# US 12,223,047 B2 · Threat mitigation system and method > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,223,047 B2 - Document ID: US12223047B2 - Status: Granted - Kind: B2 - Application number: 18/130,182 - Filed: 2023-04-03 - Published: 2023-10-05 - Granted: 2025-02-11 - Earliest claimed: 2022-04-01 - Assignees: Reliaquest Holdings, LLC - Applicants: ReliaQuest Holdings, LLC - Inventors: Brian P. Murphy; Joe Partlow; Colin O'Connor; Jason Pfeiffer; Brian Philip Murphy - Web page: https://patentgrep.com/patent/US12223047B2 ## CPC - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A computer-implemented method, computer program product and computing system for defining a first query for a first security-relevant subsystem within a computing platform; processing the first query on the first security-relevant subsystem to generate a first data set concerning security events occurring on the first security-relevant subsystem; and receiving the first data set concerning the security events occurring on the first security-relevant subsystem. ## Claims ### Claim 1 A computer-implemented method, executed on a computing device, comprising: defining a first query for a first security-relevant subsystem within a computing platform, including defining a single search in a universal language, and translating the single search in the universal language into a plurality of technology-specific searches, including a first security-relevant subsystem specific search executable by the first security-relevant subsystem, including translating a syntax of the unified query into a syntax of each of the plurality of plurality of technology-specific searches; processing the first query on the first security-relevant subsystem to generate a first data set concerning security events occurring on the first security-relevant subsystem; and receiving the first data set concerning the security events occurring on the first security-relevant subsystem. ### Claim 2 (depends on 1) The computer-implemented method of claim 1 further comprising: identifying two or more associated detection events defined within the first data set; and grouping the two or more associated detection events to define a security incident. ### Claim 3 (depends on 2) The computer-implemented method of claim 2 wherein one or more artifacts/log entries are associated with each of the first data set. ### Claim 4 (depends on 3) The computer-implemented method of claim 3 wherein identifying two or more associated detection events defined within the first data set includes: identifying two or more detection events defined within the first data set that have common artifacts/log entries. ### Claim 5 (depends on 4) The computer-implemented method of claim 4 wherein grouping the two or more associated detection events to define a security incident includes: grouping the one or more artifacts/log entries associated with each of the two or more associated detection events to form an artifact/log entry set for the security incident. ### Claim 6 (depends on 1) The computer-implemented method of claim 1 further comprising: defining a second query for a second security-relevant subsystem within the computing platform; processing the second query on the second security-relevant subsystem to generate a second data set concerning security events occurring on the second security-relevant subsystem; and receiving the second data set concerning the security events occurring on the second security-relevant subsystem. ### Claim 7 (depends on 6) The computer-implemented method of claim 6 further comprising: identifying two or more associated detection events defined within the second data set; and grouping the two or more associated detection events to define a security incident. ### Claim 8 (depends on 7) The computer-implemented method of claim 7 wherein one or more artifacts/log entries are associated with each of the second data set. ### Claim 9 (depends on 8) The computer-implemented method of claim 8 wherein identifying two or more associated detection events defined within the second data set includes: identifying two or more detection events defined within the second data set that have common artifacts/log entries. ### Claim 10 (depends on 9) The computer-implemented method of claim 9 wherein grouping the two or more associated detection events to define a security incident includes: grouping the one or more artifacts/log entries associated with each of the two or more associated detection events to form an artifact/log entry set for the security incident. ### Claim 11 A computer program product residing on a non-transitory computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising: defining a first query for a first security-relevant subsystem within a computing platform, including defining a single search in a universal language, and translating the single search in the universal language into a plurality of technology-specific searches, including a first security-relevant subsystem specific search executable by the first security-relevant subsystem, including translating a syntax of the unified query into a syntax of each of the plurality of plurality of technology-specific searches; processing the first query on the first security-relevant subsystem to generate a first data set concerning security events occurring on the first security-relevant subsystem; and receiving the first data set concerning the security events occurring on the first security-relevant subsystem. ### Claim 12 (depends on 11) The computer program product of claim 11 further comprising: identifying two or more associated detection events defined within the first data set; and grouping the two or more associated detection events to define a security incident. ### Claim 