Systems and methods for cyber security threat detection and expedited generation of investigation storyboards using intelligent cyber security automations

Patent metadata

Field	Value
Publication number	US-11604875-B2
Application number	US-202217859800-A
Country	US
Kind code	B2
Filing date	Jul 7, 2022
Priority date	Feb 25, 2021
Publication date	Mar 14, 2023
Grant date	Mar 14, 2023

Abstract

A system and method for generating a digital cybersecurity artifact includes selectively executing an automated cybersecurity investigation workflow based on a probable cybersecurity threat type of a cybersecurity event, wherein an output of the automated cybersecurity investigation workflow includes one or more corpora of investigation findings data in response to executing the automated cybersecurity investigation workflow; selectively instantiating a digital cybersecurity artifact of a plurality of digital cybersecurity artifacts based on the probable cybersecurity threat type of the cybersecurity event, wherein the digital cybersecurity artifact includes a plurality of distinct regions electronically mapped to one or more threat type-specific content automations that, when executed, install investigation findings data into the plurality of distinct regions of the plurality of distinct regions of the digital cybersecurity artifact with selective subsets of investigation findings data of the one or more corpora of investigation findings data.

First claim

We claim:

1. A method for automatically generating a digital cybersecurity artifact for accelerating threat mitigation of a cybersecurity event, the method comprising:
identifying a cybersecurity event associated with one or more computing or digital assets of a subscriber;
instantiating, by one or more computers, a digital cybersecurity artifact based on a probable cybersecurity threat type of the cybersecurity event, wherein the digital cybersecurity artifact includes at least one distinct region digitally mapped to one or more content-specific automations that, when executed, install one or more subsets of investigation findings data into the at least one distinct region; and
generating, by the one or more computers, a cybersecurity event-specific reporting artifact based on executing the one or more content-specific automations and installing the one or more subsets of investigation findings data into the at least one distinct region.

2. The method according to claim 1 , wherein:
the instantiation of the digital cybersecurity artifact includes:
identifying a reference mapping between a plurality of distinct cybersecurity threat types and a plurality of distinct digital cybersecurity artifacts; and
identifying the digital cybersecurity artifact based on evaluating the probable cybersecurity threat type of the cybersecurity event against the reference mapping.

3. The method according to claim 1 , wherein:
the instantiation of the digital cybersecurity artifact includes:
identifying a reference mapping between a plurality of distinct cybersecurity threat types and a plurality of distinct digital cybersecurity artifacts; and
identifying the digital cybersecurity artifact based on performing a search of the reference mapping using the probable cybersecurity threat type of the cybersecurity event.

4. The method according to claim 1 , wherein:
one of the one or more content-specific automations of the digital cybersecurity artifact include a login-to-location graphical automation that, when executed, graphically displays login activity data of a target user account associated with the cybersecurity event superimposed on a geographical map.

5. The method according to claim 1 , wherein:
one of the one or more content-specific automations of the digital cybersecurity artifact include a login-to-time graphical automation that, when executed, graphically indicates login activity data of a target user account associated with the cybersecurity event with respect to time.

6. The method according to claim 1 , wherein:
the at least one distinct region of the digital cybersecurity artifact includes a login-to-location graphical automation, a login-to-time graphical automation, and an event digest content automation.

7. The method according to claim 1 , wherein:
one of the one or more content-specific automations of the digital cybersecurity artifact include a subscriber digital asset-to-threat node automation that, when executed, constructs:
(a) one or more representations of subscriber digital assets affected by the cybersecurity event;
(b) one or more representations of malicious threat nodes causing the cybersecurity event; and
(c) one or more graphical edges, wherein each of the one or more graphical edges visually connects a distinct representation of the one or more representations of subscriber digital assets to the one or more representations of malicious threat nodes.

8. The method according to claim 7 , further comprising:
mitigating, via one or more mitigation actions, a subset of malicious threat nodes based on the one or more representations of malicious threat nodes.

9. The method according to claim 1 , further comprising:
updating, via the one or computers, at least one of the one or more content-specific automations of the cybersecurity event-specific reporting artifact based on identifying additional digital event data relevant to the cybersecurity event.

10. The method according to claim 1 , further comprising:
updating, via the one or more computers, at least one of the one or more content-specific automations of the cybersecurity event-specific reporting artifact based on identifying one or more additional cybersecurity events related to the cybersecurity event.

11. The method according to claim 1 , further comprising:
augmenting the cybersecurity event-specific reporting artifact to include an additional content-specific automation distinct from the one or more of content-specific automations of the digital cybersecurity artifact based on identifying additional digital event data associated with the cybersecurity event.

12. A method for automatically generating a digital cybersecurity artifact for accelerating threat mitigation of a cybersecurity event, the method comprising:
identifying a cybersecurity event associated with one or more computing or digital assets of a subscriber;
selectively executing an automated cybersecurity investigation workflow of a plurality of distinct automated cybersecurity investigation workflows based on one or more characteristics of the cybersecurity event, wherein an output of the execution of the automated cybersecurity investigation workflow includes one or more corpora of cybersecurity investigation findings data;
selectively instantiating, by one or more computers, a digital cybersecurity artifact of a plurality of digital cybersecurity artifacts based on the one or more characteristics of the cybersecurity event, wherein the digital cybersecurity artifact includes a plurality of distinct regions digitally mapped to one or more threat type-specific content automations that, when executed, install investigation findings data into the plurality of distinct regions with selective subsets of investigation findings data of the one or more corpora of investigation findings data; and
generating, by the one or more computers, a cybersecurity event-specific reporting artifact based on an execution of the one or more threat type-specific content automations.

13. The method according to claim 12 , wherein:
one of the one or more threat type-specific content automations of the digital cybersecurity artifact, when executed:
(1) identify alert-to-fix timeline data, and
(2) install, into one of the plurality of distinct regions, a graphical alert-to-fix timeline illustration based on the alert-to-fix timeline data.

14. The method according to claim 12 , wherein:
one of the one or more threat type-specific content automations of the digital cybersecurity artifact, when executed:
(a) identify cybersecurity intelligence data, and
(b) install, into one of the plurality of distinct regions, a graphical illustration of metrics based on the cybersecurity intelligence data.

15. The method according to claim 12 , wherein:
one of the one or more characteristics relates to a probable cybersecurity threat type of the cybersecurity event.

16. The method according to claim 12 , wherein:
one of the one or more characteristics relates to a probable cybersecurity threat severity level of the cybersecurity event.

17. A method for automatically generating a digital cybersecurity artifact for accelerating threat mitigation of a cybersecurity alert, the method comprising:
identifying a cybersecurity alert associated with one or more computing or digital assets of a subscriber;
instantiating, by one or more computers, a digital cybersecurity artifact based on a probable cybersecurity threat type of the cybersecurity alert, wherein the digital cybersecurity artifact includes at least one distinct region digitally m

Assignees

• Expel Inc

Inventors

• Hencinski Jonathan
• Garton Emily
• Tom Jasper
• Conley Pat
• Spigarelli David
• Studner Roger

Classifications

• G06F21/554 Primary

  involving event detection and direct action · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title