DEVICE, SYSTEM, AND METHOD FOR REMOTELY MANAGING SECURITY ORCHESTRATION, AUTOMATION, AND RESPONSE FOR OTHER ORGANIZATIONS - Patent application

Abstract

Disclosed herein is a security automation platform that can be communicatively connected to a tenant configured to deploy a tenant security platform, the security automation platform including a processor and a memory configured to store a security automation platform, which when executed by the processor causes the processor to sense variables related to the tenant via a variable store, associate the sensed variables with artifacts stored in the content library via a content library, generate automation for the tenant based on the artifacts via an automation schema, the automation including a security tool configured to continuously monitor APIs deployed by the tenant, and transmit the generated automation to the security automation platform deployed by the tenant via an API broker of the security automation platform.

Description

[Technical field]

[0001] (CROSS REFERENCE TO RELATED APPLICATIONS) This application claims the benefit of and priority under 35 U.S.C. § 119(e) to U.S. Provisional Patent Application No. 63 / 302,828, filed January 25, 2022, entitled DEVICES, SYSTEMS, AND METHODS FOR REMOTELY MANAGING ANOTHER ORGANIZATIONS SECURITY, ORCHESTRATION, AUTOMATION, AND RESPONSE, the disclosure of which is incorporated herein by reference in its entirety.

[0002] (Technical field) The present disclosure relates generally to network security, and more particularly, to improved devices, systems, and methods for managing a Security Orchestration, Automation, and Response (SOAR) platform.

[0003] The following summary is provided to facilitate understanding of some of the innovative features unique to the embodiments disclosed herein and is not intended to be a complete description, with a full understanding of the various embodiments being gained by taking the entire specification, claims, and abstract as a whole. Summary of the Invention [Means for solving the problem]

[0004] In various aspects, a security orchestration, automation, and response (SOAR) management server is disclosed herein. The SOAR management server is communicatively connected to a tenant configured to deploy a SOAR platform and can include a processor and a memory. The memory can be configured to store a SOAR management application including a content library, a variable store, an automation schema, and an application program interface (API) broker. The SOAR management application, when executed by the processor, can cause the processor to detect variables related to the tenant via the variable store, associate the detected variables with artifacts stored in the content library via the content library, generate automation for the tenant based on the artifacts via the automation schema, the automation including a security tool configured to continuously monitor APIs deployed by the tenant, and transmit the generated automation to a SOAR platform deployed by the tenant via the API broker of the SOAR management application.

[0005] In various aspects, a method for enhancing network security via a SOAR management server is disclosed. The SOAR management server can be communicatively connected to a tenant configured to deploy a SOAR platform, and the SOAR management server can have a processor and a memory configured to store a SOAR management application. The SOAR management application can include a content library, a variable store, an automation schema, and an application program interface (API) broker. The method includes: detecting variables related to the tenant via the variable store; associating the detected variables with artifacts stored in the content library via the content library; generating automation for the tenant based on the artifacts via the automation schema, the automation including a security tool configured to continuously monitor APIs deployed by the SOAR platform; and sending the generated automation to the SOAR platform deployed by the tenant via the API broker of the SOAR management application.

[0006] In various aspects, a system for enhancing network security by remotely managing a SOAR platform is disclosed. The system can include a tenant configured to deploy a SOAR platform, and a SOAR management server communicatively connected to the tenant, where the SOAR management server can have a processor and a memory. The memory can be configured to store a SOAR management application including a content library, a variable store, an automation schema, and an application program interface (API) broker. When executed by the processor, the SOAR management application can cause the processor to detect variables related to the tenant via the variable store, associate the detected variables with artifacts stored in the content library via the content library, generate automation for the tenant based on the artifacts via the automation schema, the automation including a security tool configured to continuously monitor APIs deployed by the tenant, and transmit the generated automation to the SOAR platform deployed by the tenant via the API broker of the SOAR management application.

[0007] These and other objects, features, characteristics, and methods of operation and function of associated elements of construction and combination of parts and economies of manufacture of the present invention will become more apparent from a consideration of the following description and appended claims, all of which form a part hereof, and in which like reference numerals designate corresponding parts in the various drawings, it being expressly understood, however, that the drawings are for illustration and description purposes only and are not intended to define the limits of the invention.

[0008] The various features of the aspects described herein are set forth with particularity in the appended claims, however, the various aspects, both as to organization and as to method of operation, together with their advantages, may be understood by reference to the following description taken in conjunction with the accompanying drawings, in which: [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 illustrates a system configured to remotely manage security orchestration, automation, and response (“SOAR”) for other organizations in accordance with at least one non-limiting aspect of the present disclosure. [Diagram 2] FIG. 2 illustrates a functional architecture of the system of FIG. 1 in accordance with at least one non-limiting aspect of the present disclosure. [Diagram 3] FIG. 1 illustrates a method for remotely managing another organization's SOAR in accordance with at least one non-limiting aspect of the present disclosure. [Figure 4] FIG. 3 illustrates a graphical user interface configured to interface with the functional architecture of FIG. 2 in accordance with at least one non-limiting aspect of the present disclosure. [Diagram 5] FIG. 1 illustrates an extensible security information and event management framework in accordance with at least one non-limiting aspect of the present disclosure.

[0010] Corresponding reference characters indicate corresponding parts throughout the several views. The exemplifications set forth herein are illustrative of various aspects of the present invention in one form only, and such exemplifications are not to be construed as limiting the scope of the present invention in any manner. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] (Detailed Description) The applicant of the present application owns the following U.S. provisional patent applications, the disclosures of each of which are incorporated herein by reference in their entireties: -U.S. Provisional Patent Application No. 63 / 295,150, filed on December 30, 2021, entitled DEVICES, SYSTEMS, AND METHODS FOR STREAMLINING AND STANDARDIZING THE INGEST OF SECURITY DATA ACROSS MULTIPLE TENANTS -U.S. Provisional Patent Application No. 63 / 302,828, filed on January 25, 2022, entitled DEVICES, SYSTEMS, AND METHODS FOR REMOTELY MANAGING ANOTHER ORGANIZATION'S SECURITY ORCHESTRATION, AUTOMATION, AND RESPONSE -U.S. Provisional Patent Application No. 63 / 313,422, filed on February 24, 2022, entitled DEVICES, SYSTEMS, AND METHODS FOR IDENTIFYING CYBER ASSETS AND GENERATING CYBER RISK MITIGATION ACTION BASED ON DOMAIN REDIRECTS -U.S. Provisional Patent Application No. 63 / 341,264, entitled DEVICES, SYSTEMS, AND METHODS FOR SUMMARIZING ANALYTIC OBSERVATIONS, filed on May 12, 2022 - U.S. Provisional Patent Application No. 63 / 344,305, filed May 20, 202, entitled DEVICES, SYSTEMS, AND METHODS FOR INGESTING & ENRICHING SECURITY INFORMATION TO AUTONOMOUSLY SECURE A PLURALITY OF TENANT NETWORKS -U.S. Provisional Patent Application No. 63 / 345,679, filed May 25, 2022, entitled DEVICES, SYSTEMS, AND METHODS FOR IDENTIFYING CYBER ASSETS AND GENERATING CYBER RISK MITIGATION ACTIONS BASED ON A DEMOCRATIC MATCHING ALGORITHM -International Patent Application No. PCT / US22 / 72739, entitled DEVICES, SYSTEMS, AND METHODS FOR ENHANCING SECURITY INFORMATION & EVENT MANAGEMENT UPDATES FOR MULTIPLE TENANTS BASED ON CORRELATED, AND SYNERGISTIC DEPLOYMENT NEEDS, filed on June 3, 2022 -International Patent Application No. PCT / US22 / 72743, entitled DEVICES, SYSTEMS, AND METHODS FOR STANDARDIZING & STREAMLINING THE DEPLOYMENT OF SECURITY INFORMATION & EVENT MANAGEMENT ARTIFACTS FOR MULTIPLEENANTS, filed on June 3, 2022 -U.S. Provisional Patent Application No. 63 / 365,819, filed June 3, 2022, entitled DEVICES, METHODS, AND SYSTEMS FOR GENERATING A HIGHLY-SCALABLE, EFFICIENT COMPOSITE RECORD INDEX -U.S. Provisional Patent Application No. 63 / 353,992, filed June 21, 2022, entitled DEVICES, SYSTEMS, AND METHODS FOR CATEGORIZING, PRIORITIZING, AND MITIGATING CYBER SECURITY RISKS -U.S. Provisional Patent Application No. 63 / 366,903, filed June 23, 2022, entitled DEVICES, SYSTEMS, AND METHOD FOR GENERATING AND USING A QUERYABLE INDEX IN A CYBER DATA MODEL TO ENHANCE NETWORK SECURITY - U.S. Provisional Patent Application No. 63 / 368,567, filed on July 15, 2022, entitled DEVICES, SYSTEMS, AND METHODS FOR UTILIZING A NETWORKED, COMPUTER-ASSISTED, THREAT HUNTING PLATFORM TO ENHANCE NETWORK SECURITY -U.S. Provisional Patent Application No. 63 / 369,582, filed on July 27, 2022, entitled AUTONOMOUS THREAT SCORING AND SECURITY ENHANCEMENT -U.S. Provisional Patent Application No. 63 / 377,304, filed on September 27, 2022, entitled DEVICES, SYSTEMS, AND METHODS FOR CONTINUOUSLY ENHANCING THE IMPLEMENTATION OF CODE CHANGES VIA ENRICHED PIPELINES

[0012] Numerous specific details are described to provide a thorough understanding of the overall structure, function, manufacture, and use of the embodiments as described in this disclosure and illustrated in the accompanying drawings. Well-known operations, components, and elements are not described in detail so as not to obscure the embodiments described herein. The reader will understand that the embodiments described and illustrated herein are non-limiting embodiments, and therefore, the specific structural and functional details disclosed herein may be representative and exemplary. Variations and modifications may be made without departing from the scope of the claims. In the following description, like reference characters designate like or corresponding parts throughout the several views of the drawings.

