Cyber security sharing and identification system
AssigneePalantir Technologies Inc.
InventorsJacob Albertson, Melody Hildebrandt, Harkirat Singh, Shyam Sankar, Rick Ducott, Peter Maag, Marissa Kimball
Life of this patent
Estimating the term…
Abstract
Systems and techniques for sharing security data are described herein. Security rules and/or attack data may be automatically shared, investigated, enabled, and/or used by entities. A security rule may be enabled on different entities comprising different computing systems to combat similar security threats and/or attacks. Security rules and/or attack data may be modified to redact sensitive information and/or configured through access controls for sharing.
Claims20
A computer implemented method comprising:
- by a computer system comprising one or more computer hardware processors and one or more storage devices,
- receiving first security attack data from a first entity of a plurality of entities, the first security attack data comprising information regarding one or more first security attacks;
- and
- facilitating sharing of a ruleset from the first entity to a second entity,
- wherein the ruleset (i) is determined by the first entity, and (ii) is associated with the first security attack data,
- wherein the ruleset comprises instructions selectably applicable by the second entity to detect a potential security attack, and
- wherein the instructions are configured to:
- in response to detecting the potential security attack, add data associated with the potential security attack to a cluster as a seed, wherein the cluster comprises a plurality of connected objects and a representation of the cluster is displayable in a user interface.
Non-transitory computer storage medium comprising instructions for causing one or more computing devices to perform operations comprising:
- receiving first security attack data from a first entity of a plurality of entities, the first security attack data comprising information regarding one or more first security attacks;
- and
- transmitting at least a portion of a ruleset from the first entity to a second entity,
- wherein the ruleset (i) is determined by the first entity, and (ii) is associated with the first security attack data,
- wherein the ruleset comprises ruleset instructions selectably applicable by the second entity to detect a potential security attack, and
- wherein the ruleset instructions are configured to:
- in response to detecting the potential security attack, add data associated with the potential security attack to a cluster as a seed, wherein the cluster comprises a plurality of connected objects and a representation of the cluster is displayable in a user interface.
A system for sharing security information, the system comprising:
- a data storage medium;
- and
- one or more computer hardware processors in communication with the data storage medium, wherein the one or more computer hardware processors are configured to execute computer-executable instructions to at least:
- receive first security attack data from a first entity of a plurality of entities, the first security attack data comprising information regarding one or more first security attacks;
- and
- facilitate sharing of a ruleset from the first entity to a second entity,
- wherein the ruleset (i) is determined by the first entity, and (ii) is associated with the first security attack data,
- wherein the ruleset comprises instructions selectably applicable by the second recipient entity to detect a potential security attack, and
- wherein the instructions are configured to:
- in response to detecting the potential security attack, add data associated with the potential security attack to a cluster as a seed, wherein the cluster comprises a plurality of connected objects and a representation of the cluster is displayable in a user interface.
Dependencies are inferred from the claim text.