Cybersecurity typing and inferencing

A computer system that generates a cybersecurity sensor configuration for configuring a cybersecurity agent to detect a cyber threat, comprising:

• a central processing unit;
• and
• a memory device storing instructions that, when executed by the central processing unit, perform operations, the operations comprising:
• receiving a cybersecurity event request referencing a user's input to a cybersecurity event template specifying a rule for detecting the cyber threat, wherein the user's inputs comprise high-level descriptions of the cyber threat that lack configuration details required to configure the cybersecurity agent;
• determining that the user's input to the cybersecurity event template conforms to a cybersecurity event ontology having database entries that associate the cybersecurity event template to operating system events;
• in response to the determining that the user's input to the cybersecurity event template conforms to the cybersecurity event ontology, generating the cybersecurity sensor configuration for configuring the cybersecurity agent to detect the operating system events;
• and
• instructing the cybersecurity agent to detect the cyber threat by installing the cybersecurity sensor configuration that monitors a host operating system for the operating system events.

A non-transitory computer medium memory device storing instructions that, when executed by a central processing unit, perform operations that generate a cybersecurity sensor configuration, the operations comprising:

• receiving a cybersecurity event request referencing a user's input to a cybersecurity event template describing a cybersecurity threat, wherein the user's input comprises high-level descriptions of the cybersecurity threat that lack configuration details required to configure a cybersecurity agent:
• determining a common type associated with the cybersecurity event request based on a cybersecurity event ontology;
• determining malicious operating system events associated with the cybersecurity threat by querying the cybersecurity event ontology having a database entry that associates the user's input to the malicious operating system events associated with the cybersecurity threat;
• gap filling a cybersecurity configuration parameter unspecified by the cybersecurity event request based on the malicious operating system events determined by the querying of the cybersecurity event ontology;
• generating the cybersecurity sensor configuration that configures the cybersecurity agent to detect the cybersecurity threat described by the user's input by using the cybersecurity configuration parameter and the malicious operating system events;
• and
• instructing the cybersecurity agent to detect the cybersecurity threat described by the user's input by monitoring a host operating system for the malicious operating system events.