Systems and methods for automated alert classification and triage

A method comprising:

• receiving, from a source, an alert associated with a security event, wherein the alert includes at least one entity;
• identifying a category for the alert;
• creating a feature vector for the alert that include static features based on the alert and dynamic features based on count information derived from a plurality of similar alerts, wherein each of the similar alerts has a common category with the alert or at least one common entity with the alert and the count information is maintained for previously received alerts associated with a set period of time;
• providing the feature vector to a probabilistic classification machine learning model trained using historical alerts associated with a historical period of time, wherein the historical period of time covers a longer time period than the set period of time;
• obtaining at least one probability for an action from the probabilistic classification machine learning model;
• determining whether the at least one probability exceeds a probability threshold;
• when the at least one probability exceeds the probability threshold, providing the alert and the action associated with the probability;
• receiving an analyst action for the alert;
• and
• updating the count information based on the alert and the analyst action.

A system for processing alerts associated with security events, comprising:

• an interface for receiving a plurality of alerts from a plurality of tenants, wherein each alert is associate with a security event detected at one of the tenants;
• a time series database storing a plurality of counters, wherein each counter maintains a count of alert attributes or combinations of alert attributes for alerts associated with a set period of time;
• a probabilistic classification machine learning model trained using historical alerts associated with a historical period of time, wherein the historical period of time covers a longer time period than the set period of time;
• and
• a processor configured for executing computer readable instructions that when executed by the processor cause the processor to:
• receive a first alert;
• categorize the first alert;
• create a first feature vector for the first alert that includes static features based on the first alert and dynamic features based on the counters maintained in the time series database;
• provide the first feature vector to the probabilistic classification machine leaning model;
• obtain a first probability for a first action for the first alert from the probabilistic classification machine learning model;
• determine whether the first probability exceeds a first probability threshold;
• and
• when the first probability exceeds the first probability threshold, automatically taking the first action for the first alert.