Cybersecurity Incident Response and Security Operation System Employing Playbook Generation Through Custom Machine Learning

A computer-readable, non-transitory, tangible medium comprising software that, when executed by a processor, causes the processor to perform a method of responding to cybersecurity incidents, comprising:

• at a security incident response platform, registering a new cybersecurity incident;
• at a playbook generation system:
• receiving details of the new cybersecurity incident from the security incident response platform, at least some of the details corresponding to a set of features of the new cybersecurity incident;
• localizing a set or subset of nearest neighbors of the new cybersecurity incident in a feature space, the nearest neighbors of the new cybersecurity incident being other cybersecurity incidents having a distance from the new cybersecurity incident within the feature space that is defined by differences in features of the nearest neighbors with respect to the set of features of the new cybersecurity incident;
• and
• creating a custom playbook for responding to the new cybersecurity incident, the custom playbook having one or more prescriptive procedures, for responding to the new cybersecurity incident registered by the security incident response platform, that are based on occurrences of prescriptive procedures previously employed in response to the nearest neighbor cybersecurity incidents, and on distances of the nearest neighbors of the new cybersecurity incident in the feature space;
• presenting to a user of the security incident response platform the custom playbook containing the one or more prescriptive procedures for responding to the new cybersecurity incident;
• and
• permitting the user of the security incident response platform to initiate the one or more prescriptive procedures contained in the custom playbook to respond to the new cybersecurity incident.

A method of responding to cybersecurity incidents, comprising:

• at a security incident response platform, registering a new cybersecurity incident;
• at a playbook generation system:
• receiving details of the new cybersecurity incident from the security incident response platform, at least some of the details corresponding to a set of features of the new cybersecurity incident;
• and
• producing a playbook for responding to the new cybersecurity incident, the playbook having one or more prescriptive procedures, for responding to the new cybersecurity incident, that are based on occurrences of one or more prescriptive procedures previously employed in response to previous cybersecurity incidents recorded in a feature space having features similar or identical to the set of features of the new cybersecurity incident;
• presenting to a user of the security incident response platform the playbook containing a set of the one or more prescriptive procedures for responding to the cybersecurity incident;
• the user of the security incident response platform responding to the cybersecurity incident by initiating a set of one or more prescriptive procedures that differs from the set of the one or more prescriptive procedures contained in the playbook;
• and
• at the playbook generation system, recording the new cybersecurity incident in the feature space and automatically tying to the new cybersecurity incident the one or more prescriptive procedures actually initiated by the user in responding to the new cybersecurity incident, thereby automatically altering subsequent recommendations of playbooks for responding to cybersecurity incidents having features similar or identical to the set of features of the new cybersecurity incident.

A computer-readable, non-transitory, tangible medium comprising software that, when executed by a processor, causes the processor to perform a method of responding to cybersecurity incidents, comprising:

• at a security incident response platform, registering a new cybersecurity incident;
• at a playbook generation system:
• receiving details of the new cybersecurity incident from the security incident response platform, at least some of the details corresponding to a set of features of the new cybersecurity incident;
• and
• producing a playbook for responding to the new cybersecurity incident, the playbook having one or more prescriptive procedures, for responding to the new cybersecurity incident, that are based on occurrences of one or more prescriptive procedures previously employed in response to previous cybersecurity incidents recorded in a feature space having features similar or identical to the set of features of the new cybersecurity incident;
• presenting to a user of the security incident response platform the playbook containing a set of the one or more prescriptive procedures for responding to the cybersecurity incident;
• permitting the user of the security incident response platform to respond to the cybersecurity incident by initiating a set of one or more prescriptive procedures that differs from the set of the one or more prescriptive procedures contained in the playbook;
• and
• at the playbook generation system, recording the new cybersecurity incident in the feature space and automatically tying to the new cybersecurity incident the one or more prescriptive procedures actually initiated by the user in responding to the new cybersecurity incident, thereby automatically altering subsequent recommendations of playbooks for responding to cybersecurity incidents having features similar or identical to the set of features of the new cybersecurity incident.