Identifying threats using aggregated security data and trained models

Abstract

A computerized system and method for receiving security data from a plurality of security data sources, such as security tools, platforms, and/or other applications that are running in an enterprise system or other complex system is provided. The security data is then processed and analyzed to detect anomalous events and to automatically perform remedial operations in response to anomalous events. Security data from multiple sources is obtained. The security data is normalized such that it is compatible with a model trained for a use case. The model is used in combination with the normalized data to detect anomalous events and/or predict future security events associated with the use case of the model. Then, data associated with the detected anomalous events and/or predicted future security events are presented using a visualization layer and/or a remedial operation is performed.