Threat Mitigation Reporting for Multi-Subsystem Security Events
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Threat mitigation systems face complexity in handling diverse security-relevant subsystems, requiring unique queries for information retrieval, which is inefficient and cumbersome.
Innovation Solution
A computer-implemented method using a generative AI model and formatting script to process initial security event notifications, generating a summarized human-readable report, and deploying agents to monitor computing platforms for proactive threat detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If unique queries are formulated for each security-relevant subsystem to retrieve information, then information can be obtained from diverse subsystems, but the operation becomes inefficient and cumbersome
Solution Approach 1:
The patent implements a universal query language that enables a single standardized interface to query multiple different security-relevant subsystems (SIEM, EDR, firewall, etc.). Instead of requiring separate unique queries for each subsystem type, the universal query language provides multi-functional capability to retrieve information from diverse subsystems using a common query structure, thereby improving ease of operation while maintaining adaptability across different subsystems
2Reliability
If comprehensive security monitoring is implemented across multiple subsystems, then threat detection capability is improved, but system complexity increases
Solution Approach 1:
The patent introduces a threat mitigation system as an intermediary layer between security analysts and multiple security-relevant subsystems. This intermediary automatically queries subsystems using the universal query language, processes responses, and generates consolidated reports. The intermediary handles the complexity of interacting with multiple subsystems while providing simplified threat detection capabilities to users, thereby improving reliability without exposing the full system complexity
3Loss of information
If detailed information is retrieved from all security subsystems, then complete security analysis is achieved, but information processing time increases
Solution Approach 1:
The patent extracts and prioritizes only the most relevant security information from comprehensive subsystem data using the universal query language. Instead of retrieving and processing all available information from security subsystems, the system selectively extracts critical threat-related data points that are essential for security analysis. This extraction approach maintains information completeness for threat detection while significantly reducing processing time by eliminating unnecessary data
Data Source
AI summary
A computer-implemented method, computer program product and computing system for deploying an agent to proactively monitor activity within a computing platform and generate an initial notification if a security event is detected; receiving the initial notification of the security event from the agent, wherein the initial notification includes a computer-readable language portion that defines one or more specifics of the security event; and iteratively processing the initial notification using a generative AI model and a formatting script to produce a summarized human-readable report for the initial notification.