Back to results
US 12,764,131 B1Granted
Detecting security alerts using different security systems operating on a same compute environment
AssigneeRapid7, Inc.
InventorJeffrey Bruins
Life of this patent
Estimating the term…
Abstract
Various embodiments include systems and methods pertaining to a security service platform that detects security threats based on results from multiple security systems operating on a same compute environment. The multiple security systems may each generate and store respective security alerts within a priority object. The priority object may be used to define rules that are based on results from the multiple security systems, including determining groups of security alerts or determining security alert prioritization based on local compute environment characteristics. The security service platform may use the provide an alert that indicates a detected cyberattack.
Claims20
A method comprising:
- executing a network monitoring system implemented on one or more computer systems, wherein the execution includes:
- repeatedly collecting telemetry data associated with a first compute environment and assessing the telemetry data using a plurality of security systems that generate different types of alert data, wherein the plurality of security systems includes:
- (a) a process alert classifier system that assesses the telemetry data for alerts associated with executed application processes,
- (b) a novel alert classifier system that assesses one or more novelty characteristics of alerts based on historical frequencies of the alerts, and
- (c) a service level agreement (SLA) logging system that assesses the telemetry data for observed violations of one or more SLAs;
- determining, using a first security system of the security systems and based on first telemetry data associated with the first compute environment, first security alert data;
- determining, using a second security system of the security systems and based on the first telemetry data associated with the first compute environment, second security alert data;
- determining, based on one or more detection rules using the first security alert data and the second security alert data, third security alert data indicative of a cyberattack on the first compute environment and a priority level of third security alert data;
- and
- executing, in response to the third security alert data and according to the priority level, one or more remediation operations on the first compute environment to mitigate one or more security threats indicated by the third security alert data.
7 more elements
A system comprising:
- a memory storing executable instructions;
- and
- one or more processors that execute the executable instructions to implement a network monitoring system and cause the network monitoring system to:
- repeatedly collect telemetry data associated with a first compute environment and assess the telemetry data using a plurality of security systems that generate different types of alert data, wherein the plurality of security systems includes:
- (a) a process alert classifier system that assesses the telemetry data for alerts associated with executed application processes,
- (b) a novel alert classifier system that assesses one or more novelty characteristics of alerts based on historical frequencies of the alerts, and
- (c) a service level agreement (SLA) logging system that assesses the telemetry data for observed violations of one or more SLAs;
- determine, using a first security system of the security systems and based on first telemetry data associated with the first compute environment, first security alert data;
- determine, using a second security system of the security systems and based on the first telemetry data associated with the first compute environment, second security alert data;
- determine, based on one or more detection rules using the first security alert data and the second security alert data, third security alert data indicative of a cyberattack on the first compute environment and a priority level of third security alert data;
- and
- execute, in response to the third security alert data and according to the priority level, one or more remediation operations on the first compute environment to mitigate one or more security threats indicated by the third security alert data.
9 more elements
One or more non-transitory computer-accessible storage media storing executable instructions that, when executed by one or more processors, implement a network monitoring system and cause the network monitoring system to:
- repeatedly collect telemetry data associated with a first compute environment and assess the telemetry data using a plurality of security systems that generate different types of alert data, wherein the plurality of security systems includes:
- (a) a process alert classifier system that assesses the telemetry data for alerts associated with executed application processes,
- (b) a novel alert classifier system that assesses one or more novelty characteristics of alerts based on historical frequencies of the alerts, and
- (c) a service level agreement (SLA) logging system that assesses the telemetry data for observed violations of one or more SLAs;
- determine, using a first security system of the security systems and based on first telemetry data associated with the first compute environment, first security alert data;
- determine, using a second security system of the security systems and based on the first telemetry data associated with the first compute environment, second security alert data;
- determine, based on one or more detection rules using the first security alert data and the second security alert data, third security alert data indicative of a cyberattack on the first compute environment and a priority level of third security alert data;
- and
- execute, in response to the third security alert data and according to the priority level, one or more remediation operations on the first compute environment to mitigate one or more security threats indicated by the third security alert data.
6 more elements
Dependencies are inferred from the claim text.