Security incident ranking and ranking explanation

An apparatus, comprising:

• a memory;
• and
• a processor configured:
• to store, in the memory, a set of protective actions,
• to detect, on a network, an incident comprising one or more alerts indicating malicious activity by one or more computing devices on the network,
• to extract, from the one or more alerts, a plurality of features indicating measurable characteristics of the incident, wherein the extracted features comprise at least one of:
• (i) whether a specific alert type is present in the incident, (ii) how many different alert types are present in the incident, and (iii) a number of times a given alert type or combination of alert types was detected in a specific previous time period,
• to compute, based on the one or more alerts, respective counts for the features for the detected incident,
• to compute, based on the features and their respective counts, a score indicating a magnitude of malicious activity for the detected incident,
• to identify a given feature having a highest impact on the score,
• to automatically select a protective action from the set of protective actions based on a tuple comprising the score, the identified feature having the highest impact, and its respective count, and
• to initiate the selected protective action with respect to at least some of the one or more computing devices.

A computer software product for protecting a computing device, which includes a processor and a memory and is coupled to a storage device storing a set of one or more files, the computer software product comprising a non-transitory computer-readable medium, in which program instructions are stored, which instructions, when read by a computer, cause the computer:

• to define a set of protective actions;
• to detect, on a network, an incident comprising one or more alerts indicating malicious activity by one or more computing devices on the network;
• to extract, from the one or more alerts, a plurality of features indicating measurable characteristics of the incident, wherein the extracted features comprise at least one of:
• (i) whether a specific alert type is present in the incident, (ii) how many different alert types are present in the incident, and (iii) a number of times a given alert type or combination of alert types was detected in a specific previous time period;
• to compute, based on the one or more alerts, respective counts for the features for the detected incident;
• to compute, based on the features and their respective counts, a score indicating a magnitude of malicious activity for the detected incident;
• to identify a given feature having a highest impact on the score;
• to automatically select a protective action from the set of protective actions based on a tuple comprising the score, the identified feature having the highest impact, and its respective count;
• and
• to initiate the selected protective action with respect to at least some of the one or more computing devices.