Method for responding to threat transmitted through communication network

A computer-implemented system comprising one or more processors and one or more computer-readable media storing computer-executable instructions that, when executed, cause the one or more processors to perform a method comprising:

• receiving security data from a unit security-associated system;
• generating a ticket based on the received security-associated data;
• requesting ticket analysis and response to the workflow module;
• calling AIP of the unit security system or an external security service;
• and
• carrying out a task according to API communication with the called unit security system or the external security service;
• wherein the task comprises at least one of an inquiry task, a blocking task, an alarm task, and a follow-up action task;
• wherein the inquiry task comprises at least one of an inquiry about IP reputation, an inquiry about asset information, an inquiry about WHOIS, an inquiry about GEOIP, an inquiry about URL, an inquiry about HASH, an inquiry about sandbox, an inquiry about prior information;
• and
• wherein the blocking task comprises at least one of account deactivation, IP blocking, HASH blocking, URL blocking and domain blocking.

A computer program product comprising one or more computer-readable storage media and program instructions stored in at least one of the one or more storage media, the program instructions executable by a processor to cause the processor to perform a method comprising:

• receiving security data from a unit security-associated system;
• generating a ticket based on the received security-associated data;
• requesting ticket analysis and response to the workflow module;
• calling AIP of the unit security system or an external security service;
• and
• carrying out a task according to API communication with the called unit security system or the external security service;
• wherein the task comprises at least one of an inquiry task, a blocking task, an alarm task, and a follow-up action task;
• wherein the inquiry task comprises at least one of an inquiry about IP reputation, an inquiry about asset information, an inquiry about WHOIS, an inquiry about GEOIP, an inquiry about URL, an inquiry about HASH, an inquiry about sandbox, an inquiry about prior information;
• and
• wherein the blocking task comprises at least one of account deactivation, IP blocking, HASH blocking, URL blocking and domain blocking.