System, method, and computer program for context enrichment of logs in a cybersecurity system

Abstract

The present disclosure describes a system, method, and computer program for enriching logs with cybersecurity threat information. The system receives a first input data stream with logs usable for cybersecurity evaluation and a second input data stream with data values (e.g., IP address, user IDs, etc.) that are associated with a cybersecurity threat ('threat values'). The system stores the threat values in a datastore as they are received. As logs are received, the system enriches each log having a data value that matches a threat value in the datastore. As compared to conventional systems, the system significantly reduces the number of context queries on the datastore by using a probabilistic filter to determine if there is a zero or non-zero probability of a data value in a log being one of the threat values. If there is a zero probability, the system is able to determine that the log does not have one of the threat values and, thus, can enrich the log based solely on the output of the probabilistic filter.