowmya A

Classifications

• H04L63/10

  for controlling access to devices or network resources · CPC title

• G06F16/9537

  Spatial or temporal dependent retrieval, e.g. spatiotemporal queries · CPC title

• H04L67/535

  Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34) · CPC title

• G06F16/9024

  Graphs; Linked lists (G06F16/9027 takes precedence) · CPC title

• G06F9/455

  Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines · CPC title