Abstract: A security automation platform is disclosed herein. The security automation platform can be communicably coupled to a tenant configured to deploy a tenant security platform and comprises a processor and a memory configured to store a security automation platform that, when executed by the processor, causes the processor to detect, via a variable store, a variable associated with the tenant, correlate, via a content library, the detected variable to an artifact stored within the content library; generate, via an automation schema, an automation for the tenant based on the artifact, wherein the automation comprises a security tool configured to continuously monitor an API deployed by the tenant, and transmit, via an API broker of the security automation platform, the generated automation to the security automation platform deployed by the tenant.

Abstract: A method for streamlining and standardizing the ingest of security data across a plurality of tenant networks is disclosed. Each of the plurality of tenant networks comprises at least one log source, the method comprising receiving, by each of a plurality of data gateway modules, raw log data from the log source associated therewith; generating, by each of the plurality of data gateway modules, formatted log data based on the raw log data; ingesting, by an edge module, formatted log data from the plurality of data gateway modules; automatically updating, by a central control plane module, a configuration of at least one of the plurality of data gateway modules based on a change to the log source(s) associated therewith; and implementing, by a security monitoring system, a security action related to at least one of the plurality of tenant networks based on the ingested formatted data.