Noise reduction
AssigneeCardinalOps Ltd.
InventorsYair Manor, Ilan Goldschmidt, Bar Grinshtein, Amihai Hadar, Yair Rascovsky
Life of this patent
Estimating the term…
Abstract
In one embodiment, a method for improving protection of a computer system from malicious activity includes receiving a set of alerts generated by a rule of a security monitoring system over a specified time period, analyzing the alerts to identify groups of name-value pair combinations, the analyzing including searching for combinations of name-value pairs within the set of alerts, and calculating a measurement of alerts for each of the combinations, and presenting one or more what-if scenarios to a user, each scenario showing an impact of the identified groups of name-value pair combinations in the security monitoring system.
Claims23
A method for improving protection of a computer system from malicious activity, comprising:
- receiving a set of alerts generated by a rule of a security monitoring system over a specified time period;
- analyzing the alerts to identify groups of name-value pair combinations, the analyzing including:
- searching for combinations of name-value pairs within the set of alerts;
- and
- calculating a measurement of alerts for each of the combinations;
- and
- presenting one or more what-if scenarios to a user, each scenario showing an impact of the identified groups of name-value pair combinations in the security monitoring system.
A system for improving protection of a computer system from malicious activity, comprising:
- a processor configured to:
- receive a set of alerts generated by a rule of a security monitoring system over a specified time period;
- analyze the alerts to identify groups of name-value pair combinations;
- search for combinations of name-value pairs within the set of alerts;
- calculate a measurement of alerts for each of the combinations;
- and
- present one or more what-if scenarios to a user, each scenario showing an impact of the identified groups of name-value pair combinations in the security monitoring system;
- and
- a memory to store data used by the processor.
A non-transitory computer-readable storage medium storing instructions that, when executed by a processor, cause the processor to:
- receive a set of alerts generated by a rule of a security monitoring system over a specified time period;
- analyze the alerts to identify groups of name-value pair combinations:
- search for combinations of name-value pairs within the set of alerts;
- and
- calculate a measurement of alerts for each of the combinations;
- and
- present one or more what-if scenarios to a user, each scenario showing an impact of the identified groups of name-value pair combinations in the security monitoring system.
Dependencies are inferred from the claim text.