What is a Data Catalog?

Knowing what and where your data is in an organization is no easy feat. Data ecosystems are complex – beyond the vast amounts of data, metadata from diverse data sources are not easy to integrate and standardize. Simultaneously, as organizations collect this information from various locations and disaggregated tools, they find that duplicated data often undermines their analytics’ accuracy.

In the cybersecurity context, the technology expansion makes a business case for a data catalog, where organizations can break data silos, democratize security data, and build robust, accurate analytics models across a variety of use cases.

What is a data catalog?

A data catalog is an inventory or directory of an organization’s data assets, often used to locate data, to identify and understand data attributes, and to streamline how datasets can be used by users for on-demand access to analytics models. Metadata, which is structured and descriptive information that identifies data’s attributes, is used to power the data catalog.

With a data catalog, data consumers can:

Discover the data necessary to gain insights
This includes data assets across disparate databases, data lakes, systems, or applications
Identify and organize the organization’s data
Evaluate a dataset’s fitness for an intended use
Enrich metadata to support data discovery and governance

For example, in the context of security data and telemetry, corporations need a way to organize the vast amounts of data their systems generate. Just within network monitoring, metadata may include descriptions about:

Source	Destination	Protocol
Bytes sent/received	TCP/UDP/ICMP connections	HTTP requests and replies
DHCP leases	SNMP messages	SSH connections

Using a data catalog for security data and telemetry empowers the various stakeholders to enrich network monitoring data with the data generated by other tools, like endpoint detection and response (EDR) or organizational hierarchy data. If an EDR solution and organizational hierarchy data contain the related source or destination metadata as the information that the network monitoring tool provides, then data users can leverage analytics to find connections and patterns across these otherwise disconnected tools.

What features should a data catalog have?

Some typical features that a modern data catalog has include:

Data discovery and search: metadata indexing so that users can search for data assets based on keywords, data source, data type, or other attributes
Data lineage: visibility into data’s origin, lifecycle evolution, and impact on data discovery with column-level visibility, cross-system traceability, and classifications based on data source
Data profiling: analysis of data structure and content to evaluate data quality for completeness, consistency, and timeliness when ingesting from disparate sources
Metadata management: metadata organization and enrichments to automate and streamline metadata management across disparate database schemas, transformations, and usage
Reporting and dashboards: visibility into domain data ownership, schema history and version control, and the evolution of dashboard views.
Collaboration: stakeholders working with a single source of truth for commenting on datasets and working on analytics projects
Integrations: open, extensible, and customizable API-based architectures that integrate with data sources, transformation engines, and business intelligence tools
Self-service analytics: self-service discovery to make data more visible and understandable using automation and workflow orchestration that removes data silos, increases data adoption, and reduces data engineering team burdens

While data consumers need access to the data, they may use it differently. A security data catalog integrated with the organizations business intelligence tools can empower stakeholders to:

Perform threat and data modeling
Create high-fidelity threat detections
Detect anomalies and indicators of compromise (IoCs)
Build business leader accountability
Identify and track self-defined key performance indicators

Benefits of a Data Catalog

Some key benefits organization can achieve are linked to data democratization and include:

Increased productivity and faster time-to-insight: Comprehensive visibility into and understanding of data’s context enables people to spend less time searching data so that they can analyze it and respond to questions faster.
Enhanced data-driven decision-making: Data users can more easily evaluate data’s suitability and reliability for their specific analytics use case, enabling more informed decisions based on more accurate outputs.
Comprehensive data governance: Aggregating data in a single location empowers organizations to implement and enforce data ownership and stewardship policies to manage compliance over critical data elements with visibility into data lineage and quality.
Reduced risk of error: Users handle data more accurately with quality data that includes its history to improve the analytics’ accuracy.

For example, in the security context, a data catalog that democratizes security data would allow vulnerability management and GRC teams to leverage the same underlying data. While the vulnerability management team would use the data to prioritize remediation activities, the GRC team would use the data to show auditors that they remediated vulnerabilities within policy-defined timeframes. Both teams get faster, data-driven answers to the questions they have, but they can use the data in the way that makes the most sense for their needs.

A Data Catalog as Part of an Integrated Security Data Management Solution

Organizations collect security data like baseball fans collect baseball cards. Like baseball fans who buy packs of cards hoping to find the most valuable rookie card, organizations adopt various security tools and point products, seeking the data necessary to gain visibility into their complex environments. To optimize the value of these collections, both sorting and cataloging capabilities need to be improved. A technology built to help organize and optimize security data enables the enterprise to build accurate data analytics models and mature their security monitoring.

Assign Ownership Over Sources for Improved Data Governance

Assigning data owners is the foundation of any data governance strategy.

Organizations need solutions that enable them to assign ownership over their security data’s health, then refine ownership and classification with the data produced by each system to reduce the time that data owners spend managing their responsibilities. This holds leaders responsible for their data and the health of their data.

With the ability to document data source ownership, admins can assign points of contact for data sets within the Data Catalog. This makes it simple for data users to find the right person to ask questions or raise concerns about that data. Instead of having to navigate through layers of communication, this direct line of contact can help resolve issues or answer questions more quickly and efficiently.

Use Metadata to Drive Security Data Reliability

An integrated security data solution can synchronize metadata and data definitions across complex, disparate data types for enhanced data consistency and accuracy. For security and compliance stakeholders, trustworthy data becomes even more critical as the enterprise seeks to leverage advanced analytics for critical functions like threat hunting or incident detection and response.

Further, a solution focused on security telemetry’s metadata enables data users and owners to trace the data assets’ history and lineage. With visibility into the metadata fields, they can identify the source providing insight into the cybersecurity monitoring category. For example, to identify the source responsible for insight into Process Activity used for insight into threats like malware, they can review the collected metadata to identify the source as their Extended Detection and Response (XDR) tool.

XDR Tool

Enrich Data for More Accurate and Complete Analytics

With a solution that understands the data stakeholders need, organizations can enrich the data generated by security and IT technologies with information that includes business logic and organizational hierarchies. By weaving these sources together, the organization’s stakeholders gain consistent and accurate analytics for contextualized insights.

Collaborate More Efficiently and Effectively

Senior leadership and Boards of Directors can leverage analytics showing trends over time so that they can determine whether their program effectively mitigates risk in compliance with both internal policies and external mandates. Meanwhile, IT teams can trace the high-level data to its source for technical insights. Whether the internal compliance function or external auditor has questions, the responsible parties can provide answers more rapidly.

For example, by enriching vulnerability scanner data with organization hierarchy information, stakeholders gain visibility into vulnerability and patch management program performance for insights into whether the deployed technologies and implemented processes allow responsible parties to complete their security responsibilities.