Enterprise security operation center (SOC) Bot

Abstract

The invention discloses a security operation center (SOC) Bot for assisting an SOC analyst in detecting, surveying and recovering various events in enterprise network security. The SOC Bot comprises the parts of data collection, data identification, data processing, data integration, machine learning, marking and alarming, command execution and the like, and the parts cooperate to finish the functions of enterprise security clue collection, security event monitoring and marking, security threat alarming, and security protection and recovery, provide analysis clues for the SOC security analyst, and execute tasks issued by the security analyst. Through the Bot, the labor intensity of the analyst can be relieved greatly, and the efficiency and automation and intelligence levels of enterprise security detection and maintenance work are increased and raised greatly.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a Bot of an enterprise security operation center. Background technique [0002] With the popularization and application of computer networks, especially the Internet, the network has become an important infrastructure on which people's production and life depend. At the same time, the importance of network security has become increasingly prominent. Nowadays, network security has become the key to determining whether the scope of network applications can be greatly expanded and the value of network applications can be maximized. [0003] Cybersecurity incidents, especially data breaches, can have significant financial and reputational impacts on businesses. In 2015, IBM and the Ponemon Research Institute conducted research on the losses caused by data breaches to 62 companies. The results showed that the average loss caused by data breaches to 62 companies w...

AI Technical Summary

Problems solved by technology

This may miss some serious attacks

Images