# US 10,484,404 B2 · Alerting and tagging using a malware analysis platform for threat intelligence made actionable > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,484,404 B2 - Document ID: US10484404B2 - Status: Granted - Kind: B2 - Application number: 16/403,368 - Filed: 2019-05-03 - Published: 2019-08-29 - Granted: 2019-11-19 - Earliest claimed: 2016-02-29 - Assignees: Palo Alto Networks, Inc. - Applicants: Palo Alto Networks, Inc. - Inventors: Farshad Rostamabadi; Shadi Rostami-Hesarsorkh; Sudarshan Vasudevan; Bilal Malik - Web page: https://patentgrep.com/patent/US10484404B2 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 21/562: {Static detection} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Techniques for alerting and tagging using a malware analysis platform for threat intelligence made actionable are disclosed. In some embodiments, a system, process, and/or computer program product for alerting and tagging using a malware analysis platform for threat intelligence made actionable includes receiving a plurality of samples for performing automated malware analysis to generate log files based on the automated malware analysis; processing the log files to extract artifacts associated with the log files; determining whether a tag matches any of the plurality of samples based on the artifacts; and performing an action based on whether the tag matches any of the plurality of samples. ## Claims ### Claim 1 A computer-implemented method, comprising: receiving a plurality of samples for performing automated malware analysis to generate log files based on the automated malware analysis, wherein a log file for a sample comprises one or more lines based on results of the automated malware analysis for the sample; processing the log files to extract artifacts associated with the log files; receiving a configuration to enable an alert action based on a tag type for matching any of the plurality of samples, wherein the tag type is configured for the alert action for a tag based on a search criteria for one or more artifacts, and wherein the alert action is configured to match private samples and public samples; determining whether the tag matches any of the plurality of samples based on the search criteria for one or more artifacts; and performing an action based on whether the tag matches any of the plurality of samples including to trigger the alert action based on a determination that the tag matches a sample detected on a first monitored enterprise network, wherein the sample detected on the first monitored enterprise network is a public sample and the first monitored enterprise network is associated with another subscriber's enterprise network. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, further comprising: performing a search to identify one or more samples that match the search criteria for one or more artifacts. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, further comprising: receiving a configuration for a tag class to associate the tag with a known actor, targeted campaign, malware family, malicious behavior, or an exploit. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the tag is a private tag that is visible only to users associated with a subscriber for the first monitored enterprise network. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein an extracted artifact is a high-risk artifact, and wherein the high-risk artifact is determined to be associated with malware based on the automated malware analysis. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein performing automated malware analysis includes performing a dynamic analysis and/or a static analysis. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, further comprising: generating another alert based on a determination that the tag matches a sample detected on a second monitored enterprise network, wherein the sample detected on the second monitored enterprise network is a private sample and the second monitored enterprise network is associated with the subscriber's enterprise network. ### Claim 8 A system, comprising: a processor configured to: receive a plurality of samples for performing automated malware analysis to generate log files based on the automated malware analysis, wherein a log file for a sample comprises one or more lines based on results of the automated malware analysis for the sample; process the log files to extract artifacts associated with the log files; receive a configuration to enable an alert action based on a tag type for matching any of the plurality of samples, wherein the tag type is configured for the alert action for a tag based on a search criteria for one or more artifacts, and wherein the alert action is configured to match private samples and public samples; determine whether the tag matches any of the plurality of samples based on the search criteria for one or more artifacts; and perform an action based on whether the tag matches any of the plurality of samples including to trigger the alert action based on a determination that the tag matches a sample detected on a first monitored enterprise network, wherein the sample detected on the first monitored enterprise network is a public sample and the first monitored enterprise network is associated with another subscriber's enterprise network; and a memory coupled to the processor and configured to provide the processor with instructions. ### Claim 9 (depends on 8) The system recited in claim 8, wherein the processor is further configured to: perform a search to identify one or more samples that match the search criteria for one or more artifacts. ### Claim 10 (depends on 8) The system recited in claim 8, wherein the processor is further configured to: receive a configuration for a tag class to associate the tag with a known actor, targeted campaign, malware family, malicious behavior, or an exploit. ### Claim 11 (depends on 8) The system recited in claim 8, wherein the tag is a private tag that is visible only to users associated with a subscriber for the first monitored enterprise network. ### Claim 12 (depends on 8) The system recited in claim 8, wherein an extracted artifact is a high-risk artifact, and wherein the high-risk artifact is determined to be associated with malware based on the automated malware analysis. ### Claim 13 (depends on 8) The system recited in claim 8, wherein performing automated malware analysis includes performing a dynamic analysis and/or a static analysis. ### Claim 14 (depends on 8) The system recited in claim 8, wherein the processor is further configured to: generate another alert based on determining that the tag matches a sample detected on a second monitored enterprise network, wherein the sample detected on the second monitored enterprise network is a private sample and the second monitored enterprise network is associated with the subscriber's enterprise network. ### Claim 15 A computer program product, the computer program product being embodied in a non-transitory tangible computer readable storage medium and comprising computer instructions for: receiving a plurality of samples for performing automated malware analysis to generate log files based on the automated malware analysis, wherein a log file for a sample comprises one or more lines based on results of the automated malware analysis for the sample; processing the log files to extract artifacts associated with the log files; receiving a configuration to enable an alert action based on a tag type for matching any of the plurality of samples, wherein the tag type is configured for the alert action for a tag based on a search criteria for one or more artifacts, and wherein the alert action is configured to match private samples and public samples; determining whether the tag matches any of the plurality of samples based on the search criteria for one or more artifacts; and performing an action based on whether the tag matches any of the plurality of samples including to trigger the alert action based on a determination that the tag matches a sample detected on a first monitored enterprise network, wherein the sample detected on the first monitored enterprise network is a public sample and the first monitored enterprise network is associated with another subscriber's enterprise network. ### Claim 16 (depends on 15) The computer program product recited in claim 15, and further comprising computer instructions for: performing a search to identify one or more samples that match the search criteria for one or more artifacts. ### Claim 17 (depends on 15) The computer program product recited in claim 15, and further comprising computer instructions for: receiving a configuration for a tag class to associate the tag with a known actor, targeted campaign, malware family, malicious behavior, or an exploit. ### Claim 18 (depends on 15) The computer program product recited in claim 15, wherein the tag is a private tag that is visible only to users associated with a subscriber for the first monitored enterprise network. ### Claim 19 (depends on 15) The computer program product recited in claim 15, wherein the artifact is a high-risk artifact, and wherein the high-risk artifact is determined to be associated with malware based on the automated malware analysis. ### Claim 20 (depends on 15) The computer program product recited in claim 15, and further comprising computer instructions for: generating another alert based on a determination that the tag matches a sample detected on a second monitored enterprise network, wherein the sample detected on the second monitored enterprise network is a private sample and the second monitored enterprise network is associated with the subscriber's enterprise network.