Back to results
US 12,756,739 B1Granted
Security alert prioritization using multidimensional threat detection data
AssigneeRapid7, Inc.
InventorJeffrey Bruins
Life of this patent
Estimating the term…
Abstract
Various embodiments include systems and methods pertaining to a security service platform that detects security threats based on results from multiple security systems. The multiple security systems may each generate and store respective security alerts within a priority object. The priority object may be used to define rules that are based on results from the multiple security systems, including determining groups of security alerts or determining whether a security alert is common or uncommon for a given compute environment. The security service platform may use the provide an alert that indicates a detected cyberattack.
Claims20
A method comprising:
- executing a network monitoring system implemented on one or more computer systems, wherein the execution includes:
- collecting first telemetry data from a first compute environment;
- determining, based on a first classifier using the first telemetry data associated with the first compute environment, first security alert data, wherein the first classifier is associated with the first compute environment;
- determining, based on a second classifier using the first telemetry data, second security alert data, wherein the second classifier is associated with a plurality of compute environments;
- determining first prioritization data associated with the first security alert data and second prioritization data associated with the second security alert data, wherein the first prioritization data includes a first detection rate associated with a first one or more detection rules that matches one or more characteristics of the first telemetry data, and the second prioritization data includes a global detection rate associated with a second one or more detection rules that matches one or more characteristics of the first telemetry data;
- determining third prioritization data based on a deviation between the first detection rate associated with the first one or more detection rules and the global detection rate associated with the second one or more detection rules;
- placing the first security alert data in an alert set, wherein the alert set is selected from among a plurality of alert sets based on the third prioritization data and displayed on a user interface;
- and
- in response to user input received via the user interface pertaining to the alert set, initiating one or more remediation operations with respect to the first security alert data.
6 more elements
A system comprising:
- a memory storing executable instructions;
- and
- one or more processors that execute the executable instructions to implement a network monitoring system and cause the network monitoring system to:
- collect first telemetry data from a first compute environment;
- determine, based on a first classifier using the first telemetry data associated with the first compute environment, first security alert data, wherein the first classifier is associated with the first compute environment;
- determine, based on a second classifier using the first telemetry data, second security alert data, wherein the second classifier is associated with a plurality of compute environments;
- determine first prioritization data associated with the first security alert data and second prioritization data associated with the second security alert data, wherein the first prioritization data includes a first detection rate associated with a first one or more detection rules that matches one or more characteristics of the first telemetry data, and the second prioritization data includes a global detection rate associated with a second one or more detection rules that matches one or more characteristics of the first telemetry data;
- determine third prioritization data based on a deviation between the first detection rate associated with the first one or more detection rules and the global detection rate associated with the second one or more detection rules;
- place the first security alert data in an alert set, wherein the alert set is selected from among a plurality of alert sets based on the third prioritization data and displayed on a user interface;
- and
- in response to user input received via the user interface pertaining to the alert set, initiate one or more remediation operations with respect to the first security alert data.
8 more elements
One or more non-transitory computer-accessible storage media storing executable instructions that, when executed by one or more processors, implement a network monitoring system and cause the network monitoring system to:
- collect first telemetry data from a first compute environment;
- determine, based on a first classifier using the first telemetry data associated with the first compute environment, first security alert data, wherein the first classifier is associated with the first compute environment;
- determine, based on a second classifier using the first telemetry data, second security alert data, wherein the second classifier is associated with a plurality of compute environments;
- determine first prioritization data associated with the first security alert data and second prioritization data associated with the second security alert data, wherein the first prioritization data includes a first detection rate associated with a first one or more detection rules that matches one or more characteristics of the first telemetry data, and the second prioritization data includes a global detection rate associated with a second one or more detection rules that matches one or more characteristics of the first telemetry data;
- determine third prioritization data based on a deviation between the first detection rate associated with the first one or more detection rules and the global detection rate associated with the second one or more detection rules;
- place the first security alert data in an alert set, wherein the alert set is selected from among a plurality of alert sets based on the third prioritization data and displayed on a user interface;
- and
- in response to user input received via the user interface pertaining to the alert set, initiate one or more remediation operations with respect to the first security alert data.
5 more elements
Dependencies are inferred from the claim text.