[0013] Before describing in detail various aspects of the systems and methods disclosed herein, it should be noted that the exemplary aspects are not limited in application or use to the details disclosed in the accompanying drawings and description. It will be understood that the exemplary aspects may be implemented or incorporated in other aspects, variations, and modifications, and may be practiced or performed in various ways. Furthermore, unless otherwise indicated, the terms and expressions used herein have been selected for the purpose of describing the exemplary aspects for the convenience of the reader, and are not intended to be limiting thereof. For example, any reference to a particular manufacturer, software suite, application, or development platform disclosed herein should be understood to be merely for the purpose of describing some of the many aspects of the disclosure. This includes any reference to trademarks. Thus, it should be understood that the devices, systems, and methods disclosed herein can be implemented to enhance any software updates depending on the intended use and / or user preferences.

[0014] As used herein, the term "server" may refer to or include one or more computing devices operated by or facilitating communication and processing for multiple parties in a network environment, such as the Internet or any public or private network. References to a "server" or "processor" as used herein may refer to the previously described server, and / or processor, a different server, and / or processor, and / or a combination of servers and / or processors that are referred to as performing the previous step or function.

[0015] As used herein, the term "tenant" may refer to one or more client organizations managed by a managed security service provider ("MSSP"). A tenant may include one or more servers configured to manage a network, such as an intranet, to which multiple client instances are connected. For example, a "client" or "client instance" as used herein may include a computing device (e.g., a laptop, a desktop computer, a mobile phone, etc.) that is connected to the tenant's network. According to some non-limiting aspects, a "client" or "client instance" may be a software agent or computing device outside the tenant's network that is connected via a virtual private network ("VPN") connection.

[0016] As used herein, the term "constant" may refer to one or more SIEM features that do not change during the issuance of an alert. For example, the constants may include Azure Sentinel Log Analytics features, among others. According to some non-limiting aspects, the constants may be specifically configured according to individual client preferences and / or requirements. For example, the alert rules as described herein may be the same for all client deployments. However, the devices, systems, and methods disclosed herein may employ client-specific constants to "fine-tune" how alerts are managed for each particular client. In other words, each constant may include a whitelist of specific protocols, accounts, etc., for which the alert rules manage those constants differently (e.g., skip them).

[0017] As used herein, the term "network" may include the entire enterprise information technology ("IT") system deployed by a tenant. For example, a network may include a group of two or more nodes (e.g., assets) connected by any physical and / or wireless connection and configured to communicate and share information with other single or multiple nodes. However, the term network is not limited to any particular node or any particular means of connecting those nodes. A network may include any combination of assets (e.g., devices, servers, desktop computers, laptop computers, personal digital assistants, mobile phones, wearables, smart appliances, etc.) connected to an Ethernet, intranet, and / or extranet and configured to communicate with each other regardless of the physical location of each device via ad-hoc connections (e.g., Bluetooth, Near Field Communication ("NFC"), etc.), local area connections ("LANs"), wireless local area networks ("WLANs"), and / or virtual private networks ("VPNs"). A network may further include any tools, applications, and / or services deployed by devices or utilized by the enterprise IT system, such as firewalls, email clients, document management systems, office systems, etc. In some non-limiting aspects, the “network” may include third-party devices, applications, and / or services that are owned and controlled by a third party, but that are allowed access to the enterprise IT systems by a tenant.

[0018] As used herein, the term "platform" can include software architecture, hardware architecture, and / or combinations thereof. A platform can include either a standalone software product, a network architecture, and / or a software product configured to integrate within a software architecture and / or hardware architecture necessary for the software product to provide its technical benefits. For example, a platform can include any combination of chipsets, processors, logic-based devices, memory, storage, graphical user interfaces, graphics subsystems, applications, and / or communication modules (e.g., transceivers). In other words, a platform can provide the resources necessary to enable the technical benefits provided by the software. According to some non-limiting aspects, the technical benefits provided by the software are provided to the physical resources of the ecosystem or to other software (e.g., APIs, services, etc.) employed by the physical resources in the ecosystem. According to other non-limiting aspects, a platform can include a framework for multiple software applications intended and designed to work together.

[0019] MSSPs provide outsourced monitoring and management of security devices and systems on behalf of organizational clients. For example, MSSPs may provide general services such as managed firewalls, intrusion detection, virtual private networks, vulnerability scanning, and antivirus services to their clients. An emerging trend in the MSSP industry is to develop technology that is three to five years ahead of what is available in the general market. For example, some of the proprietary security information and event management ("SIEM") technologies were developed when it became clear that MSSPs could not buy them off the shelf. After their own proprietary SIEM technologies were developed, MSSPs developed platforms to automate the management of their customers' SIEM platforms in a scalable manner as the technology became more generally available. One non-limiting example of such a scalable and automated SIEM platform is disclosed in U.S. Provisional Patent Application No. 63 / 196,458, filed June 3, 2021, entitled "DEVICES, SYSTEMS, AND METHODS FOR ENHANCING SECURITY INFORMATION & EVENT MANAGEMENT UPDATES FOR MULTIPLE TENANTS BASED ON CORRELATED, AND SYNERGISTIC DEPLOYMENT NEEDS," the disclosure of which is incorporated by reference in its entirety into this specification.

[0020] While SIEM platforms can analyze multiple data sources, perform advanced correlations to identify threats, and intelligently rank identified events in order of importance, implementing a security orchestration, automation, and response ("SOAR") platform can automate the workflow of investigation paths based on SIEM-generated alerts, significantly reducing the time required to manage and mitigate security threats. SOAR platforms generally include a collection of security software solutions and tools to view and collect diverse data from various sources for analysis in order to understand and prioritize security incident response actions. SOAR platforms can be used to describe several software functions, including threat and vulnerability management, security incident response, and security operations automation. In other words, SOAR platforms not only enable companies to collect threat-related data from various sources, but also identify and respond to identified threats based on the analysis. Once threats are identified, a typical SOAR platform can protect the network by implementing incident responses to mitigate the identified threats.

[0021] Traditionally, SOAR platforms have been designed to automate the incident response lifecycle by improving the ability of cyber defense teams to detect, investigate, and respond to security alerts in a given environment, either manually or using automation. However, to realize their full potential, SOAR platforms require a high degree of integration into the environment, as well as customized playbooks and response activities. Thus, traditional SOAR platforms are typically managed directly by the implementing organization, because the organization is in a better position to integrate the platform into its network and can myopically manage its own single network. For a SOAR platform to be managed by a service provider, manual integration is required to achieve the right degree of integration to fully protect the client organization's network. In other words, a lot of manual work and thought is required to establish sufficient connectivity to the various SOAR platforms and application program interfaces ("APIs") implemented by each client organization.

[0022] As a result, MSSPs must hire more expensive specialists and client organizations often have to cover at least part of the increased expenses, resulting in higher costs for both parties. However, there is often overlap in the deployment needs of various client organizations. For example, many organizations may utilize similar SOAR platforms and require similar monitoring and management solutions. In such cases, asset reuse, redeployment, and updates can lead to significant cost savings and operational simplification. Unfortunately, known SIEM tools are not technically capable of exploiting such synergies. This leaves MSSPs with limited opportunities for reuse to drive efficiencies across multiple clients, both from the initial preparation stage and across incident response automation. The lack of reusable deployments is not only very costly, but may also be inherently non-scalable, as each client organization has a different network, different detection capabilities, and different risk tolerance. While automation alone cannot increase the scalability of traditional SOAR platforms, many client organizations are skeptical and may hesitate to adopt an automation SOAR platform, even though it may at least mitigate the expense of manual deployments.

[0023] Thus, there is a need for improved devices, systems, and methods for remotely managing SOAR for other organizations. The devices, systems, and methods disclosed herein allow service providers to centrally and remotely manage SOAR platforms with modular, standardized content, and thus can be easily provided to client organizations to provide comprehensive, well-integrated SOAR solutions. The SOAR solutions provided by the improved devices, systems, and methods disclosed herein can provide improved results to client organizations without human intervention, and can provide improved results at a greater scale and at a fraction of the cost compared to traditional, manually integrated SOAR platforms that require active human integration and ongoing maintenance. The improved devices, systems, and methods disclosed herein overcome the aforementioned challenges and can be implemented to act as a centralized platform for remotely managing SOAR for other organizations by expanding beyond providing simple management of systems and content. Rather, the improved devices, systems, and methods for remotely managing SOAR for other organizations allow service providers to provide scalable orchestration content and management to a multitude of client systems in a manner that allows for infinite modular and / or flexible solutions to be customized according to the needs of each client.

