Abstract: A security threat candidate (STC) detector examines a set of activity log records representing access requests directed to data artifacts by various entities of an organization. In a first threat analysis, the STC detector determines that an activity log record indicates a use of an access path which is not present in a database of legitimate access paths for an entity. In a second threat analysis, the STC detector determines whether the behavior of the entity matches a stored suspect behavior pattern template. Results of the first and/or second analysis are transmitted to a selected security management component of the organization.

Abstract: A vulnerability records manager (VRM) receives respective vulnerability data sets (VDS) from a first and second vulnerability information collector. Each VDS comprises values of a different set of attributes defined in a vulnerability taxonomy specification. The VRM normalizes the VDSs to generate a first and second vulnerability record comprising a particular plurality of attributes defined in the specification, and stores the vulnerability records in a repository. In response to a request received via a programmatic interface, the VRM transmits contents of the vulnerability records to an automated risk analyzer or a reporting/presentation component.