Method and device for associated playback of privileged threat behavior tracks based on drag and drop

Abstract

The invention discloses a drag-and-drop-based method and device for associated playback of privileged threat behavior tracks, which are applied to a privileged account threat analysis system. The method includes: A) accessing privileged account session log data, accessing privileged account terminal operation audit log data; B) process the privileged account session log data and the privileged account terminal operation audit log data; C) visualize the indicators of various dimensions related to the abnormal behavior of the privileged threat into draggable field blocks; D) drag and drop the Select the relevant dimension index by dragging; E) Select the track playback time range according to the needs; F) Associate the selected dimension index with the track playback time range to restore the track of privileged threat abnormal behavior. The invention enables relevant personnel who do not understand technology or are not deep in technology to quickly realize the trajectory playback analysis of privilege threat abnormal behavior through a simple mouse dragging and combining method, thereby improving timeliness and ease of use.

Description

technical field [0001] The invention relates to the field of privilege security, in particular to a drag-and-drop-based method and device for associated playback of privilege threat behavior tracks. Background technique [0002] Privileged accounts refer to accounts with high risk (such as administrator accounts that can start and stop devices) or high value (such as application accounts that can read business-sensitive data). More than half of major security incidents each year are due to privileged accounts being This behavior of using privileged accounts to cause damage or loss to enterprises is called privileged threat abnormal behavior. In the traditional sense, privileged threat abnormal behavior detection analysis and track playback are generally done through tool rule configuration or command filtering, which requires relatively high personal technical skills for administrators, making it impossible for some administrators and leadership personnel to do so. It canno...

AI Technical Summary

Problems solved by technology

In the traditional sense, privileged threat abnormal behavior detection analysis and track playback are generally done through tool rule configuration or command filtering, which requires relatively high personal technical skills for administrators, making it impossible for some administrators and leadership personnel to do so. It can only be carried out after the relevant technical personnel are in place, so it is easy to cause timeliness and usability problems, causing corporate privileges to threaten abnormal behavior security risks

Images