[0024] The present disclosure contemplates such devices, systems, and methods, all of which provide numerous technical advantages over traditional MSSP and SIEM platforms. For example, traditional MSSP devices, systems, and methods lack the automation, artifacts, and interfaces necessary to seamlessly scale an MSSP platform to provide SIEM services to hundreds, if not thousands, of tenant networks. Instead, traditional MSSP devices, systems, and methods require manual integration and management, which is inefficient and costly. Traditional MSSP devices, systems, and methods also require each tenant network to share the manual resources employed by the MSSP, making each tenant network less secure. In contrast, the devices, systems, and methods disclosed herein are highly automated and are configured to allow MSSPs to efficiently implement and continuously monitor tenant networks in real time with minimal manual intervention. Not only do traditional MSSP devices, systems, and methods lack such automation, but it is highly impractical, if not impossible, for MSSPs to manually monitor hundreds, if not thousands, of tenant networks in real time. The devices, systems, and methods disclosed herein are also technologically adaptable. Such adaptability, coupled with the highly scalable nature of the MSSP devices, systems, and methods disclosed herein, allows MSSPs to track changes across a large number of tenant deployments, monitor responses to those changes, and autonomously execute them for applicable tenant deployments that may benefit from them. In other words, the updates provided by the disclosed MSSP devices, systems, and methods facilitate technological evolution, enabling MSSPs to provide higher levels of security for each new tenant deployment.Additionally, the MSSP devices, systems, and methods disclosed herein are substantially integrated to enable autonomous security hardening actions, such as deleting suspicious accounts, deleting suspicious files, autonomously alerting security administrators, etc. These technical advantages are described in more detail herein. In summary, conventional MSSP devices, systems, and methods are inherently more prone to security events and are therefore technically less secure than the devices, systems, and methods disclosed herein.

[0025] Referring now to FIG. 1, a block diagram of a system 1000 configured to remotely manage security orchestration, automation, and response ("SOAR") for other organizations is depicted in accordance with at least one non-limiting aspect of the present disclosure. According to the non-limiting aspect of FIG. 1, the system 1000 can include a SOAR management server 1002, which includes a memory 1006 configured to store a SOAR application (see FIG. 2) and a processor 1004 configured to execute the stored SOAR application (see FIG. 2), as described further with reference to FIG. 2. For example, the SOAR management server 1002 can be a computational resource owned or leased by a managed security service provider ("MSSP"). The SOAR management server 1002 can be communicatively coupled to a plurality of tenants 1010a, 1010b, . . . 1010n via a network 1008. The plurality of tenants 10101, 10102, . . . 10103, . . . 10104, . . . 10105, . . . 10106, . . . 10107, . . . 10108, . . . 10109, . . . 10101020, . . . 10108, . . . 10109, . . . 1010101020, . ... n Each of the networks 1008 may represent a customer (e.g., an organization) that has a contract with the MSSP. According to a non-limiting aspect of FIG. 1, the network 1008 may include any of a variety of wired, long-range wireless, and / or short-range wireless networks. For example, the network 1008 may include an internal network, a local area network (LAN), WiFi, a cellular network, a near field communication (hereinafter "NFC"), etc.

[0026] With further reference to FIG. 1, multiple tenants 10101, 10102...1010 n Each of the tenants 10101 and 10102 may host one or more instances of one or more clients 1012, 1014, 1016. For example, a first tenant 10101 may host one or more client applications 10121, 10122, . . . 1012. n , and a second tenant 10102 may include one or more machines implementing one or more client applications 10141, 10142...1014 n and / or a third tenant 1010. n One or more client applications 10161, 10162...1016 n Each of the tenants 10101, 10102, and 1010 n can include an intranet whereby each machine implements a client application. For example, each of tenants 10101, 10102, and 1010 n Each of the can represent a customer, such as an organization that has contracted with the MSSP for security services.

[0027] Therefore, the SOAR management server 1002 manages multiple tenants 10101, 10102, 1010 n 10101, 10102, 10103, and is responsible for monitoring and managing threats for each of the client applications 1012, 1014, 1016. n The differences and complexities of the architectures of the different tenants can make this complicated and inefficient for MSSPs. Therefore, known SOAR tools do not analyze tenants 10101, 10102, 10103, 10104, 10105, 10106, 10107, 10108, 10109, 10200, 10201, 10202, 10203, 10204, 10205, 10206, 10207, 10208, 10209, 10300, 10301, 10301, 10302, 10303, 10304, 10305, 10306, 10307, ​​10308, 10309, 10401, nThis can render the SOAR management server 1002 technically defenseless and vulnerable to attacks. According to non-limiting aspects of the present disclosure, the SOAR management server 1002 can implement a SOAR management application (see FIG. 2 ) that addresses these deficiencies technically and practically by enhancing the ability of the SOAR management server 1002 to manage and send alerts and client application updates for multiple tenants based on correlated and synergistic development needs. Additionally, the architecture 2000 of FIG. 2 further illustrates different means of communication between the various modules.

[0028] 2, a block diagram of a functional architecture 2000 of the system 1000 of FIG. 1 is depicted in accordance with at least one non-limiting aspect of the present disclosure. According to a non-limiting aspect of FIG. 2, the architecture 2000 may include a content library 2002, a variable store 2004, an automation schema 2008, and a service operation engine 2012, collectively provided via applications stored in memory 1006 (FIG. 1) of the SOAR management server 1002. According to some non-limiting aspects, the SOAR management server 1002 may provide services to MSSPs and / or tenants 1010. n For example, the SOAR management server 1002 may be cloud-based. When executed by the processor 1004 (FIG. 1), the content library 2002, variable store 2004, automation schema 2008, and service operation engine 2012 of the application may work together to provide services to multiple tenants 1010. n or for a client organization, the application may facilitate large-scale simultaneous configuration, management, and / or control of multiple SOAR platforms 2018. Additionally, when executed by the processor 1004 (FIG. 1), the application may support the SOAR platforms 2018 of the client organizations, either abstractly or dynamically, as described in further detail herein.

[0029] According to certain non-limiting aspects, the application deployed by the SOAR management server 1002 may be configured as an Azure Sentinel Automation Portal (ASAP), as disclosed in U.S. Provisional Patent Application No. 63 / 196,458, entitled DEVICES, SYSTEMS, AND METHODS FOR ENHANCING SECURITY INFORMATION & EVENT MANAGEMENT UPDATES FOR MULTIPLE TENANTS BASED ON CORRELATED, AND SYNERGISTIC DEPLOYMENT NEEDS, filed June 3, 2021, the disclosure of which is incorporated herein by reference in its entirety. For example, according to one non-limiting aspect, the ASAP portal runtime software code may include server middleware responsible for processing content from the content library 2002, connections to the SOAR platform 2018, and / or other services, as well as service requests for the SOAR management server 1002 to deploy, update, and / or read. In other words, an application deployed by the SOAR management server 1002, including the content library 2002, the variable store 2004, and the automation schema 2008, is managed by one or more tenants 1010. 1-n Combined with the ability to work simultaneously with all 1010 tenants 1-n (Figure 1) provides a unified and simplified view of the deployment.

[0030] The content library 2002 may be configured to store various artifacts (e.g., detections, automations, workbooks, alert rules, playbooks, etc.) that enable the SOAR management server 1002 to manage the content of one or more tenants 1010. n2 may be stored locally to the application, meaning provided via memory 1006 (FIG. 1) of SOAR management server 1002. However, according to other non-limiting aspects, content library 2002 may be stored on a remote server communicatively connected to SOAR management server 1002. In still other non-limiting aspects, content library 2002 may be provided by a third party provider (e.g., GitHub, GitLab, etc.) similar to that disclosed in U.S. Provisional Patent Application No. 63 / 196,458, entitled DEVICES, SYSTEMS, AND METHODS FOR ENHANCING SECURITY INFORMATION & EVENT MANAGEMENT UPDATES FOR MULTIPLE TENANTS BASED ON CORRELATED, AND SYNERGISTIC DEPLOYMENT NEEDS, the disclosure of which is incorporated herein by reference in its entirety. In summary, the content library 2002, and more specifically, the artifacts stored within the content library 2002, govern the rules that allow the SOAR management server 1002 to manage the tenants 1010. n For example, the content library 2002 may interface with and / or manage the SOAR management server 1002 and / or the SOAR platform 2018 for a client organization. n One or more rules and / or templates may be stored that are configured to automate the deactivation of a user account if a determined risk score exceeds a predetermined threshold based on the overall sensed variables.

