A non-transitory computer readable medium having stored thereon a set of instructions, the set of instructions, when executed by a processor, causing a set of acts for automatically isolating malicious security alerts from benign alerts using an ensemble model of pattern recognition techniques, the set of acts comprising:
- maintaining an alert history comprising a plurality of stored alerts;
- receiving a new alert;
- processing the new alert using an ensemble of models, wherein the ensemble of models comprises two or more of an account-specific model, a site-specific model, and a type specific model, and the two or more of an account-specific model, a site-specific model, and a type-specific model each generate a model score;
- generating a score for the new alert by combining model scores from the ensemble of models according to a set of logic;
- and
- applying a threshold to the score to determine handling of the new alert.