Serverless FaaS Pipeline for Automated Security Event Remediation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security monitoring systems face challenges in automating the process of triaging and remediation of security events in large enterprises due to complexity and lack of efficient tools, particularly in redirecting alerts across organizational layers and integrating diverse data perspectives.
Innovation Solution
A serverless architecture using function-as-a-service (FaaS) pipelines with multiple layers (input, enrich, route, and action layers) that processes security events in real-time, enabling automated remediation actions by enriching context, creating events, and executing commands without the need for dedicated servers, allowing non-developers to maintain security systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual triaging and remediation processes are used in large enterprises, then security events can be monitored and acted upon, but the process complexity increases substantially requiring multiple organizational layers and manual resource allocation
Solution Approach 1:
The patent segments the security event processing into distinct functional layers: trigger layer (event generation), input layer (data reception), enrich layer (context addition), route layer (alert distribution), and action layer (remediation execution). This segmentation automates what was previously manual multi-layer organizational processing, reducing process complexity while maintaining reliability.
Solution Approach 2:
The patent introduces an intermediary serverless architecture that acts as a mediator between security events and remediation actions. This intermediary automatically enriches events with context, routes alerts to appropriate teams, and executes remediation actions, eliminating the need for manual intervention across multiple organizational layers.
2Loss of information
If security events are enriched with additional data from multiple sources, then the context and relevance of security events improve, but the complexity of integrating diverse data perspectives increases
Solution Approach 1:
The enrich layer function serves multiple purposes: it receives trigger data, adds contextual information from various sources, creates enriched events, and passes them to the route layer. This multi-functional approach consolidates data integration complexity into a single automated component that handles diverse data perspectives universally.
Solution Approach 2:
The enrich layer automatically enriches security events with contextual data from multiple sources without requiring manual configuration or intervention. The system self-services by autonomously integrating diverse data perspectives and making the enriched events available to subsequent layers.
3Productivity
If automated remediation actions are implemented, then the speed and efficiency of responding to security events improve, but the complexity of automating multi-layer organizational processes increases
Solution Approach 1:
The patent implements dynamic automation where the route layer function automatically determines which teams receive alerts based on event characteristics, and the action layer function dynamically executes appropriate remediation actions. This dynamic behavior provides fast automated response while the serverless architecture manages the complexity of automation logic.
Solution Approach 2:
The patent incorporates feedback mechanisms where security events trigger automated responses, and the system learns from event outcomes. The feedback loop enables continuous improvement of remediation actions while the serverless infrastructure handles the complexity of automating organizational processes.
4Device complexity
If serverless architecture is used to automate security processes, then the infrastructure complexity is reduced and scalability improves, but the requirement for sophisticated function-as-a-service pipelines increases
Solution Approach 1:
The patent extracts infrastructure management from the security processing logic by using serverless architecture. The infrastructure complexity is taken out and managed by the cloud provider, while the focus shifts to configuring function-as-a-service pipelines that handle security event processing, enrichment, routing, and remediation.
Data Source
AI summary
Systems and methods involve an input layer function of a function-as-a-service (FaaS) pipeline that receives trigger data from a trigger layer function of one or more processors of enterprise processing systems, calls one or more processors of an enrich layer function of the FaaS pipeline that adds enriching context to the trigger data, and creates an event based at least in part on the enriched trigger data. A route layer function of the FaaS pipeline invoked by the input layer function creates an action based on the event created by the input layer function. An action layer function of the FaaS pipeline invoked by the route layer function creates a command based on the action created by the route layer function, and the action layer function sends a remediation action to a command layer function of the enterprise processor based on the action created by the route layer function.