[0031] According to a non-limiting embodiment of FIG. 2, a particular client organization and / or tenant 1010 nTenant 1010, such as architecture-specific variation points n The requirements can be provided to artifacts stored in the content library 2002, which can accomplish this according to deployable artifact templates as disclosed in U.S. Provisional Patent Application No. 63 / 196,458, filed June 3, 2021, entitled DEVICES, SYSTEMS, AND METHODS FOR ENHANCING SECURITY INFORMATION & EVENT MANAGEMENT UPDATES FOR MULTIPLE TENANTS BASED ON CORRELATED, AND SYNERGISTIC DEPLOYMENT NEEDS, the disclosure of which is incorporated herein by reference in its entirety. For example, the content library 2002 can include "json" files for defining alert rules, workbooks, playbooks, etc. As new content is added to the content library 2002 or existing content is updated, the changes are communicated to the tenants 1010 via the SOAR management server 1002. n In other words, the SOAR management server 1002, when deployed, can be automatically pushed to the SOAR platform 2018 of each tenant 1010. 1-n (Figure 1) Can be configured to meet specific SOAR needs, which will vary based on each tenant's architecture.

[0032] The variable store 2004 is connected to the SOAR management server 1002 and the tenant 1010. n , or a client organization's architecture. For example, the variable store 2004 may be configured to allow a user of the SOAR management server 1002, such as an MSSP, to create a tenant 1010 when detected by the SOAR management server 1002. nThe content library 2020 may allow variables related to the architecture of the SOAR management server 1002 to be defined and / or linked with various artifacts stored in the content library 2020, which enhances the ability of the SOAR management server 1002 to automate client-specific implementations. According to some non-limiting aspects, the variables may be stored using a primary key that uniquely indicates the destination environment. For example, when onboarding an environment to be managed, the MSSP or another user may indicate an administrator account tied to that environment so that it can be configured when deployed to that particular environment. Thus, the automation being deployed needs to be given which account is the administrator to run automation specific to that account's role.

[0033] Automation Schema 2008 is a set of various tenants 1010 1-n Recognizing commonalities between the architectures of (FIG. 1), a SOAR management server 1002 implementation may be configured to serve a single client organization or to serve multiple tenants 1010. 1-n This represents a significant technological improvement over traditional SOAR management platforms that are structured to require significant manual effort to implement across multiple client organizations. For example, traditional SOAR platforms require assessment of a client's unique environment and needs, which necessitates the design and implementation of a custom solution. The automation schema 2008 of FIG. 2, in conjunction with the content library 2002 and variable store 2004, enables the SOAR management server 1002 of FIGS. 1 and 2 to automatically generate customized SOAR solutions to serve an unprecedented number of tenants 1010. 1-n or to enable the simultaneous scaling of such solutions across client organisations.

[0034] The application launched by the SOAR management server 1002 may further include an API broker 2006 and a graphical user interface 2010. An example of such a graphical user interface 4000, according to one non-limiting aspect, is depicted in FIG. 4. For example, the graphical user interface 4000 of FIG. 4 may include one or more platforms 4002, 4004, 4006 for manipulating authorization settings. The platforms may be third party applications that serve as authentication mechanisms, such as, for example, Okta 4002, Duo 4004, and / or Azure AD 4006. Once the platform 4002 is selected, the graphical interface may display a configuration wizard 4008. The configuration wizard 4008 may include one or more windows 4010 that allow a user to configure various settings for various parameters, such as users, user groups, and / or remediation playbooks. Each window 4010, when selected, may display instructions 4012 through which a user may configure certain settings of its parameters configured to visually present information and accept user input via a display and / or peripheral devices (e.g., keyboard, mouse, touch screen, etc.) communicatively connected to the SOAR management server 1002. For example, the graphical user interface 2010 may be configured to execute a wizard through which a user may configure one or more tenants 1010. n or control the set-up and / or automation of a SOAR platform for a client organization.

[0035] With further reference to FIG. 2, in accordance with at least one non-limiting aspect of the present disclosure, such a tenant 1010 n An example architecture is depicted. A SOAR management server 1002 manages tenants 1010. nA tenant 1010 that detects variables related to the architecture and includes one or more of the modules shown in FIG. n For example, according to a non-limiting embodiment of FIG. n The architecture includes a remote SOAR platform 2018, a dashboard / reporting module 2022, and one or more security tool application program interfaces ("APIs") 2020. a-d Each security tool API 2020 a-d Tenant 1010 n APIs can be configured to prevent malicious attacks and abuse of APIs of clients deployed in the cloud. APIs are key to programming web-based interactions and are therefore a target for hackers. Therefore, security tools API 2020 a-d can monitor the client's APIs and send alerts 2030 back to the SOAR platform 2018 if a suspicious event is detected.

[0036] According to some non-limiting aspects, the dashboard / reporting module 2022 may include a tenant 1010 n For example, the dashboard / reporting module 2022 may provide a customizable visual representation of the cybersecurity of the tenant 1010. n It may be possible to see what is happening across the network and take solutions to protect the network in response to identified threats. This may assist the MSSP and / or client organization in identifying, preventing, mitigating, and / or predicting cybersecurity incidents in a significantly more efficient manner. Of course, the specific tenant 1010 in FIG. 2 may also be able to provide a solution to the problem. nAccording to another non-limiting aspect, a tenant 1010 is designed and deployed by a SOAR management server 1002. n The architecture may alternatively be configured to include alternative types and / or quantities of modules. The capabilities of the SOAR management server 1002, and more specifically, the content library 2002, variable store 2004, and automation schema 2008, are managed by the tenants 1010. n Instead, it enables customized SOAR-based solutions that can be managed remotely. Each solution differs in the variables discovered by the variable store 2004 and the artifacts selected from the content library 2002 based on the discovered variables when deployed by the SOAR management server 1002.

[0037] The architecture 2000 of FIG. 2 also includes various modules of a SOAR management server 1002 and one or more tenants 1010. n 20. The diagram further illustrates different means of communication between the tenants 1010 and the content library 2002. For example, a particular module, such as the API broker 2006, may communicate with other modules, such as the service operations engine 2012, the graphical user interface 2010, the remote SOAR platform 2018, and the dashboard / reporting module 2022, via the service layer 2024. Other modules, such as the content library 2002, the variable store 2004, and the API broker 2006, may communicate with the tenants 1010 and the content library 2002 via the management and content delivery layer 2026. n The remote SOAR platform 2018 may communicate with the tenant 1010 via a SOAR communication protocol 2028. n One or more security tool APIs of 2020 a-cThe one or more security tool APIs may communicate with the remote SOAR platform 2018 via an alert protocol 2030 according to rules defined by applied artifacts 2032 from the content library 2002, as defined by variables from the variable store 2004. The impact of selected artifacts from the content library 2002 and sensed variables from the variable store 2004 on the artifacts 2032 is illustrated in FIG. 2 via corresponding cross-hatching. In other words, each means of communication may include different content, although similar or the same protocols and / or methods may be applied. Thus, an end user may utilize the architecture 2000 of FIG. 2 with or without utilizing a particular managed detection and response ("MDR") service. However, the same APIs may be utilized by a particular MDR service user to interface with the APIs, manage the architecture 2000, and take actions on behalf of one or more tenants, if provided with the particular MDR service.

[0038] As shown in the non-limiting embodiment of FIG. 2, the various modules of the SOAR management server 1002 architecture are determined by and / or previously stored in the variable store 2004 and the tenants 1010 n According to a particular artifact 2032 from the content library 2002, which is an autonomously selected variable associated with the tenant 1010 n The content library 2002 and variable store 2004 may be configured to communicate with, manage, and control the remote SOAR platform 2018 of each tenant 1010. Thus, the content library 2002 and variable store 2004, in conjunction with the automation schema 2008, enable the SOAR management server 1002 to nFor example, the artifact 2032 may enable the API broker 2006 and the service operations engine 2012 of the SOAR management server 1002 to autonomously generate custom configurations for integration with and remote management of the tenant 1010. n The artifact 2032 may define a means for interfacing with a remote SOAR platform 2018 of the same type as the content alert 2030. Additionally, the artifact 2032 may define a means for interfacing with the content alert 2030 and the remote SOAR platform 2018 of the same type as the content alert 2030. a-d to the remote SOAR platform 2018.

[0039] The SOAR management server 1002, including the content library 2002, variable store 2004, and automation schema 2008, can provide a powerful cloud-based tool that allows an MSSP to remotely manage a client organization's SOAR platform 2018. The primary interface is a graphical user interface 2010, but the API interface 2006 can further enable programmatic control of the SOAR platform 2018 management functions, allowing users to create and manage tenants 1010 through a central interface in the form of playbooks, automations, integrations, dashboards, and other SOAR control code-based content. n In addition, the content library 2002, the variable store 2004, and the automation schema 2008 of the SOAR management server 1002 provide functionality that allows customization of content, and the tenant 1010 can deploy content to remote environments such as the tenant 1010. n In other words, the SOAR management server 1002 can provide a modular and extensible way to reference stored libraries of code and content (e.g., content library 2002) so that options are autonomously determined at deployment time.