13 (depends on 12) The computer program product of claim 12 wherein one or more artifacts/log entries are associated with each of the first data set. ### Claim 14 (depends on 13) The computer program product of claim 13 wherein identifying two or more associated detection events defined within the first data set includes: identifying two or more detection events defined within the first data set that have common artifacts/log entries. ### Claim 15 (depends on 14) The computer program product of claim 14 wherein grouping the two or more associated detection events to define a security incident includes: grouping the one or more artifacts/log entries associated with each of the two or more associated detection events to form an artifact/log entry set for the security incident. ### Claim 16 (depends on 11) The computer program product of claim 11 further comprising: defining a second query for a second security-relevant subsystem within the computing platform; processing the second query on the second security-relevant subsystem to generate a second data set concerning security events occurring on the second security-relevant subsystem; and receiving the second data set concerning the security events occurring on the second security-relevant subsystem. ### Claim 17 (depends on 16) The computer program product of claim 16 further comprising: identifying two or more associated detection events defined within the second data set; and grouping the two or more associated detection events to define a security incident. ### Claim 18 (depends on 17) The computer program product of claim 17 wherein one or more artifacts/log entries are associated with each of the second data set. ### Claim 19 (depends on 18) The computer program product of claim 18 wherein identifying two or more associated detection events defined within the second data set includes: identifying two or more detection events defined within the second data set that have common artifacts/log entries. ### Claim 20 (depends on 19) The computer program product of claim 19 wherein grouping the two or more associated detection events to define a security incident includes: grouping the one or more artifacts/log entries associated with each of the two or more associated detection events to form an artifact/log entry set for the security incident. ### Claim 21 A computing system including a processor and memory configured to perform operations comprising: defining a first query for a first security-relevant subsystem within a computing platform, including defining a single search in a universal language, and translating the single search in the universal language into a plurality of technology-specific searches, including a first security-relevant subsystem specific search executable by the first security-relevant subsystem, including translating a syntax of the unified query into a syntax of each of the plurality of plurality of technology-specific searches; processing the first query on the first security-relevant subsystem to generate a first data set concerning security events occurring on the first security-relevant subsystem; and receiving the first data set concerning the security events occurring on the first security-relevant subsystem. ### Claim 22 (depends on 21) The computing system of claim 21 further comprising: identifying two or more associated detection events defined within the first data set; and grouping the two or more associated detection events to define a security incident. ### Claim 23 (depends on 22) The computing system of claim 22 wherein one or more artifacts/log entries are associated with each of the first data set. ### Claim 24 (depends on 23) The computing system of claim 23 wherein identifying two or more associated detection events defined within the first data set includes: identifying two or more detection events defined within the first data set that have common artifacts/log entries. ### Claim 25 (depends on 24) The computing system of claim 24 wherein grouping the two or more associated detection events to define a security incident includes: grouping the one or more artifacts/log entries associated with each of the two or more associated detection events to form an artifact/log entry set for the security incident. ### Claim 26 (depends on 21) The computing system of claim 21 further comprising: defining a second query for a second security-relevant subsystem within the computing platform; processing the second query on the second security-relevant subsystem to generate a second data set concerning security events occurring on the second security-relevant subsystem; and receiving the second data set concerning the security events occurring on the second security-relevant subsystem. ### Claim 27 (depends on 26) The computing system of claim 26 further comprising: identifying two or more associated detection events defined within the second data set; and grouping the two or more associated detection events to define a security incident. ### Claim 28 (depends on 27) The computing system of claim 27 wherein one or more artifacts/log entries are associated with each of the second data set. ### Claim 29 (depends on 28) The computing system of claim 28 wherein identifying two or more associated detection events defined within the second data set includes: identifying two or more detection events defined within the second data set that have common artifacts/log entries. ### Claim 30 (depends on 29) The computing system of claim 29 wherein grouping the two or more associated detection events to define a security incident includes: grouping the one or more artifacts/log entries associated with each of the two or more associated detection events to form an artifact/log entry set for the security incident.