US 2022/0027831 A1 · SYSTEM AND METHOD FOR SECURITY ANALYST MODELING AND MANAGEMENT

Abstract

Systems and methods for managing incoming cybersecurity events. Incoming security events are first classified based on stored event profiles from previous events. Multiple analysts with relevant experience and background are determined based on the analysts' stored profiles. The incoming event is assigned and dispatched as necessary to one of these analysts. Analyst stress levels and mood is assessed, and the assessments are stored in the analyst profiles. Analyst resolution steps and performance against those steps in resolving the events are also stored in the relevant analyst profiles and in an event record database. QA reviews of resolved events are conducted when norm deviant circumstances arise. AI and process mining techniques are used in classifying the incoming events, assigning the incoming events to the relevant analyst, and determining lessons to be learned from previous events. The analyst profiles models specific analyst behaviour and are used for assigning incoming events.

Claims49

Dependent claims

A system for managing incoming events and analysts, the system comprising:

an event classifier module for classifying an incoming event;
an analyst database storing analyst profiles of said analysts;
a processing module for determining which analyst is to be assigned to address said incoming event based on an analyst profile in said analyst database;
a routing engine for routing data related to said incoming event to an analyst based on a determination by said processing module as to which analyst is to be assigned to address said incoming event;
wherein
said processing module receives data regarding said incoming event from said event classifier module and receives analyst profiles from said analyst database;
said processing module determines which analyst is to be assigned to said incoming event based on said analyst profiles and on a classification of said incoming event.

4 more elements

A method for addressing an incoming event, the method comprising:

a) receiving said incoming event;
b) classifying said incoming event based on stored event profiles;
c) determining at least one analyst suitable to address said incoming event, said at least one analyst being determined to be suitable based on a plurality of stored analyst profiles;
d) assigning said incoming event to one of said at least one analyst determined in step c);
and
e) dispatching data relating to said incoming event to said analyst assigned in step d).

3 more elements

Dependencies are inferred from the claim text.

System and method for security analyst modeling and management

Life of this patent

System and method for security analyst modeling and management

Life of this patent

Abstract

Claims49