[0040] For example, a user may deploy a set of artifacts stored in the content library 2002, such as playbooks, code, integrations, and / or dashboards that enable integration of next generation antivirus ("NGAV") products, email security products, and / or identity protection products, and then automate the detection, investigation, and response stages based on controls accepted from the user via the graphical user interface 2010. Additionally and / or alternatively, the SOAR management server 1002 may be configured to allow a user to manage the content of a tenant 1010. n 2008。 Additionally, the graphical user interface 2010 may enable a user to "opt-in" and / or "opt-out" of the automation functionality presented by the automation schema 2008 through a wizard-like, walk-through, easy-to-handle application. A user may further customize reporting and / or dashboard functionality and preferences applied through the dashboard / reporting module 2022, which may be packaged for deployment simultaneously with the automated content.

[0041] According to some non-limiting aspects, the applications launched by the SOAR management server 1002 may be scalable, which means that the applications may be managed by tenants 1010 that the SOAR platform 2018 can manage remotely. nThis means that the application, including the content library 2002, the variable store 2004, and the automation schema 2008, may be configured with the ability to expand or grow in terms of the number of services (e.g., scalability) and / or the number of SOAR management functions that it provides. In other words, the application, including the content library 2002, the variable store 2004, and the automation schema 2008, may be designed to minimize the level of effort required to enable the SOAR management server 1002 to be extended for future use. For example, through the extensibility mechanisms provided by the application launched by the SOAR management server 1002, pluggable add-ons configured to enable additional service components and functions of the SOAR management server 1002 may be deployed in the future.

[0042] According to some non-limiting aspects, the extensibility mechanism can be implemented in various ways that allow for plugging in additional SOAR service components. For example, authentication mechanisms such as DUO, Okta, etc. can be supported simultaneously (as shown via graphical user interface 4000 in FIG. 4). These authentication mechanisms do not have to be hard-coded, but the configuration files can be discoverable (e.g., a main "config" file for each authentication mechanism can be placed in a well-known repository location that is scanned for new or deleted files). If new configurations such as Azure AD are also to be supported, the corresponding configuration file for Azure AD will be placed in the same repository location as the Duo and Okta configurations, discovered by the application management server, and presented to the user for selection and configuration in the client as needed. The configuration files can conform to a schema defined and understood by this application management tool, and elements 4002, 4004, 4006 (FIG. 4) of user interface 4000 (FIG. 4) can be generated and added accordingly. Notably, the SOAR application discussed herein is built to be easily extensible with additional configuration capabilities that are dynamically plugged in through new configurations according to the present methodology, rather than being hard-coded into its source code.

[0043] When a user deploys these add-ons via automation, they can trigger applications launched by the SOAR management server 1002 and enable additional subscription-based services on behalf of the MSSP, thereby enabling tenants 1010. n Additionally and / or alternatively, applications deployed by the SOAR management server 1002 may be configured to work with existing “unmanaged” content, such as an entirely new customized tenant 1010, as depicted in FIG. nInstead of generating the architecture, tenant 1010 n This may enable discovery and light management of at least some of the prior SOAR assets already deployed by

[0044] As previously described, when executed by the processor 1004 (FIG. 1), the application may be configured to abstractly and / or dynamically manage a client organization's SOAR platform 2018. For example, in an abstract implementation, the SOAR management server 1002 may employ generically defined artifacts (e.g., automations) stored in the content library 2002, such as those disclosed in U.S. Provisional Patent Application No. 63 / 196,458, entitled DEVICES, SYSTEMS, AND METHODS FOR ENHANCING SECURITY INFORMATION & EVENT MANAGEMENT UPDATES FOR MULTIPLE TENANTS BASED ON CORRELATED, AND SYNERGISTIC DEPLOYMENT NEEDS, filed June 3, 2021, the disclosure of which is incorporated herein by reference in its entirety. The generically defined artifacts may include, for example, blocks of executable code. However, platform-specific implementations may subsequently be provided (e.g., Azure Defender, Crowdstrike, etc.). Abstract automations / playbooks can be written in a generic format and then transformed into a specific format at deployment time. For example, an automation / playbook can be created that is specifically configured to deactivate a user's email account in the event of a business email data breach. However, when that automation / playbook is actually implemented in a specific customer environment, the system 1000 (FIG. 1) and functional architecture 2000 (FIG. 2) disclosed herein can transform the generically written content into a version specifically implemented for the specific mail application that the tenant is using. In this way, content can be generated that can be programmatically adapted to multiple environments without rewriting, unlike traditional systems and architectures.Thus, the system 1000 (FIG. 1) and functional architecture 2000 (FIG. 2) disclosed herein provide an important technical solution to the technical problem of traditional automation / playbook incompatibility: flexible formats and interfaces, allowing users to extend services to multiple tenants and their authentication mechanisms.

[0045] Alternatively, in a dynamic implementation, the SOAR management server 1002 can dynamically generate new automation types via the content library 2002, which can be automatically detected by the graphical user interface 2010 for subsequent deployment and displayed for selection via the graphical user interface 2010. Similarly, a new automation, such as an endpoint monitoring solution (e.g., CarbonBlack, etc.), can be added to the content library 2002 for a given automation type, such as one that blocks the execution of harmful programs detected by the automation (e.g., block executable file automation, etc.), which in turn is automatically made available to the GUI and can be deployed to the appropriate client SOAR (using their security tools).

[0046] SOAR Management Server 1002, Tenant 1010 n, or at deployment time via a client, certain points of variance can be sensed by the variable store 2004 and associated with artifacts stored in the content library 2002. For example, the SOAR management server 1002 has the ability to configure automated response / remediation actions (e.g., playbooks) for a given configuration. These remediation actions can require optional steps, for example, the tenant must first approve the action. So, the configuration of a remediation automation might include similar configuration for the actual task (e.g., blocking an account), but the approval step may be done manually via phone, email, or workflow form (e.g., integration via a service ticket). As such, the approval step is variable (e.g., it may or may not be present, and if present, it may be accomplished in many ways) and requires pulling the appropriate code and configuration from the automation repository to configure for this client and SOAR automation.

[0047] Therefore, at the time of deployment, the variation point is tenant 1010 n Based on the network architecture of tenant 1010 n According to one non-limiting aspect, the SOAR management server 1002 automates the SOAR platform 2018 to provide security tools APIs 2020. a-d Based on input received by the tenant 1010, the automation may block a user account upon detection of a security event. n For example, during deployment via a wizard presented via the graphical user interface 2010, the automation may include multiple steps or conditions, such as approval from an administrative account. nThe user may be requested to provide information related to one or more administrative accounts (e.g., phone numbers, short message service ("SMS") addresses, email addresses, etc.). Accordingly, certain steps and / or conditions, such as contacting and / or directing actions from the administrative accounts, may be programmed into the automation via the graphical user interface 2010.

[0048] According to one non-limiting aspect, executing the custom automation causes the SOAR management server 1002, and more specifically, the custom automation generated by the SOAR management server 1002, to manage the SOAR platform 2018 to communicate with one or more security tool APIs 2020. a-d The SOAR management server 1002 may detect security events based on inputs / alerts received from the tenant 1010 and determine that a user account should be blocked. The SOAR management server 1002 may manage the SOAR platform 2018 to notify the management account, and the automation may wait for approval, and upon approval, may proceed to subsequent steps in the automation, and ultimately to the tenant 1010. n This will involve removing suspicious accounts from the network. As mentioned above, this is done by each security tool API2020 a-d The deletion of suspicious accounts may be abstracted into an automation type, with specific implementations for the tenant 1010 and / or notification methods. n This is just one example of the actions that SOAR Platform 2018 can take to enhance the security of a network. For example, apart from blocking an account, SOAR Platform 2018 can also delete suspicious files and send emails to security administrators, among other actions.

[0049] Once deployed by the SOAR management server 1002, the artifacts 2032 (e.g., automations) are deployed to the tenant's 1010 nIn some non-limiting embodiments, the MSSP and / or the client may modify the deployed configuration. For example, in some non-limiting embodiments, the client may modify the tenant 1010 n The MSSP may wish to control the configuration deployed across the network. However, according to other non-limiting aspects, the client may wish for the MSSP to have exclusive control over the configuration. Nevertheless, the applications deployed by the SOAR management server 1002 may be configured to automatically detect changes made by the MSSP and / or the client and use them for managing future deployments and / or updates to already deployed artifacts 2032. According to some non-limiting aspects, such changes may be utilized by artificial intelligence stored in the memory 1006 (FIG. 1) of the SOAR management server 1002 to adapt one or more artifacts 2032 (e.g., templates, workflows, etc.) in the content library 2002 for enhanced deployment for similar clients and / or architectures.

[0050] Thus, the content library 2020, when deployed by the SOAR management server 1002 application along with the graphical user interface 2010 and API broker 2006, can act as a contribution mechanism that can abstractly and / or dynamically detect updates to both the content library 2002 and the client's SOAR platform 2018. These updates can be managed centrally via the SOAR management server 1002, which acts as a central console for the system 1000 (FIG. 1), allowing unprecedented scalability for managing a large number of clients. In this way, the SOAR management server 1002 can remotely manage the different client's SOAR platform 2018 reliably and consistently. Due to its modular design, it can also be "future-proofed," allowing users and third-party applications to contribute new artifacts 2032 and / or update existing artifacts 2032 to them as third-party vendor solutions evolve.

