Systems and methods for intelligent cyber security threat detection and mitigation through an extensible automated investigations and threat mitigation platform

Abstract

A cybersecurity system and method for handling a cybersecurity event includes identifying a cybersecurity alert; selectively initializing automated threat intelligence workflows based on computing a cybersecurity alert type, wherein the automated threat intelligence workflows include a plurality of automated investigative tasks that, when executed by one or more computers, derive cybersecurity alert intelligence data; and executing the plurality of automated investigative tasks includes automatically sourcing a corpus of investigative data; deriving the cybersecurity alert intelligence data based on extracting selective pieces of data from the corpus of investigative data, wherein the cybersecurity alert intelligence data informs an inference of a cybersecurity alert severity of the cybersecurity alert; and automatically routing the cybersecurity alert to one of a plurality of distinct threat mitigation or threat disposal routes based on the cybersecurity alert severity of the cybersecurity alert.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS[0001]This application claims the benefit of U.S. Provisional Application No. 63 / 091,409, filed 14 Oct. 2020, which is incorporated in its entirety by this reference.TECHNICAL FIELD[0002]This invention relates generally to the cybersecurity field, and more specifically to a new and useful cyber threat detection and mitigation system and methods in the cybersecurity field.BACKGROUND[0003]Modern computing and organizational security have been evolving to include a variety of security operation services that can often abstract a responsibility for monitoring and detecting threats in computing and organizational resources of an organizational entity to professionally managed security service providers outside of the organizational entity. As many of these organizational entities continue to migrate their computing resources and computing requirements to cloud-based services, the security risks posed by malicious actors or uneducated insiders appear...

AI Technical Summary

Benefits of technology

This approach enables real-time, intelligent threat detection and mitigation, improving response efficiency and maintaining quality despite increasing security risks, by leveraging automated workflows and machine learning for threat classification and severity assessment.

Problems solved by technology

As many of these organizational entities continue to migrate their computing resources and computing requirements to cloud-based services, the security risks posed by malicious actors or uneducated insiders appear to grow at an incalculable rate because of the complexity of configuring cloud-based services, their ease of access, and the speed at which cloud base services allow users to move.

However, because the volume of security threats may be great, it may present one or more technical challenges in scaling security operations services without resulting in a number of technical inefficiencies that may prevent or slowdown the detection of security threats and efficiently responding to detected security threats.

Images