Cybersecurity incident response and security operation system employing playbook generation through custom machine learning

A system comprising:

• a memory comprising instructions;
• and
• one or more computer processors, wherein the instructions, when executed by the one or more computer processors, cause the system to perform operations comprising:
• encoding values associated with features of a plurality of cybersecurity incidents to obtain a feature vector for each cybersecurity incident, each cybersecurity incident having an associated playbook from a plurality of playbooks for responding to the cybersecurity incident;
• receiving details for a new cybersecurity incident;
• obtaining a new feature vector for the new cybersecurity incident;
• selecting at least one from the plurality of cybersecurity incidents based on the new feature vector, wherein selecting the at least one from the plurality of cybersecurity incidents comprises:
• calculating a distance from the new feature vector to each feature vector from the plurality of cybersecurity incidents;
• and
• selecting one or more cybersecurity incidents that are within a predetermined distance from the new feature vector;
• determining a score for at least one action from the selected cybersecurity incidents;
• selecting one or more actions based on the score of each action;
• creating a custom playbook for the new cybersecurity incident that includes the selected one or more actions;
• and
• causing presentation on a display of the custom playbook for responding to the new cybersecurity incident.

A non-transitory machine-readable storage medium including instructions that, when executed by a machine, cause the machine to perform operations comprising:

• encoding values associated with features of a plurality of cybersecurity incidents to obtain a feature vector for each cybersecurity incident, each cybersecurity incident having an associated playbook from a plurality of playbooks for responding to the cybersecurity incident;
• receiving details for a new cybersecurity incident;
• obtaining a new feature vector for the new cybersecurity incident;
• selecting at least one from the plurality of cybersecurity incidents based on the new feature vector, wherein selecting the at least one from the plurality of cybersecurity incidents comprises:
• calculating a distance from the new feature vector to each feature vector from the plurality of cybersecurity incidents;
• and
• selecting one or more cybersecurity incidents that are within a predetermined distance from the new feature vector;
• determining a score for at least one action from the selected cybersecurity incidents;
• selecting one or more actions based on the score of each action;
• creating a custom playbook for the new cybersecurity incident that includes the selected one or more actions;
• and
• causing presentation on a display of the custom playbook for responding to the new cybersecurity incident.