[0051] Referring now to FIG. 3, a method 3000 of remotely managing another organization's SOAR platform 2018 (FIG. 2) is depicted in accordance with at least one non-limiting aspect of the present disclosure. According to the non-limiting aspect of FIG. 3, the method 3000 may be performed by the SOAR management server 1002 (FIGS. 1 and 2). In particular, a SOAR management application including a content library 2002 (FIG. 2), a variable store 2004 (FIG. 2), an automation schema 2008 (FIG. 2), and an API broker 2006 (FIG. 2), stored in the memory 1006 (FIG. 1), may cause the processor 1004 (FIG. 1) of the SOAR management server 1002 (FIGS. 1 and 2) to perform the method 3000. The method 300 may include a step 3002 of detecting variables associated with the tenant via the variable store 2004 (FIG. 2). Once the variables are sensed, the method 3000 may include associating 3004, via the content library 2002 (FIG. 2), the sensed variables with artifacts 2032 (FIG. 2) stored within the content library 2002 (FIG. 2). The method 3000 may include associating 3004, via the automation schema 2008 (FIG. 2), the tenant 1010 based on the artifacts 2032 (FIG. 2). n (FIG. 2) is an automation for a tenant 1010 n A security tool configured to continuously monitor one or more APIs deployed by (Figure 2) a-d (FIG. 2). The method 3000 may further include a step of generating 3006 the automation, which may include the API broker 2006 (FIG. 2), to transmit the generated automation to the tenant 1010. n (Figure 2) to a SOAR platform 2018 (Figure 2) deployed by the device 2008.

[0052] Referring now to FIG. 5, there is depicted a scalable security information and event management framework computer system 500, originally described in U.S. Patent No. 10,708,123, entitled SCALABLE SECURITY INFORMATION AND EVENT MANAGEMENT (SIEM) FRAMEWORK, filed April 24, 2019, the disclosure of which is incorporated herein by reference in its entirety. Specifically, FIG. 5 illustrates a schematic diagram of a computer system 500, in which the embodiments described in this disclosure may be implemented and practiced. According to one non-limiting aspect, the computer system 500 may include a bus 502 (i.e., interconnect), one or more processors 504, a main memory 506, a read-only memory 508, a removable storage medium 510, a mass storage device 512, and one or more communication ports 514. It should be understood that components such as removable storage media are optional and may not be required in all systems. The communication port 514 may be connected to one or more networks in a manner that allows the computer system 500 to receive and / or transmit data. As used herein, "processor" means one or more microprocessors, central processing units (CPUs), computing devices, microcontrollers, digital signal processors, or similar devices, or any combination thereof, regardless of architecture. An apparatus that executes a process may include, for example, a processor and devices, such as input and output devices, suitable for executing the process. The processor 504 may be any known processor that is generally well known to those skilled in the relevant art and well defined in the literature, such as, but not limited to, processors manufactured and / or sold by INTEL®, AMD®, or MOTOROLA®, etc. The communication port 514 may be any of an RS-232 port for use with a modem-based dial-up connection, a 10 / 100 Ethernet port, a Gigabit port using copper or fiber, a USB port, or the like.The communication port 514 may be selected depending on the network, such as a local area network (LAN), a wide area network (WAN), a CDN, or any network to which the computer system 500 connects. The computer system 500 may communicate with peripheral devices (e.g., a display screen 516, an input device 518) via an input / output (I / O) port 520. The main memory 506 may be a random access memory (RAM) or any other dynamic storage device(s) commonly known in the art. The read-only memory 508 may be any static storage device, such as a programmable read-only memory (PROM) chip for storing static information, such as instructions for the processor 504. The mass storage device 512 may be used to store information and instructions. For example, hard disks, such as the Adaptec® family of Small Computer Serial Interface (SCSI) drives, optical disks, arrays of disks, such as a Redundant Array of Independent Disks (RAID), such as the Adaptec® family of RAID drives, or other mass storage devices may be used. The bus 502 communicatively connects the processor 504 with other memory, storage, and communication blocks. The bus 502 may be a PCI / PCI-X, SCSI, Universal Serial Bus (USB) based system bus (or others), etc., depending on the storage device used. The removable storage medium 510 may be any of the following: an external hard drive, a floppy drive, an IOMEGA® Zip drive, a compact disk read only memory (CD-ROM), a rewritable compact disk (CD-RW), a digital versatile disk read only memory (DVD-ROM), etc.

[0053] Various aspects of the subject matter described herein are set forth in the following numbered sections:

[0054] Item 1: A security automation platform communicatively connected to a tenant configured to deploy a tenant security platform, the security automation platform including a processor and a memory configured to store a security automation application including a content library, a variable store, an automation schema, and an application program interface (API) broker, wherein when executed by the processor, the security automation application causes the processor to sense variables related to the tenant via the variable store, associate the sensed variables with artifacts stored in the content library via the content library, generate automation for the tenant based on the artifacts via the automation schema, the automation including a security tool configured to continuously monitor the API deployed by the tenant security platform, and send the generated automation to a SOAR platform deployed by the tenant via the API broker of the security automation application.

[0055] Clause 2: The security automation platform of clause 1, wherein the automation includes a security tool configured to continuously and autonomously monitor the APIs, and when executed by the processor, the security automation application further causes the processor to detect, via the security tool, a security event related to the APIs deployed by the tenant security platform, generate, via the automation, an alert related to the detected security event, and send, via the automation, the alert to a tenant security platform deployed by the tenant.

[0056] Item 3: A security automation platform as described in item 1 or 2, where the alert provides recommended actions to mitigate the detected security event.

[0057] Item 4: The security automation platform of any one of items 1 to 3, wherein the detected security event is associated with a suspicious account, and the recommended action includes removing network access associated with the suspicious account via the tenant security platform.

[0058] Clause 5: The security automation platform of any one of clauses 1 to 4, wherein the recommended action requires approval from a tenant administrative account before removing network access for a suspicious account.

[0059] Clause 6: The security automation platform of any one of clauses 1 to 5, wherein the artifacts include at least one of a detection, a workbook, an alert rule, a playbook, or a combination thereof.

[0060] Clause 7: The security automation platform of any one of clauses 1 to 6, wherein the security automation platform is configured to automatically update the artifacts for future use based on detected variables associated with the tenant.

[0061] Clause 8: The security automation platform of any one of clauses 1 to 7, wherein the tenant is one of a plurality of tenants, the tenant security platform is one of a plurality of tenant security platforms deployed by the plurality of tenants, and the security automation platform is further configured to simultaneously manage each tenant security platform deployed by the plurality of tenants.

[0062] Clause 9: The security automation platform of any one of clauses 1 to 8, wherein the security automation application further includes a graphical user interface configured to accept user input, the user input including instructions related to management of a tenant security platform deployed by a tenant.

[0063] Clause 10: A method for enhancing network security via a security orchestration, automation, and response (SOAR) management server communicatively connected to a tenant configured to deploy a SOAR platform, the SOAR management server including a processor and a memory configured to store a SOAR management application including a content library, a variable store, an automation schema, and an application program interface (API) broker, the method including: detecting variables related to the tenant via the variable store; associating the detected variables with artifacts stored in the content library via the content library; generating automation for the tenant based on the artifacts via the automation schema, the automation including a security tool configured to continuously monitor APIs deployed by the tenant; and sending the generated automation to the SOAR platform deployed by the tenant via the API broker of the SOAR management application.

[0064] Clause 11: The method of clause 10, further comprising: detecting, via a security tool, a security event related to the API deployed by the tenant; generating, via automation, an alert related to the detected security event; and sending, via automation, the alert to a SOAR platform deployed by the tenant, the alert providing a recommended action to mitigate the detected security event.

[0065] Clause 12: The method of clause 10 or clause 11, wherein the detected security event is associated with a suspicious account and the recommended action includes removing network access associated with the suspicious account via the SOAR platform.

[0066] Clause 13: The method of any one of clauses 10 to 12, further comprising automatically updating the artifacts for future use based on the detected variables associated with the tenant via the content library.

[0067] Clause 14: A system for enhancing network security by remotely managing a SOAR platform, the system including: a tenant configured to deploy a SOAR platform; and a security orchestration, automation, and response (SOAR) management server communicatively connected to the tenant, the SOAR management server including a processor and a memory, the memory configured to store a SOAR management application including a content library, a variable store, an automation schema, and an application program interface (API) broker, the SOAR management application, when executed by the processor, causes the processor to detect variables related to the tenant via the variable store, associate the detected variables with artifacts stored in the content library via the content library, generate automation for the tenant based on the artifacts via the automation schema, the automation including a security tool configured to continuously monitor the APIs deployed by the tenant, and send the generated automation to the SOAR platform deployed by the tenant via the API broker of the SOAR management application.

[0068] Clause 15: The system described in clause 14, wherein the security automation application, when executed by the processor, further causes the processor to detect, via the security tool, a security event related to the API deployed by the tenant security platform deployed by the tenant, generate, via automation, an alert related to the detected security event, and send, via automation, the alert to the tenant security platform deployed by the tenant.

