Security Incident Clustering for Automated Investigation Steps
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security incident investigations by human analysts are labor-intensive and require building context from scratch for each event, making it difficult and time-consuming.
Innovation Solution
A computing device employs an incident clustering engine to group security incidents and runbooks into clusters based on investigation similarity, using a large language model to determine summaries and criteria, and a retrieval augmented generation pipeline to suggest investigation steps, with human approval and reinforcement learning for improvement.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If human analysts manually investigate each security incident from scratch, then investigation accuracy can be maintained through domain knowledge, but investigation time and labor intensity increase significantly
Solution Approach 1:
The system performs preliminary actions by pre-clustering security incidents and pre-generating investigation steps for each cluster before actual incidents occur. When a new incident is detected, the system quickly retrieves and presents pre-prepared investigation steps tailored to the incident's cluster, eliminating the need to build context from scratch while maintaining accuracy through domain-expert-curated procedures.
Solution Approach 2:
The system creates and maintains a library of standardized investigation step templates for different incident clusters. These templates represent proven investigation procedures that can be copied and adapted to similar incidents, allowing analysts to leverage established methodologies rather than reinventing investigation approaches for each new incident.
2Reliability
If each security incident is handled as a singular event requiring full context building, then investigation thoroughness is maintained, but scalability of the investigation process deteriorates
Solution Approach 1:
The system segments the investigation process into cluster-specific standardized steps and incident-specific customization opportunities. By dividing incidents into clusters with shared characteristics, the system can apply standardized investigation procedures to common incident types while retaining the ability to adapt to unique aspects of individual incidents, thereby improving scalability without sacrificing thoroughness.
Solution Approach 2:
The system creates universal investigation step templates that can serve multiple incident types within a cluster. These multi-functional templates are designed to handle various scenarios through parameterization and conditional logic, allowing a single set of investigation steps to address multiple similar incidents efficiently while maintaining comprehensive coverage.
3Productivity
If automated systems are introduced to reduce manual effort, then investigation speed improves, but system complexity increases
Solution Approach 1:
The system introduces an intermediary layer consisting of pre-defined cluster definitions and investigation step templates that mediate between automated incident detection and analyst decision-making. This intermediary structure organizes complex automation logic into manageable, reusable components, making the system easier to maintain and extend while delivering automated speed benefits.
Solution Approach 2:
The system manages complexity by parameterizing investigation steps rather than hard-coding complex decision logic. Investigation templates use parameters and variables that can be dynamically adjusted based on incident attributes, allowing the system to handle diverse incidents through configurable parameters rather than requiring complex proprietary algorithms for each scenario.
Data Source
AI summary
Technologies for automated security incident analysis include a computing device that clusters security incidents and runbooks into multiple clusters based on investigation similarity. For each cluster, the computing device determines a summary of all security incidents in the cluster with a large language model, determines criteria for inclusion of a security incident in the cluster, and determines a suggested investigation step with a retrieval augmented generation pipeline. The suggested investigation step includes a natural language description and a programmatic query. Upon receiving approval from a user, the computing device stores the cluster information in a curated query repository. The computing device may receive a security incident for investigation, assign the security incident to a cluster based on the stored criteria, and retrieve a suggested investigation step from the curated query repository. The computing device may provide the suggested investigation step to a user. Other embodiments are described and claimed.