# US 2025/0097253 A1 · Threat indicator alert generation based on prioritization models > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2025/0097253 A1 - Document ID: US20250097253A1 - Status: Published application - Kind: A1 - Application number: 18/511,538 - Filed: 2023-11-16 - Published: 2025-03-20 - Earliest claimed: 2023-09-15 - Assignees: Google Inc. - Applicants: Google LLC - Inventors: Erik Shih-Hau Huang; Benjamin Henry Walter; Eric James Stennett; Ricardo Correa; Barbara Davila; Benjamin Zachary Withnell; John Whitcomb; Jeremiah David Warren; Moses Daniel Schwartz - Web page: https://patentgrep.com/patent/US20250097253A1 ## CPC - H04L 63/1433: {Vulnerability analysis} - H04L 41/16: using machine learning or artificial intelligence - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method includes receiving, at a security platform, a plurality of threat indicators associated with current intrusive activities with respect to computing resources of a first entity and receiving, at the security platform, a plurality of threat datasets associated with prior intrusive activities with respect to computing resources associated with one or more entities including the first entity. The method further includes receiving, at the security platform, a plurality of environmental datasets associated with the computing resources of the first entity and determining an alert level associated with a first threat indicator of the plurality of threat indicators based on the plurality of threat datasets and the plurality of environmental datasets. The method further includes generating, responsive to the alert level satisfying an alert threshold criterion, an alert associated with the first threat indicator for one or more users of the first entity. ## Claims ### Claim 1 A method comprising: receiving, at a security platform, a plurality of threat indicators associated with current intrusive activities with respect to computing resources of a first entity; receiving, at the security platform, a plurality of threat datasets associated with prior intrusive activities with respect to computing resources associated with one or more entities including the first entity; receiving, at the security platform, a plurality of environmental datasets associated with the computing resources of the first entity; determining an alert level associated with a first threat indicator of the plurality of threat indicators based on the plurality of threat datasets and the plurality of environmental datasets; and generating, responsive to the alert level satisfying an alert threshold criterion, an alert associated with the first threat indicator for one or more users of the first entity. ### Claim 2 (depends on 1) The method of claim 1, further comprising adding the first threat indicator to the plurality of threat datasets. ### Claim 3 (depends on 1) The method of claim 1, wherein the first threat indicator of the plurality of threat indicators has associated metadata, wherein the associated metadata comprises a severity score, environmental data associated with the computing resources of the first entity, and at least one of network-based threat data or host-based threat data. ### Claim 4 (depends on 3) The method of claim 3, wherein generating the alert is further responsive to the metadata of the first threat indicator satisfying an alert generation criterion. ### Claim 5 (depends on 3) The method of claim 3, wherein the network-based threat data comprises at least one of: an internet protocol (IP) address; a domain name; or a universal resource locator (URL). ### Claim 6 (depends on 3) The method of claim 3, wherein the host-based threat data comprises at least a file hash. ### Claim 7 (depends on 3) The method of claim 3, wherein determining the alert level associated with the first threat indicator comprises: identifying a prioritization model defined by the first entity, the prioritization model comprising a score threshold and a plurality of metadata criteria; and applying the prioritization model to the first threat indicator, the plurality of threat datasets, and the plurality of environmental datasets, wherein applying the prioritization model comprises: comparing the severity score of the first threat indicator to the score threshold of the prioritization model; and evaluating the metadata of the first threat indicator against each of the plurality of metadata criteria of the prioritization model to determine the alert level. ### Claim 8 (depends on 7) The method of claim 7, wherein evaluating the metadata of the first threat indicator comprises at least one of: comparing the metadata of the first threat indicator to a first threat dataset of the plurality of threat datasets; or comparing the metadata of the first threat indicator to a first environmental dataset of the plurality of environmental datasets. ### Claim 9 (depends on 7) The method of claim 7, wherein: the prioritization model corresponds to a machine learning model; at least one threat indicator of the plurality of threat indicators defines a set of features and respective labels that are included in training data to train the machine learning model, wherein each label of the respective labels indicates a target alert level based on one or more corresponding features of the set of features; and the machine learning model is trained using the training data comprising: the set of features representing training inputs; and the respective labels representing target outputs for the training inputs. ### Claim 10 (depends on 9) The method of claim 9, further comprising: receiving a new threat indicator; applying the trained machine learning model to the new threat indicator to obtain a new alert level; and generating, responsive to the new alert level satisfying the alert threshold criterion, a new alert associated with the new threat indicator for the one or more users of the first entity. ### Claim 11 A system comprising: