Cloud-based orchestration of incident response using multi-feed security event classifications with machine learning

A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by one or more processing resources of a cloud-based security service protecting a private network, causes the one or more processing resources to perform a method comprising:

• receiving, from an endpoint protection platform running on an endpoint device associated with the private network, an initial classification of an event associated with a process of the endpoint device and contextual information regarding the process and the event;
• collecting a plurality of classification results for the event by obtaining the classification result for the event from each of a plurality of data feeds implemented within the cloud-based security service, wherein each data feed of the plurality of data feeds is configured to independently classify a given security event and produce a classification result;
• generating a final classification result by applying a machine-learning classifier implemented within the cloud-based security service to the initial classification and the plurality of classification results;
• and
• based on the final classification, causing, by the cloud-based security service, the endpoint protection platform to perform an automated incident response, by providing an output of an automated response engine of the cloud-based security service to the endpoint protection platform.