[0069] Clause 16: The system of any one of clauses 14 or 15, wherein the alert provides a recommended action to mitigate the detected security event.

[0070] Clause 17: The system of any one of clauses 14 to 16, wherein the detected security event is associated with a suspicious account and the recommended action includes removing network access associated with the suspicious account via the tenant security platform.

[0071] Clause 18: The system of any one of clauses 14 to 17, wherein the recommended action requires approval from a tenant administrative account before removing network access for the suspect account.

[0072] Clause 19: The system of any one of clauses 14 to 18, wherein the artifacts include at least one of a detection, a workbook, an alert rule, a playbook, or a combination thereof.

[0073] Clause 20: The system of any one of clauses 14 to 19, wherein when executed by the processor, the security automation application further causes the processor to automatically update artifacts for future use based on detected variables associated with the tenant.

[0074] All patents, patent applications, publications, or other disclosure materials described herein are incorporated herein by reference in their entirety, as if each individual document were expressly incorporated by reference. All documents and any material, or portions thereof, that are incorporated herein by reference are incorporated herein only to the extent that the incorporated material does not contradict existing definitions, descriptions, or other disclosed material set forth in this disclosure. Therefore, and to the extent necessary, the disclosure set forth herein takes precedence over any conflicting material incorporated herein by reference, and the disclosure expressly set forth in this application controls.

[0075] Various exemplary and illustrative embodiments have been described. The embodiments described herein are understood to provide exemplary features of various details of the various embodiments of the present disclosure, and therefore, unless otherwise specified, it is understood that one or more features, elements, components, ingredients, materials, structures, modules, and / or aspects of the embodiments of the present disclosure may be combined, separated, substituted, and / or rearranged with or relative to one or more other features, elements, components, ingredients, materials, structures, modules, and / or aspects of the embodiments of the present disclosure, to the extent possible, without departing from the scope of the present disclosure. Thus, one skilled in the art will recognize that various substitutions, modifications, or combinations of any of the exemplary embodiments may be made without departing from the claimed subject matter. Moreover, one skilled in the art will recognize or be able to ascertain, by reviewing this specification, many equivalents to the various embodiments of the present disclosure using no more than routine experimentation. Thus, the present disclosure is not limited by the description of the various embodiments, but rather by the scope of the claims.

[0076] Those skilled in the art will recognize that the terms used herein in general, and in the appended claims in particular (e.g., the body of the appended claims) are generally intended as "open-ended" terms (e.g., the term "including" should be interpreted as "including but not limited to," the term "having" should be interpreted as "having at least," and the term "includes" should be interpreted as "including but not limited to"). It will be further understood by those skilled in the art that where a particular number of introduced claim recitations are intended, such intent will be expressly set forth in the claims, and in the absence of such recitation, no such intent exists. For example, as an aid to understanding, the following appended claims may include the use of the introductory phrases "at least one" and "one or more" to introduce the claim recitations. However, the use of such phrases should not be construed as implying that the introduction of a claim recitation with the indefinite article "a" or "an" limits any particular claim that contains such an introduced claim recitation to claims that contain only one such recitation, even if the same claim also includes the introductory phrases "one or more" or "at least one" and an indefinite article such as "a" or "an" (e.g., "a" and / or "an" should be ordinarily construed to mean "at least one" or "one or more"), nor should the use of definite articles used to introduce claim recitations be construed as implying that the introduction of any particular claim that contains such an introduced claim recitation is limited to claims that contain only one such recitation.

[0077] Furthermore, even if a particular number of recitations in an introduced claim is explicitly recited, one of ordinary skill in the art will recognize that such recitation should typically be interpreted to mean at least the recited number (e.g., the mere recitation of "two recitations" usually means at least two recitations or more than two recitations, without other qualifiers). Furthermore, in those cases where a convention similar to "at least one of A, B, and C, etc." is used, such structure is generally intended in the sense that one of ordinary skill in the art would understand the convention (e.g., "a system having at least one of A, B, and C" includes, but is not limited to, A alone, B alone, C alone, a system having A and B together, a system having A and C together, a system having B and C together, and / or a system having A, B, and C together, etc.). In instances where a convention similar to "at least one of A, B, or C, etc." is used, such construction is generally intended in the sense that one of ordinary skill in the art would understand the convention (e.g., "a system having at least one of A, B, or C" includes, but is not limited to, A alone, B alone, C alone, a system having A and B together, a system having A and C together, a system having B and C together, and / or a system having A, B, and C together, etc.). It will be further understood by those of ordinary skill in the art that disjunctions and / or phrases, whether in the specification, claims, or drawings, that typically present two or more alternative terms, should be understood to contemplate the possibility of including one of the terms, either of the terms, or both terms, unless the context dictates otherwise. For example, the phrase "A or B" will typically be understood to include the possibilities of "A" or "B" or "A and B."

[0078] With respect to the appended claims, those skilled in the art will appreciate that the actions recited therein may generally occur in any order. Also, while the claims are presented in sequence, it should be understood that various actions may occur in other orders than those recited, or may occur simultaneously. Examples of such alternative orders include overlapping, interleaving, interrupting, reordering, incremental, preparatory, supplementary, simultaneous, reverse, or other variant orders, unless the context dictates otherwise. Moreover, unless the context dictates otherwise, terms such as "responsive," "related to," or other past tense adjectives are generally not intended to exclude such variants, unless the context dictates otherwise.

[0079] It should be noted that any reference to "one embodiment," "embodiment," "exemplary," "one example," and the like means that a particular feature, structure, or characteristic described in connection with an embodiment is included in at least one embodiment. Thus, the appearances of the phrases "in one embodiment," "in an embodiment," "in an example," and "in one example" in various places throughout this specification do not necessarily all refer to the same embodiment. Furthermore, particular features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0080] As used herein, the singular forms "a," "an," and "the" include plural references unless the context clearly dictates otherwise.

[0081] Directional terms used herein, such as, for example, but not limited to, up, down, left, right, below, upward, front, rear, and variations thereof, relate to the orientation of the elements as shown in the accompanying drawings and are not intended to be limiting with respect to the claims, unless expressly stated otherwise.

[0082] The term "about" or "approximately" as used in this disclosure, unless otherwise specified, refers to an acceptable error for a particular value as determined by one of ordinary skill in the art, which depends in part on how the value is measured or determined. In certain embodiments, the term "about" or "approximately" refers to within 1, 2, 3, or 4 standard deviations. In certain embodiments, the term "about" or "approximately" refers to within 50%, 200%, 105%, 100%, 9%, 8%, 7%, 6%, 5%, 4%, 3%, 2%, 1%, 0.5%, or 0.05% of a given value or range.

[0083] In this specification, unless otherwise indicated, all numerical parameters are to be understood as predicated and, in all instances, the numerical parameter should be understood to be modified by the term "about" having regard to the inherent variability characteristic of the underlying measurement technique used to determine the numerical value of the parameter. At the very least, and not as an attempt to limit the application of the doctrine of equivalents to the scope of the claims, each numerical parameter set forth in this specification should at least be construed in light of the number of reported significant digits and by applying ordinary rounding techniques.

[0084] Any numerical range described herein includes all subranges subsumed within the described range. For example, a range of 1 to 100 includes all subranges between (and including) the recited minimum value of 1 and the recited maximum value of 100, i.e., the minimum value is equal to or greater than 1 and the maximum value is equal to or less than 100. Also, all ranges recited herein include the recited range endpoints. For example, a range of "1 to 100" includes the endpoints 1 and 100. Any maximum numerical limitation recited herein is intended to include all lower numerical limitations subsumed therein, and any minimum numerical limitation recited herein is intended to include all higher numerical limitations subsumed therein. Accordingly, applicants reserve the right to amend this specification, including the claims, to expressly recite subranges subsumed within the expressly recited ranges. All such ranges are inherently described herein.

[0085] Any patent application, patent, non-patent publication, or other disclosure material mentioned herein and / or listed in any application data sheet is incorporated herein by reference to the extent that the incorporated material is not inconsistent with this specification. Accordingly, and to the extent necessary, the present disclosure as expressly set forth herein takes precedence over any conflicting material incorporated herein by reference. Any material, or portion thereof, that is said to be incorporated herein by reference but that conflicts with existing definitions, statements, or other disclosure material set forth herein is incorporated only to the extent that no conflict arises between the incorporated material and the existing disclosure material.

[0086] The terms "comprise" (and any form of comprise, such as "comprises", "comprising"), "have" (and any form of have, such as "has" and "have"), "include" (and any form of include, such as "includes" and "including"), and "contain" (and any form of contain, such as "contains" and "containing") are open-ended linking verbs. As a result, a system that "comprises", "has", "contains", or "contains" one or more elements possesses those one or more elements, but is not limited to possessing only those one or more elements. Similarly, an element of a system, device, or apparatus that "comprises", "has", "contains", or "contains" one or more features possesses those one or more features, but is not limited to possessing only those one or more features.