a memory device; and a processing device coupled to the memory device, the processing device to perform operations comprising: receiving, at a security platform, a plurality of threat indicators associated with current intrusive activities with respect to computing resources of a first entity; receiving, at the security platform, a plurality of threat datasets associated with prior intrusive activities with respect to computing resources associated with one or more entities including the first entity; receiving, at the security platform, a plurality of environmental datasets associated with the computing resources of the first entity; determining an alert level associated with a first threat indicator of the plurality of threat indicators based on the plurality of threat datasets and the plurality of environmental datasets; and generating, responsive to the alert level satisfying an alert threshold criterion, an alert associated with the first threat indicator for one or more users of the first entity. ### Claim 12 (depends on 11) The system of claim 11, further comprising adding the first threat indicator to the plurality of threat datasets. ### Claim 13 (depends on 11) The system of claim 11, wherein the first threat indicator of the plurality of threat indicators has associated metadata, wherein the associated metadata comprises a severity score, environmental data associated with the computing resources of the first entity, and at least one of network-based threat data or host-based threat data. ### Claim 14 (depends on 13) The system of claim 13, wherein determining the alert level associated with the first threat indicator comprises: identifying a prioritization model defined by the first entity, the prioritization model comprising a score threshold and a plurality of metadata criteria; and applying the prioritization model to the first threat indicator, the plurality of threat datasets, and the plurality of environmental datasets, wherein applying the prioritization model comprises: comparing the severity score of the first threat indicator to the score threshold of the prioritization model; and evaluating the metadata of the first threat indicator against each of the plurality of metadata criteria of the prioritization model to determine the alert level. ### Claim 15 (depends on 14) The system of claim 14, wherein evaluating the metadata of the first threat indicator comprises at least one of: comparing the metadata of the first threat indicator to a first threat dataset of the plurality of threat datasets; or comparing the metadata of the first threat indicator to a first environmental dataset of the plurality of environmental datasets. ### Claim 16 A non-transitory computer-readable medium comprising instructions that, when executed by a processing device, cause the processing device to perform operations comprising: receiving, at a security platform, a plurality of threat indicators associated with current intrusive activities with respect to computing resources of a first entity; receiving, at the security platform, a plurality of threat datasets associated with prior intrusive activities with respect to computing resources associated with one or more entities including the first entity; receiving, at the security platform, a plurality of environmental datasets associated with the computing resources of the first entity; determining an alert level associated with a first threat indicator of the plurality of threat indicators based on the plurality of threat datasets and the plurality of environmental datasets; and responsive to the alert level satisfying an alert threshold criterion, generating an alert associated with the first threat indicator for one or more users of the first entity. ### Claim 17 (depends on 16) The non-transitory computer-readable medium of claim 16 further comprising instructions that, when executed by the processing device, cause the processing device to perform operations comprising adding the first threat indicator to the plurality of threat datasets. ### Claim 18 (depends on 16) The non-transitory computer-readable medium of claim 16, wherein the first threat indicator of the plurality of threat indicators has associated metadata, wherein the associated metadata comprises a severity score, environmental data associated with the computing resources of the first entity, and at least one of network-based threat data or host-based threat data. ### Claim 19 (depends on 18) The non-transitory computer-readable medium of claim 18, wherein determining the alert level associated with the first threat indicator comprises: identifying a prioritization model defined by the first entity, the prioritization model comprising a score threshold and a plurality of metadata criteria; and applying the prioritization model to the first threat indicator, the plurality of threat datasets, and the plurality of environmental datasets, wherein applying the prioritization model comprises: comparing the severity score of the first threat indicator to the score threshold of the prioritization model; and evaluating the metadata of the first threat indicator against each of the plurality of metadata criteria of the prioritization model to determine the alert level. ### Claim 20 (depends on 19) The non-transitory computer-readable medium of claim 19, wherein: the prioritization model corresponds to a machine learning model; at least one threat indicator of the plurality of threat indicators defines a set of features and respective labels that are included in training data to train the machine learning model, wherein each label of the respective labels indicates a target alert level based on one or more corresponding features of the set of features; and the machine learning model is trained using the training data comprising: the set of features representing training inputs; and the respective labels representing target outputs for the training inputs.