Alerts for communities of a security information sharing platform

Patent metadata

Field	Value
Publication number	US-10693914-B2
Application number	US-201515737878-A
Country	US
Kind code	B2
Filing date	Jun 26, 2015
Priority date	Jun 26, 2015
Publication date	Jun 23, 2020
Grant date	Jun 23, 2020

Abstract

Examples disclosed herein relate to alerts for communities of a security information sharing platform. Some examples may enable obtaining a security indicator from a user of a first community of a security information sharing platform that enables sharing of security information among a plurality of communities; including the security indicator in community-based security information associated with the first community, the first security indicator comprising a first observable; sharing the first security indicator with the security information sharing platform; obtaining, from the security information sharing platform, information related to sightings of the first observable; and providing a first alert to the first community based on the information related to the sightings of the first observable.

First claim

The invention claimed is:

1. A method for providing alerts for communities of a security information sharing platform, the method comprising:
obtaining a first security indicator from a user of a first community of the security information sharing platform that enables sharing of security information among a plurality of communities, wherein each of the plurality of communities is a defined group of users that share a particular set of security information;
including the first security indicator in community-based security information associated with the first community, the first security indicator comprising a first observable;
sharing a first portion of the first security indicator with a second community of the security information sharing platform, wherein a second portion of the first security indicator is kept private to the first community of the security information sharing platform;
obtaining, from the security information sharing platform, information related to sightings of the first observable; and
providing a first alert to the first community based on the information related to the sightings of the first observable.

2. The method of claim 1 , wherein obtaining the information related to the sightings of the first observable further comprises:
obtaining, from a first source entity, a first sighting of the first observable, the first sighting of the first observable indicating that the first observable has been observed by the first source entity; and
determining a number of sightings of the first observable, the sightings of the first observable including the first sighting of the first observable.

3. The method of claim 2 , wherein the first source entity comprises a second user of the second community.

4. The method of claim 2 , further comprising:
obtaining, from a second source entity, a second sighting of the first observable, the second sighting of the first observable indicating that the first observable has been observed by the second source entity; and
determining the number of sightings of the first observable, the sightings of the first observable including the second sighting of the first observable.

5. The method of claim 2 , wherein providing the first alert to the first community based on the information related to the sightings of the first observable further comprises:
determining whether the number of sightings of the first observable exceeds a threshold value; and
in response to determining that the number of sightings of the first observable exceeds the threshold value, generating the first alert.

6. The method of claim 1 , wherein the first security indicator comprises a second observable, further comprising;
obtaining, from the security information sharing platform, information related to sightings of the second observable; and
providing a second alert to the first community based on the information related to the sightings of the second observable.

7. The method of claim 1 , wherein the first community is prevented from obtaining the first alert unless the first security indicator is shared with the security information sharing platform.

8. The method of claim 1 , wherein the plurality of communities other than the first community are prevented from accessing the first security indicator unless the first security indicator is also shared with the plurality of communities.

9. The method of claim 1 , the first security indicator associated with first contextual information, the method comprising:
sharing a first portion of the first contextual information with the second community, wherein a second portion of the first contextual information is kept private to the first community.

10. The method of claim 9 , wherein the first contextual information indicates an industry sector associated with the first community.

11. A non-transitory machine-readable storage medium comprising instructions executable by a processor of a computing device for providing alerts for communities of a security information sharing platform, the machine-readable storage medium comprising:
instructions to obtain a first security indicator from a first user of a first community generated on the security information sharing platform that enables sharing of security information among a plurality of communities, wherein each of the plurality of communities is a defined group of users that share a particular set of security information;
instructions to include the first security indicator in community-based security information associated with the first community, the first security indicator comprising an observable;
instructions to share a first portion of the first security indicator with a second community of the security information sharing platform, wherein a second portion of the first security indicator is kept private to the first community of the security information sharing platform;
instructions to determine a number of sightings of the observable using information stored on the security information sharing platform, the number of sightings indicating the number of times that the observable has been observed by at least one source entity; and
instructions to provide a first alert to the first community based on the number of sightings of the observable.

12. The non-transitory machine-readable storage medium of claim 11 , further comprising:
instructions to identify contextual information related to the first security indicator;
instructions to identify a second security indicator that is related to the identified contextual information; and
instructions to provide a second alert to the first community based on information stored on the security information sharing platform with respect to the second security indicator.

13. The non-transitory machine-readable storage medium of claim 11 , further comprising:
instructions to provide the first security indicator to the first community to obtain contextual information related to the first security indicator from a second user of the first community.

14. The non-transitory machine-readable storage medium of claim 13 , wherein the contextual information is not shared with the security information sharing platform.

15. A system for providing alerts for communities of a security information sharing platform comprising:
a processor that:
obtains a first security indicator from a first user of a first community of the security information sharing platform that enables sharing of security information among a plurality of communities, the first security indicator associated with first contextual information, wherein each of the plurality of communities is a defined group of users that share a particular set of security information;
obtains a second security indicator from a second user of a second community of the security information sharing platform, the second security indicator associated with second contextual information;
shares a first portion of the first security indicator with the second community of the security information sharing platform, wherein a second portion of the first security indicator is kept private to the first community;
determines that the first contextual information has at least a portion that overlaps with the second contextual information; and
provides an alert to the first community about the second security indicator using the second contextual information.

16. The system of claim 15 , wherein the first or second contextual information comprise a threat actor, an industry sector, a geography, a sighting, or a combination thereof.

17. The system of claim 1

Assignees

• Entit Software Llc
• Micro Focus Llc

Inventors

• Sander Tomas
• Cohen Nadav
• Hein Brian Frederik Hosea Che
• Ross Ted

Classifications

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/1408 Primary

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L43/06

  Generation of reports · CPC title

• H04L41/06

  Management of faults, events, alarms or notifications · CPC title

• H04L29/06

  Electricity · mapped topic