# US 2019/0377882 A1 · Threat mitigation system and method

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0377882 A1
- Document ID: US20190377882A1
- Status: Published application
- Kind: A1
- Application number: 16/432,791
- Filed: 2019-06-05
- Published: 2019-12-12
- Earliest claimed: 2018-06-06
- Assignees: Reliaquest Holdings, LLC
- Applicants: ReliaQuest Holdings, LLC
- Inventors: Brian P. Murphy; Joe Partlow; Colin O'Connor; Jason Pfeiffer
- Web page: https://patentgrep.com/patent/US20190377882A1

## CPC

- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- G06F 8/65: Updates (security arrangements therefor G06F21/57)
- G06F 18/20: Analysing
- G06F 18/214: Generating training patterns; Bootstrap methods, e.g. bagging or boosting
- G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine
- G06F 21/55: Detecting local intrusion or implementing counter-measures
- G06F 21/554: {involving event detection and direct action}
- G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements
- G06F 21/561: {Virus type analysis}
- G06F 21/562: {Static detection}
- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- G06F 21/568: {eliminating virus, restoring damaged files}
- G06F 30/20: Design optimisation, verification or simulation (optimisation, verification or simulation of circuit designs G06F30/30)
- G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks
- G06N 20/00: Machine learning
- H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)}
- H04L 63/0263: {Rule management}
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1433: {Vulnerability analysis}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms}
- H04L 63/164: {at the network layer}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06F 2221/034: Test or assess a computer or a system
- G06F 2221/2115: Third party
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A computer-implemented method, computer program product and computing system for: displaying initial security-relevant information that includes analytical information; allowing a third-party to manipulate the initial security-relevant information with automation information; and generating revised security-relevant information that includes the automation information.

## Claims

### Claim 1

A computer-implemented method, executed on a computing device, comprising:
displaying initial security-relevant information that includes analytical information;
allowing a third-party to manipulate the initial security-relevant information with automation information; and
generating revised security-relevant information that includes the automation information.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1 further comprising:
rendering the revised security-relevant information.

### Claim 3 (depends on 2)

The computer-implemented method of claim 2 wherein rendering the revised security-relevant information includes:
rendering the revised security-relevant information within an interactive report.

### Claim 4 (depends on 1)

The computer-implemented method of claim 1 wherein allowing a third-party to manipulate the initial security-relevant information with automation information includes:
allowing a third-party to select automation information to add to the initial security-relevant information to generate the revised security-relevant information.

### Claim 5 (depends on 4)

The computer-implemented method of claim 4 wherein allowing a third-party to select the automation information to add to the initial security-relevant information to generate the revised security-relevant information includes:
allowing the third-party to choose a specific type of automation information from a plurality of automation information types.

### Claim 6 (depends on 1)

The computer-implemented method of claim 1 wherein generating revised security-relevant information that includes the automation information includes:
combining the automation information and the initial security-relevant information to generate the revised security-relevant information.

### Claim 7 (depends on 1)

The computer-implemented method of claim 1 wherein the analytical information includes one or more of:
investigative information; and
hunting information.

### Claim 8 (depends on 1)

The computer-implemented method of claim 1 wherein the automation information includes one or more of:
automated information; and
orchestrated information.

### Claim 9

A computer program product residing on a computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:
displaying initial security-relevant information that includes analytical information;
allowing a third-party to manipulate the initial security-relevant information with automation information; and
generating revised security-relevant information that includes the automation information.

### Claim 10 (depends on 9)

The computer program product of claim 9 further comprising:
rendering the revised security-relevant information.

### Claim 11 (depends on 10)

The computer program product of claim 10 wherein rendering the revised security-relevant information includes:
rendering the revised security-relevant information within an interactive report.

### Claim 12 (depends on 9)

The computer program product of claim 9 wherein allowing a third-party to manipulate the initial security-relevant information with automation information includes:
allowing a third-party to select automation information to add to the initial security-relevant information to generate the revised security-relevant information.

### Claim 13 (depends on 12)

The computer program product of claim 12 wherein allowing a third-party to select the automation information to add to the initial security-relevant information to generate the revised security-relevant information includes:
allowing the third-party to choose a specific type of automation information from a plurality of automation information types.

### Claim 14 (depends on 9)

The computer program product of claim 9 wherein generating revised security-relevant information that includes the automation information includes:
combining the automation information and the initial security-relevant information to generate the revised security-relevant information.

### Claim 15 (depends on 9)

The computer program product of claim 9 wherein the analytical information includes one or more of:
investigative information; and
hunting information.

### Claim 16 (depends on 9)

The computer program product of claim 9 wherein the automation information includes one or more of:
automated information; and
orchestrated information.

### Claim 17

A computing system including a processor and memory configured to perform operations comprising:
displaying initial security-relevant information that includes analytical information;
allowing a third-party to manipulate the initial security-relevant information with automation information; and
generating revised security-relevant information that includes the automation information.

### Claim 18 (depends on 17)

The computing system of claim 17 further comprising:
rendering the revised security-relevant information.

### Claim 19 (depends on 16)

The computing system of claim 16 wherein rendering the revised security-relevant information includes:
rendering the revised security-relevant information within an interactive report.

### Claim 20 (depends on 17)

The computing system of claim 17 wherein allowing a third-party to manipulate the initial security-relevant information with automation information includes:
allowing a third-party to select automation information to add to the initial security-relevant information to generate the revised security-relevant information.

### Claim 21 (depends on 20)

The computing system of claim 20 wherein allowing a third-party to select the automation information to add to the initial security-relevant information to generate the revised security-relevant information includes:
allowing the third-party to choose a specific type of automation information from a plurality of automation information types.

### Claim 22 (depends on 17)

The computing system of claim 17 wherein generating revised security-relevant information that includes the automation information includes:
combining the automation information and the initial security-relevant information to generate the revised security-relevant information.

### Claim 23 (depends on 17)

The computing system of claim 17 wherein the analytical information includes one or more of:
investigative information; and
hunting information.

### Claim 24 (depends on 17)

The computing system of claim 17 wherein the automation information includes one or more of:
automated information; and
orchestrated information.