Cyber security scenarios with improved playbooks
AssigneeDarktrace Holdings Limited
InventorsSimon Fellows, Dickon Humphrey
Life of this patent
Estimating the term…
Abstract
An apparatus comprises a cyber security restoration engine configured to restore an asset in a computing network that is involved in a cyberattack to a trusted operational state and prioritize remediation actions for the asset in the computing network. The cyber security restoration engine is configured to receive an indication that the asset in the computing network is involved in a cyber security scenario. The cyber security restoration engine is further configured to identify, based on a property of the asset, an ordered set of instructions forming a playbook that applies to the asset to at least partially address the cyber security scenario.
Claims20
An apparatus, comprising:
- a cyber security restoration engine configured to restore an asset in a computing network that is involved in a cyberattack to a trusted operational state and prioritize remediation actions for the asset in the computing network, which is further configured to:
- receive an indication that the asset in the computing network is involved in a cyber security scenario, and
- identify, based on a property of the asset, an ordered set of instructions forming a playbook that applies to the asset to at least partially address the cyber security scenario;
- and
- where instructions implemented in software for the cyber security restoration engine are configured to be stored in one or more non-transitory storage mediums to be executed by one or more processing units.
A method for a cyber security restoration engine configured to restore an asset in a computing network that is involved in a cyberattack to a trusted operational state and prioritize remediation actions for the asset in the computing network, comprising:
- receiving an indication that the asset in the computing network is involved in a cyber security scenario, and
- identifying, based on a property of the asset, an ordered set of instructions forming a playbook that applies to the asset to at least partially address the cyber security scenario.
A non-transitory computer-readable medium storing instructions which when executed by a cyber security restoration engine configured to restore an asset in a computing network that is involved in a cyberattack to a trusted operational state and prioritize remediation actions for the asset in the computing network causes the cyber security restoration engine to:
- receive an indication that the asset in the computing network is involved in a cyber security scenario, and
- identify, based on a property of the asset, an ordered set of instructions forming a playbook that applies to the asset to at least partially address the cyber security scenario.
An apparatus, comprising:
- a cyber security restoration engine configured to restore an asset in a computing network that is involved in a cyberattack to a trusted operational state and prioritize remediation actions for the asset in the computing network, which is further configured to:
- cause a user interface to display a recommended set of instructions in a recommended order forming a playbook that applies to the asset in the computing network involved in a cyber security scenario, wherein the recommended set of instructions in the recommended order are identified based on knowledge about the asset and the cyber security scenario;
- and
- where instructions implemented in software for the cyber security restoration engine are configured to be stored in one or more non-transitory storage mediums to be executed by one or more processing units.
Dependencies are inferred from the claim text.