Threat Mitigation Reporting With AI Security Event Summarization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Threat mitigation systems face complexity in handling diverse security-relevant subsystems, requiring unique queries for each, which is inefficient and cumbersome.
Innovation Solution
A Generative AI Model is utilized to process computer-readable language portions of security event notifications, summarizing them into human-readable reports, with feedback loops for script refinement.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a unique query is formulated for each security-relevant subsystem, then information can be obtained from each subsystem, but the operation becomes inefficient and cumbersome
Solution Approach 1:
The patent implements a universal query language that can interface with multiple different security-relevant subsystems (SIEM, SOAR, EDR, firewall, intrusion detection systems) using a single standardized query syntax. This allows one query mechanism to serve multiple subsystems, eliminating the need to learn and formulate separate queries for each system while maintaining comprehensive information gathering capabilities
2Reliability
If multiple security-relevant subsystems are utilized, then comprehensive security information is gathered, but the system complexity increases
Solution Approach 1:
The universal query language serves as a standardized interface layer that can communicate with multiple diverse security subsystems simultaneously. This single interface handles queries across SIEM, SOAR, EDR, firewall, and intrusion detection systems, reducing the operational complexity despite maintaining comprehensive multi-subsystem coverage
Solution Approach 2:
The universal query language acts as an intermediary layer between the user and multiple security subsystems. Instead of users directly interacting with each complex subsystem, the universal query language mediates by translating high-level security queries into subsystem-specific formats, simplifying the integration complexity
Data Source
AI summary
A computer-implemented method, computer program product and computing system for defining a formatting script for use with a Generative AI Model; receiving a notification of a security event, wherein the notification includes a computer-readable language portion that defines one or more specifics of the security event; and processing at least a portion of the computer-readable language portion of the notification using the Generative AI Model and the formatting script to summarize the computer-readable language portion and generate a summarized human-readable report.