Incident Query Retrieval Using Historical Investigation Similarity

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods for investigating cyber incidents are inefficient and resource-intensive due to reliance on manual review of prior investigations, limiting the discoverability and scalability of useful tools and techniques.

Innovation Solution

A system and method for extracting and indexing historical query inputs and metadata from past incident investigations, enabling rapid retrieval of relevant tools and information through a graphical user interface based on similarity to user-input search strings.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Loss of information

If manual review of prior incident investigations is used, then investigators can access historical data, but the process is inefficient and resource-intensive

Engineering Contradiction:

Improveaccess to historical investigation dataVSAvoidinvestigation efficiency

Core Design Contradiction:

Loss of informationVSProductivity

Solution Approach 1:

The patent replaces the manual mechanical review process with an automated computer-based system that uses natural language processing and machine learning algorithms to automatically analyze historical incident investigations, extract relevant information, and present findings to investigators, thereby eliminating manual labor while preserving access to historical data

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The patent introduces an automated processing system as an intermediary between historical investigation data and investigators. This intermediary automatically processes, indexes, and retrieves relevant historical information based on current incident parameters, serving as a bridge that eliminates the need for manual review while maintaining information accessibility

Inventive Principle:

Principle #24Intermediary (Mediator)

2Loss of information

If manual review methods are used, then investigators can examine historical cases, but scalability is limited

Engineering Contradiction:

Improvediscoverability of tools and techniquesVSAvoidscalability of investigation methods

Core Design Contradiction:

Loss of informationVSAdaptability or versatility

Solution Approach 1:

The patent transforms the investigation system from a manual process to an automated one by changing key parameters including processing speed, data volume capacity, and retrieval accuracy. The automated system can process exponentially more historical data and serve multiple investigators simultaneously, enabling scalability while improving discoverability of investigation tools and techniques

Inventive Principle:

Principle #35Parameter changes

Solution Approach 2:

The patent creates a universal automated system that can serve multiple investigators across different incidents simultaneously. The system processes various types of incident data using the same automated algorithms, making the investigation methodology scalable and adaptable to different cases without requiring manual intervention for each incident

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Quantity of substance

If comprehensive historical data is stored, then more investigation tools are available, but retrieval time increases

Engineering Contradiction:

Improvevolume of historical query inputsVSAvoidtime to access relevant tools

Core Design Contradiction:

Quantity of substanceVSLoss of time

Solution Approach 1:

The patent applies preliminary action by automatically indexing, tagging, and organizing historical query inputs and metadata before they are needed for retrieval. The system pre-processes and structures the data using natural language processing and machine learning, so when investigators need information, it can be rapidly retrieved based on semantic similarity rather than requiring time-consuming manual search through large volumes of unprocessed data

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS12568103B2Systems and methods for querying incident investigations

Publication Date: 2026.03.03 ATLASSIAN PTY LTD

AI summary

Systems and methods provide techniques for improving incident investigation efficiency. In various embodiments, a method includes obtaining historical query inputs associated with historical incident investigations; generating an incident investigation dataset based on the historical query inputs and respective metadata associated with the historical incident investigations; receiving, from a computing device via an application programming interface (API), a query search string; generating a response based on the query search string and the incident investigation dataset, the request response comprising a historical query input and a digital reference to the metadata for a respective historical incident investigation associated with the historical query input, wherein metadata or historical query input are within a threshold similarity to the query search string; and provisioning the response to the computing device via the API, wherein the request response causes the computing device to render a graphical user interface comprising the historical query input and digital reference.