Actionability determination for suspicious network events

A non-transitory computer-readable medium having program instructions stored thereon that are capable of causing a computer system to implement operations comprising:

• evaluating a network event that involves a host computer system and occurs within a computer network, including:
• accessing a set of data corresponding to the network event, wherein the set of data includes captured attributes of the network event;
• accessing a suspiciousness score that indicates a likelihood that the network event is suspicious and an actionability score that indicates whether there is sufficient data to take action to remediate the network event, independent of the suspiciousness score for the network event, wherein the actionability is based on an extent to which a particular group of attributes are missing from the set of data for the network event;
• determining a first number of a particular group of attributes that are missing from the set of data;
• adjusting at least the actionability score based on the first number;
• and
• repeating the evaluating to adjust actionability scores for other network events of a group of network events within the computer network;
• and
• prioritizing network events within the group of network events for security review based at least on respective adjusted actionability scores for those network events.

A method, comprising:

• accessing, by a computer system, an alert that specifies attributes of a network event that involves a host computer system and occurs within a computer network;
• scoring, by the computer system, the network event, including by:
• calculating, using the attributes specified in the alert, a security score for the network event, wherein the security score is indicative of a likelihood that the network event is suspicious;
• running a set of tests for the alert to generate an actionability score indicative of whether there is sufficient data to take action to remediate the network event, independent of the security score for the network event, wherein the set of tests include first tests indicative of whether the alert includes particular items of information usable to generate an incident report for the alert;
• and
• determining, based on the security score and the actionability score, a combined score for the network event;
• and
• repeating the scoring, by the computer system, to compute combined scores for other network events of a group of network events within the computer network;
• and
• prioritizing, by the computer system, network events within the group of network events for security review based on respective combined scores for those network events.