Automatic validations and prioritizations of indicators of compromise
AssigneeThe Toronto-Dominion Bank
InventorsNir AGIV, Moshe KARL, Allie David SHAY
Life of this patent
Estimating the term…
Abstract
One example method includes receiving indicator of compromise (IOC) intelligence including an IOC. The IOC can then be validated. One or more security systems to add the IOC can then be determined based on one or more risk indicators of the IOC. The IOC can then be added to the one or more security systems.
Claims20
A computer-implemented method of automating validation and prioritization of indicators of compromise (IOC), comprising:
- receiving indicator of compromise (IOC) intelligence comprising an IOC;
- validating the IOC automatically based on querying internal sources and external sources, wherein the internal sources and external sources collect IOC information;
- determining, based on one or more risk indicators of the IOC and querying the internal sources and the external sources, one or more security systems to add the IOC;
- and
- adding the IOC to the one or more security systems.
A system comprising:
- at least one memory storing instructions;
- and
- at least one hardware processor interoperably coupled with the at least one memory, wherein execution of the instructions by the at least one hardware processor causes performance of operations to automate the validation and prioritization of indicator of compromise (IOC) comprising:
- receiving indicator of compromise (IOC) intelligence comprising an IOC;
- validating the IOC automatically based on querying internal sources and external sources, wherein the internal sources and external sources collect IOC information;
- determining, based on one or more risk indicators of the IOC and querying the internal sources and external sources, one or more security systems to add the IOC;
- and
- adding the IOC to the one or more security systems.
A non-transitory, computer-readable medium storing computer-readable instructions, that upon execution by at least one hardware processor, cause performance of operations to automate the validation and prioritization of indicator of compromise (IOC), comprising:
- receiving indicator of compromise (IOC) intelligence comprising an IOC;
- validating the IOC automatically based on querying internal sources and external sources, wherein the internal sources and external sources collect IOC information;
- determining, based on one or more risk indicators of the IOC and querying the internal sources and external sources, one or more security systems to add the IOC;
- and
- adding the IOC to the one or more security systems.
Dependencies are inferred from the claim text.