Back to results
US 9,807,120 B2Granted
Method and system for automated incident response
AssigneeAccenture Global Services Limited
InventorsMatthew Carver, Louis William DiValentin, Michael L. Lefebvre, Elvis Hovor, David William Rozmiarek
Life of this patent
Estimating the term…
Abstract
Methods, systems, and apparatus, including computer programs encoded on computer storage media, for implementing a response to one or more security incidents in a computing network. One of the methods includes identifying a security incident based on detecting one or more indicators of compromise associated with the security incident, comparing the security incident with a predefined ontology that maps the security incident to one or more courses of action, selecting a response strategy that includes one or more of the courses of action, and implementing the response strategy as an automated response.
Claims20
A computer-implemented method, comprising:
- receiving, by a threat intelligence device within a computing network and from one or more data feed sources external to the computing network, information related to one or more previously identified computing network security threats;
- based at least in part on the information related to the one or more previously identified computing network security threats, determining, by the threat intelligence device, one or more observable indicators of compromise for at least one of the one or more previously identified computing network security threats;
- receiving, by a security information and analytics device of the computing network and from the threat intelligence device, the one or more observable indicators of compromise;
- monitoring, by the security information and analytics device, one or more computing network data sources internal to the computing network for occurrences of security incidents and identifying, by the security information and analytics device, a security incident as an occurrence of a particular security threat to the computing network from the one or more previously identified computing network security threats, based on detecting one or more observable indicators of compromise for the particular security threat;
- comparing, by the security information and analytics device, the security incident with a predefined ontology that maps the security incident to one or more courses of action, each of the one or more courses of action including workflow steps to be performed in response to the security incident;
- providing, through an operator display interface, a notification of the security incident, wherein the notification includes a list of the one or more courses of action that are mapped to the security incident;
- receiving, through the operator display interface, a selection of one or more of the one or more courses of action;
- and
- implementing, by an automated incident response device, the selected one or more courses of action including, for each workflow step of the selected one or more courses of action, performing the workflow step and receiving forensics information related to performing the workflow step.
6 more elements
A system comprising:
- one or more computers and one or more storage devices storing instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising:
- receiving, by a threat intelligence device within a computing network and from one or more data feed sources external to the computing network, information related to one or more previously identified computing network security threats;
- based at least in part on the information related to the one or more previously identified computing network security threats, determining, by the threat intelligence device, one or more observable indicators of compromise for at least one of the one or more previously identified computing network security threats;
- receiving, by a security information and analytics device of the computing network and from the threat intelligence device, the one or more observable indicators of compromise;
- monitoring, by a security information and analytics device, one or more computing network data sources internal to the computing network for occurrences of security incidents and identifying, by the security information and analytics device, a security incident as an occurrence of a particular security threat to the computing network from the one or more previously identified computing network security threats, based on detecting one or more observable indicators of compromise for the particular security threat;
- comparing, by the security information and analytics device, the security incident with a predefined ontology that maps the security incident to one or more courses of action, each of the one or more courses of action including workflow steps to be performed in response to the security incident;
- providing, through an operator display interface, a notification of the security incident, wherein the notification includes a list of the one or more courses of action that are mapped to the security incident;
- receiving, through the operator display interface, a selection of one or more of the one or more courses of action;
- and
- implementing, by an automated incident response device, the selected one or more courses of action including, for each workflow step of the selected one or more courses of action, performing the workflow step and receiving forensics information related to performing the workflow step.
7 more elements
A computer-readable device encoded with a computer program comprising instructions that, when executed, operate to cause a computer to perform operations comprising:
- receiving, by a threat intelligence device within a computing network and from one or more data feed sources external to the computing network, information related to one or more previously identified computing network security threats;
- based at least in part on the information related to the one or more previously identified computing network security threats, determining, by the threat intelligence device, one or more observable indicators of compromise for at least one of the one or more previously identified computing network security threats;
- receiving, by a security information and analytics device of the computing network and from the threat intelligence device, the one or more observable indicators of compromise;
- monitoring, by a security information and analytics device, one or more computing network data sources internal to the computing network for occurrences of security incidents and identifying, by the security information and analytics device, a security incident as an occurrence of a particular security threat to the computing network from the one or more previously identified computing network security threats, based on detecting one or more observable indicators of compromise for the particular security threat;
- comparing, by the security information and analytics device, the security incident with a predefined ontology that maps the security incident to one or more courses of action, each of the one or more courses of action including workflow steps to be performed in response to the security incident;
- providing, through an operator display interface, a notification of the security incident, wherein the notification includes a list of the one or more courses of action that are mapped to the security incident;
- receiving, through the operator display interface, a selection of one or more of the one or more courses of action;
- and
- implementing, by an automated incident response device, the selected one or more courses of action including, for each workflow step of the selected one or more courses of action, performing the workflow step and receiving forensics information related to performing the workflow step.
6 more elements
Dependencies are inferred from the claim text.