System and methods for cybersecurity analysis using ueba and network topology data and trigger-based network remediation

Abstract

A system and method for network cybersecurity analysis that uses user and entity behavioral analysis combined with network topology information and trigger-based network remediation to provide improved cybersecurity. The system and method involve gathering network entity information, establishing baseline behaviors for each entity, and monitoring each entity for behavioral anomalies that might indicate cybersecurity concerns. Further, the system and method involve incorporating network topology information into the analysis by generating a model of the network, annotating the model with risk and criticality information for each entity in the model and with a vulnerability level between entities, and using the model to evaluate cybersecurity risks to the network. Triggers may be based on risks or anomalous behavior and associated with a remediation action executed on the network by a security mitigation engine. The system and method may also dynamically adjust monitoring characteristics based on trigger events.