Artificial intelligence assisted rule generation

A method comprising:

• inputting, by one or more processors, a plurality of client profiles to an artificial intelligence (AI) system, wherein the plurality of client profiles are based on an analysis of respective client environments comprising client assets and an intrusion detection alert history of a plurality of clients;
• matching, by the one or more processors, a new client profile for a new client to a respective client profile from the plurality of client profiles, wherein the respective client profile is for a particular client from the plurality of clients;
• building, by the one or more processors, a new rule for the new client based on a rule used by the particular client;
• receiving, by the one or more processors, information indicating that a violation of the new rule has occurred;
• and
• in response to the new rule being violated, executing, by the one or more processors, a security feature of a computer system of the new client in order to resolve the violation of the new rule.

A method comprising:

• inputting, by one or more processors, a plurality of client profiles to an artificial intelligence (AI) system, wherein the plurality of client profiles are based on an analysis of respective client environments comprising client assets and an intrusion detection alert history of a plurality of clients;
• matching, by the one or more processors, a new client profile for a new client to a respective client profile from the plurality of client profiles, wherein the respective client profile is for a particular client from the plurality of clients;
• assigning, by the one or more processors, a particular rule from the particular client to the new client based on the new client profile matching the respective client profile;
• receiving, by the one or more processors, information indicating that a violation of the particular rule has occurred;
• and
• in response to the particular rule being violated, executing, by the one or more processors, a security feature of a computer system of the new client in order to resolve the violation of the particular rule.

A computer program product comprising a non-transitory computer readable storage medium having program code embodied therewith, wherein the program code is readable and executable by a processor to perform a method comprising:

• inputting a plurality of client profiles to an artificial intelligence (AI) system, wherein the plurality of client profiles are based on an analysis of respective client environments comprising client assets and an intrusion detection alert history of a plurality of clients;
• matching a new client profile for a new client to a respective client profile from the plurality of client profiles, wherein the respective client profile is for a particular client from the plurality of clients;
• building a new set of rules for the new client based on a similarity measure of the new client profile to the respective client profile;
• receiving information indicating that a violation of the new set of rules has occurred;
• and
• in response to the new set of rules being violated, executing a security feature of a computer system of the new client in order to resolve the violation of the new set of rules.

A computer system comprising:

• one or more processors;
• one or more computer readable memories;
• and
• one or more computer readable non-transitory storage mediums having program instructions stored thereon for execution by at least one of the one or more processors via at least one of the one or more computer readable memories, the stored program instructions executed on said at least one of the one or more processors to perform a method comprising:
• inputting a plurality of client profiles to an artificial intelligence (AI) system, wherein the plurality of client profiles are based on an analysis of respective client environments comprising client assets and an intrusion detection alert history of a plurality of clients;
• matching a new client profile for a new client to a respective client profile from the plurality of client profiles, wherein the respective client profile is for a particular client from the plurality of clients;
• building a new set of rules for the new client based on a similarity measure of the new client profile to the respective client profile;
• receiving information indicating that a violation of the new set of rules has occurred;
• and
• in response to the new set of rules being violated, executing a security feature of a computer system of the new client in order to resolve the violation of the new set of rules.