Method, apparatus, system, and non-transitory computer readable medium for identifying and prioritizing network security events

A method for identifying and prioritizing a collection of information technology (IT) security events associated with a network, the method comprising:

• receiving a dataset representing a plurality of IT security events associated with the network, the plurality of IT security events specific to one or more resources associated with the network,
• generating, by each of a plurality of defined algorithms, a plurality of individual scores for the plurality of IT security events, each individual score indicative that a possible security incident occurred, the plurality of defined algorithms including a first defined algorithm employing one or more machine learning models and a second defined algorithm employing one or more rule-based conditions, wherein the first defined algorithm and the second defined algorithm each generates an individual score for each IT security event,
• correlating, based on the received dataset, each of the individual scores for the plurality of IT security events with the one or more resources,
• aggregating, for a resource of the one or more resources, each of the individual scores correlated with the resource into a security score specific to the resource,
• determining that the security score specific to the resource does not exceed a defined threshold, and
• updating the security score specific to the resource only after receiving a plurality of new IT security events.

A non-transitory computer readable medium storing computer readable instructions, which when executed by processing circuitry of a server, causes the server to:

• receive a dataset representing a plurality of information technology (IT) security events associated with a network, the plurality of IT security events specific to one or more resources associated with the network,
• generate, by each of a plurality of defined algorithms, a plurality of individual scores for the plurality of IT security events, each individual score indicative that a possible security incident occurred, the plurality of defined algorithms including a first defined algorithm employing one or more machine learning models and a second defined algorithm employing one or more rule-based conditions, wherein the first defined algorithm and the second defined algorithm each generates an individual score for each IT security event,
• correlate, based on the received dataset, each of the individual scores for the plurality of IT security events with the one or more resources,
• aggregate, for a resource of the one or more resources, each of the individual scores correlated with the resource into a security score specific to the resource,
• determine whether the security score specific to the resource exceeds a defined threshold, and
• in response to the security score specific to the resource not exceeding the defined threshold, update the security score specific to the resource only after receiving a plurality of new IT security events.