[0087] The foregoing detailed description describes various aspects of devices and / or processes using block diagrams, flow charts, and / or examples. Where such block diagrams, flow charts, and / or examples include one or more functions and / or operations, those skilled in the art will appreciate that each function and / or operation in such block diagrams, flow charts, and / or examples can be individually and / or collectively implemented by a wide range of hardware, software, firmware, or substantially any combination thereof. Those skilled in the art will appreciate that some aspects of the aspects disclosed herein can be equivalently implemented in whole or in part in an integrated circuit as one or more computer programs running on one or more computers (e.g., as one or more programs running on one or more computer systems), as one or more programs running on one or more processors (e.g., as one or more programs running on one or more microprocessors), as firmware, or substantially any combination thereof, and that designing the circuitry and / or writing the code for the software and / or firmware, and / or firmware, in light of this disclosure, is within the skill of those skilled in the art. Furthermore, those skilled in the art will appreciate that the mechanisms of the subject matter described herein can be distributed as one or more program products in a variety of forms, and that the illustrative forms of the subject matter described herein apply regardless of the particular type of signal-bearing medium actually used to effectuate the distribution.

[0088] The instructions used to program the logic to implement the various disclosed aspects may be stored in memory within the system, such as dynamic random access memory (DRAM), cache, flash memory, or other storage device. Additionally, the instructions may be distributed over a network or by other computer readable media. Thus, a machine readable medium may include, but is not limited to, any mechanism for storing or transmitting information in a form readable by a machine (e.g., a computer), such as a floppy diskette, optical disk, compact disk, read-only memory (CD-ROM), and magneto-optical disk, read-only memory (ROM), random access memory (RAM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), magnetic or optical card, flash memory, or tangible machine readable storage devices used in transmitting information over the Internet via electrical, optical, acoustical, or other forms of propagated signals (e.g., carrier waves, infrared signals, digital signals, etc.). Accordingly, non-transitory computer-readable media includes any type of tangible machine-readable medium suitable for storing or transmitting electronic instructions or information in a form readable by a machine (eg, a computer).

[0089] As used in any aspect of the present specification, the term "control circuitry" may refer to, for example, hardwired circuitry, programmable circuitry (e.g., a computer processor having one or more individual instruction processing cores, a processing unit, a processor, a microcontroller, a microcontroller unit, a controller, a digital signal processor (DSP), a programmable logic device (PLD), a programmable logic array (PLA), or a field programmable gate array (FPGA)), a state machine circuit, firmware that stores instructions executed by the programmable circuit, and any combination thereof. The control circuitry may be embodied, collectively or individually, as circuitry that forms part of a larger system, such as an integrated circuit (IC), an application specific integrated circuit (ASIC), a system on a chip (SoC), a desktop computer, a laptop computer, a tablet computer, a server, a smartphone, etc. Thus, as used herein, "control circuitry" includes, but is not limited to, electrical circuitry having at least one discrete electrical circuit, electrical circuitry having at least one integrated circuit, electrical circuitry having at least one application specific integrated circuit, electrical circuitry forming a general purpose computing device configured by a computer program (e.g., a general purpose computer configured by a computer program at least partially executing a process and / or a device described herein, or a microprocessor configured by a computer program at least partially executing a process and / or a device described herein), electrical circuitry forming a memory device (e.g., in the form of a random access memory), and / or electrical circuitry forming a communication device (e.g., a modem, a communication switch, or an optoelectronic device).Those skilled in the art will recognize that the subject matter described herein can be implemented in an analog or digital fashion or some combination thereof.

[0090] As used in any aspect herein, the term "logic" may refer to an application, software, firmware, and / or circuitry configured to perform any of the operations described above. Software may be embodied as a software package, code, instructions, instruction sets, and / or data recorded on a non-transitory computer-readable storage medium. Firmware may be embodied as code, instructions, or instruction sets, and / or data hard-coded (e.g., non-volatile) within a memory device.

[0091] As used in any aspect of this specification, the terms "component," "system," "module," and the like may refer to a computer-related entity, which may be either hardware, a combination of hardware and software, software, or software in execution.

[0092] As used in any aspect of the present specification, an "algorithm" refers to a self-consistent sequence of steps leading to a desired result, where the "steps" refer to manipulations of physical quantities and / or logical states which may, but need not, take the form of electrical or magnetic signals capable of being stored, transferred, combined, compared, and otherwise manipulated. These signals are commonly referred to as bits, values, elements, symbols, characters, terms, numbers, or the like. These and similar terms may be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities and / or states.

Claims

1. 1. A security automation platform communicatively coupled to a tenant configured to deploy a tenant security platform, comprising: The security automation platform includes: A processor; a memory configured to store a security automation application including a content library, a variable store, an automation schema, and an application program interface (API) broker; When executed by the processor, the security automation application causes the processor to: Detecting variables associated with the tenant via the variable store; via the content library, associating the sensed variables with artifacts stored within the content library; generating automation for the tenant based on the artifacts via the automation schema, the automation including a security tool configured to continuously monitor APIs deployed by the tenant security platform; Sending the generated automation to the tenant security platform deployed by the tenant via the API broker of the security automation application; Security automation platform.

2. When executed by the processor, the security automation application further causes the processor to: Detecting, via the security tool, a security event associated with the API deployed by the tenant security platform; generating an alert related to the detected security event via the automation; causing, via the automation, the alert to be transmitted to the tenant security platform deployed by the tenant; The security automation platform of claim 1 .

3. the alert provides recommended actions to mitigate the detected security event. The security automation platform of claim 2 .

4. The detected security event is associated with a suspicious account; the recommended action includes removing network access associated with the suspicious account via the tenant security platform; The security automation platform of claim 3 .

5. the recommended action requires approval from an administrative account of the tenant before removing the network access of the suspect account. The security automation platform of claim 4.

6. the artifacts include at least one of a detection, a workbook, an alert rule, a playbook, or a combination thereof; The security automation platform of claim 1 .

7. the security automation application is configured to automatically update the artifact for future use based on the sensed variables associated with the tenant; The security automation platform of claim 6.

8. the tenant is one of a plurality of tenants; the tenant security platform is one of a plurality of tenant security platforms deployed by the plurality of tenants; the security automation platform is further configured to simultaneously manage each tenant security platform deployed by the plurality of tenants. The security automation platform of claim 1 .

9. The security automation application further includes a graphical user interface configured to accept user input; the user input includes instructions related to management of the tenant security platform deployed by the tenant; The security automation platform of claim 1 .

10. 1. A method for enhancing network security via a security orchestration, automation, and response (SOAR) management server communicatively connected to a tenant configured to deploy a SOAR platform, the method comprising: The SOAR management server includes: A processor; a memory configured to store a SOAR management application including a content library, a variable store, an automation schema, and an application program interface (API) broker; The method comprises: Detecting variables associated with the tenant via the variable store; via the content library, associating the sensed variables with artifacts stored within the content library; generating automation for the tenant based on the artifacts via the automation schema, the automation including a security tool configured to continuously monitor APIs deployed by the SOAR platform; and sending the generated automation to the SOAR platform deployed by the tenant via the API broker of the SOAR management application. method.

11. Detecting, via the security tool, a security event associated with the API deployed by the SOAR platform; generating, via the automation, an alert related to the detected security event; and sending, via the automation, the alert to the SOAR platform deployed by the tenant, the alert providing a recommended action to mitigate the detected security event. The method of claim 10.

12. The detected security event is associated with a suspicious account; the recommended action includes removing network access associated with the suspicious account via the SOAR platform; The method of claim 11.

13. and automatically updating the artifacts for future use via the content library based on the sensed variables associated with the tenant. The method of claim 12.

14. A system for enhancing network security by remotely managing a security orchestration, automation, and response (SOAR) platform, comprising: The system comprises: A tenant configured to deploy the SOAR platform; a SOAR management server communicatively connected to the tenant; The SOAR management server includes: A processor; a memory configured to store a SOAR management application including a content library, a variable store, an automation schema, and an application program interface (API) broker; When executed by the processor, the SOAR management application causes the processor to: Detecting variables associated with the tenant via the variable store; via the content library, associating the sensed variables with artifacts stored within the content library; generating automation for the tenant based on the artifacts via the automation schema, the automation including a security tool configured to continuously monitor APIs deployed by the SOAR platform; Sending the generated automation to the SOAR platform deployed by the tenant via the API broker of the SOAR management application; system.

15. When executed by the processor, the security automation application further causes the processor to: detecting, via the security tool, a security platform deployed by the tenant that detects a security event related to the deployed API; generating an alert related to the detected security event via the automation; causing, via the automation, the alert to be transmitted to the tenant security platform deployed by the tenant; The system of claim 14.

16. the alert provides recommended actions to mitigate the detected security event. The system of claim 15.

17. The detected security event is associated with a suspicious account; the recommended action includes removing network access associated with the suspicious account via the tenant security platform; 17. The system of claim 16.

18. the recommended action requires approval from an administrative account of the tenant before removing the network access of the suspect account.

20. The system of claim 17.

19. the artifacts include at least one of a detection, a workbook, an alert rule, a playbook, or a combination thereof; The system of claim 14.

20. The security automation application, when executed by the processor, further causes the processor to automatically update the artifacts for future use based on the sensed variables associated with the tenant. The system of claim 6.

Images