Machine-learning based approach for dynamically generating incident-specific playbooks for a security orchestration, automation and response (soar) platform

A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by a processing resource of a Security Orchestration, Automation and Response (SOAR) platform, causes the processing resource to perform a method comprising:

• capturing information regarding execution of a sequence of one or more actions performed by one or more analysts responsive to a first incident of a first type, wherein the one or more actions include one or more of:
• extracting one or more indicators of the first incident, determining a reputation score of one or more indicators of the first incident;
• analyzing a severity level of the incident based on a reputation score of at least one indicator of the first incident, or processing incident data of the first incident based on a severity level of the incident;
• in response to observing a second incident that is similar in nature to the first incident or the first type, generating a recommended sequence of one or more actions for use by an analyst in connection with responding to the second incident, wherein the recommended sequence is generated based on applying a machine-learning model to the captured information;
• and
• in response to rejection of the recommended sequence by the analyst, revising the recommended sequence based on input provided by the analyst and storing the revised recommendation sequence in a form of a revised playbook for response to subsequent incidents that are similar to the second incident.

A method for generating a playbook to facilitate incident response by a Security Orchestration, Automation and Response (SOAR) platform, the method comprising:

• capturing, by the SOAR platform, information regarding execution of a sequence of one or more actions performed by one or more analysts responsive to a first incident of a first type, wherein the one or more actions include one or more of:
• extracting one or more indicators of the first incident, determining a reputation score of one or more indicators of the first incident;
• analyzing a severity level of the incident based on a reputation score of at least one indicator of the first incident, or processing incident data of the first incident based on a severity level of the incident;
• in response to a second incident observed by the SOAR platform that is similar in nature to the first incident or the first type, generating a recommended sequence of one or more actions for use by an analyst in connection with responding to the second incident, wherein the recommended sequence is generated based on applying a machine-learning model to the captured information;
• and
• in response to rejection of the recommended sequence by the analyst, revising the recommended sequence based on input provided by the analyst and storing the revised recommendation sequence in a form of a revised playbook for response to subsequent incidents that are similar to the second incident.