Browser extension for cybersecurity threat intelligence and response

A method for implementing a browser extension for cyber threat intelligence and response, the method comprising:

• scanning, in a sandbox of a browser by a browser extension, at least part of a web page to produce a set of items of interests;
• transmitting, by the browser extension, the set of items of interests to a cloud-based enrichment and analysis of cybersecurity threat intelligence system to request information on the set of items;
• receiving, in the browser extension, a response from the cloud-based enrichment and analysis of cybersecurity threat intelligence system, the response including a scan result based on the transmitted set of items of interests, and the scan result including at least one indicator of compromise of the at least scanned part of the web page;
• displaying, by the browser extension, a plurality of orchestrated responses to be performed on the at least one indicator of compromise;
• receiving, in the browser extension, a selection of a plurality of particular orchestrated responses of the plurality of orchestrated responses;
• transmitting, with the browser extension, the selected plurality of particular orchestrated responses to be performed on a selected at least one particular indicator of compromise to the cloud-based enrichment and analysis of cybersecurity threat intelligence system;
• and
• receiving, from the cloud-based enrichment and analysis of cybersecurity threat intelligence system, a response including a result of each of the selected plurality of particular orchestrated responses.

A non-transitory memory for implementing a browser extension for cyber threat intelligence and response, the non-transitory memory storing instructions to cause a system to perform operations comprising:

• scanning, in a sandbox of a browser by a browser extension, at least part of a web page to produce a set of items of interests;
• transmitting, by the browser extension, the set of items of interests to a cloud-based enrichment and analysis of cybersecurity threat intelligence system to request information on the set of items;
• receiving, in the browser extension, a response from the cloud-based enrichment and analysis of cybersecurity threat intelligence system, the response including a scan result based on the transmitted set of items of interests, and the scan result including at least one indicator of compromise of the at least scanned part of the web page;
• displaying, by the browser extension, a plurality of orchestrated responses to be performed on the at least one indicator of compromise;
• receiving, in the browser extension, a selection of a plurality of particular orchestrated responses of the plurality of orchestrated responses;
• transmitting, with the browser extension, the selected plurality of particular orchestrated responses to be performed on a selected at least one particular indicator of compromise to the cloud-based enrichment and analysis of cybersecurity threat intelligence system;
• and
• receiving, from the cloud-based enrichment and analysis of cybersecurity threat intelligence system, a response including a result of each of the selected plurality of particular orchestrated responses.