Systems, methods, and graphical user interfaces for accelerating a construction of a data integration for a non-integrated technology data source

Patent metadata

Field	Value
Publication number	US-12335283-B2
Application number	US-202418749222-A
Country	US
Kind code	B2
Filing date	Jun 20, 2024
Priority date	Jun 20, 2023
Publication date	Jun 17, 2025
Grant date	Jun 17, 2025

Abstract

A system, method, and computer-program product includes displaying, via a data integration building user interface, a plurality of integration-identifying user interface input elements configured to receive one or more strings of text for specifying a set of integration identification parameters that characterize an in-development security integration for a third-party security service, displaying, via the data integration building user interface, a signal-specific data mapping container based on receiving an input selecting a signal mapping addition control button of the data integration building user interface, displaying, via the data integration building user interface, a raw event simulation container based on receiving an input selecting a simulation addition control button of the data integration building user interface, and displaying, via the data integration building user interface, an integration deployment control element that, when operated, transitions the in-development security integration to a deployed security integration.

First claim

We claim:

1. A computer-implemented method comprising:
displaying, via a data integration building user interface, a plurality of integration-identifying user interface input elements configured to receive one or more strings of text for specifying a set of integration identification parameters that characterize an in-development security integration for a third-party security service;
displaying, via the data integration building user interface, a signal-specific data mapping container based on receiving an input selecting a signal mapping addition control button of the data integration building user interface, wherein the signal-specific data mapping container is configured to receive inputs of characters to map technology-specific data attributes of the third-party security service to technology source-agnostic data attributes required by a target technology source-agnostic event signal type;
displaying, via the data integration building user interface, a raw event simulation container;
automatically prepopulating, within the raw event simulation container, a distinct raw event generated by the third-party security service, wherein the raw event simulation container is configured to receive input of:
an expected technology source-agnostic event signal type for validating that the in-development security integration accurately translates the distinct raw event automatically prepopulated within the raw event simulation container to a technology source-agnostic event signal of the expected technology source-agnostic event signal type using mapping instructions specified by the signal-specific data mapping container, wherein:
the raw event simulation container executes, via one or more processing devices, a computer-based integration simulation that generates a simulation output indicating whether a reconfiguration of the in-development security integration is needed before the in-development security integration is deployed into production by assessing whether the mapping instructions specified by the signal-specific data mapping container translated the distinct raw event to a technology-source agnostic security event signal of the expected technology source-agnostic event signal type, and
the computer-based integration simulation is automatically executed based on detecting an algorithmic change to the in-development security integration; and

displaying, via the data integration building user interface, an integration deployment control element that, when operated, transitions the in-development security integration to a deployed security integration for the third-party security service, wherein based on operating the integration deployment control element, installing the mapping instructions configured via the signal-specific data mapping container into a computer database storing a plurality of previously deployed security integrations;
receiving an unnormalized security event from the third-party security service;
generating a technology-source agnostic security event signal that corresponds to the unnormalized security event using the deployed security integration for the third-party security service; and
executing, in real-time, a threat mitigation response that mitigates a security threat associated with the technology-source agnostic security event signal that corresponds to the unnormalized security event by reporting the security threat in real-time to a threat reporting user interface accessible to a subscribing entity.

2. The computer-implemented method according to claim 1 , further comprising:
at a cybersecurity event detection and response service:
identifying that the third-party security service is in inoperable communication with the cybersecurity event detection and response service; and
instantiating, via one or more computers, the data integration building user interface based on identifying that the third-party security service is in inoperable communication with the cybersecurity event detection and response service, wherein the data integration building user interface is digitally accessible by a user of the cybersecurity event detection and response service.

3. The computer-implemented method according to claim 1 , further comprising:
receiving, via one or more computers, a third-party event;
identifying, within the computer database storing the plurality of previously deployed security integrations, a target security data integration of the plurality of previously deployed security integrations that corresponds to the third-party event based on a type of the third-party event; and
generating a corresponding technology source-agnostic event signal using mapping instructions defined by the target security data integration that corresponds to the third-party event.

4. The computer-implemented method according to claim 3 , wherein:
in response to generating the corresponding technology source-agnostic event signal:
identifying, via the one or more computers, a selective subset of automated detection decisioning workflows of a plurality automated detection decisioning workflows digitally mapped to the corresponding technology source-agnostic event signal based on a signal type of the corresponding technology source-agnostic event signal;
evaluating, via the one or more computers, the corresponding technology source-agnostic event signal against the selective subset of automated detection decisioning workflows.

5. The computer-implemented method according to claim 1 , wherein:
the plurality of integration-identifying user interface input elements includes:
a first integration-identifying user interface input element configured to receive an input of a title that corresponds to the in-development security integration,
a second integration-identifying user interface input element configured to receive an input of an integration description that corresponds to the in-development security integration, and
a third integration-identifying user interface input element configured to receive an input of a slug that corresponds to the in-development security integration.

6. The computer-implemented method according to claim 1 , wherein:
the signal-specific data mapping container includes a signal type user interface element that, when selected, displays a drop-down menu element of a plurality of technology source-agnostic event signal types provided by a cybersecurity event detection and response service.

7. The computer-implemented method according to claim 6 , further comprising:
dynamically instantiating, within the signal-specific data mapping container, a plurality of source-to-target data mapping user interface elements based on receiving a selection of the target technology source-agnostic event signal type from the drop-down menu element of the plurality of technology source-agnostic event signal types.

8. The computer-implemented method according to claim 6 , wherein:
the target technology source-agnostic event signal type is associated with a plurality of signal versions, wherein each signal version of the plurality of signal versions corresponds to a distinct iteration of the target technology source-agnostic event signal type,
the signal-specific data mapping container further includes a version-controlled user interface element that, when selected, displays a drop-down menu element of the plurality of signal versions that correspond to the target technology source-agnostic event signal type.

9. The computer-implemented method according to claim 8 , further comprising:
dynamically instantiating, within the signal-specific data mapping container, a plurality of source-to-target data mapping user interface elements based on:
(a) receiving a selection of the target technology sour

Assignees

• Expel Inc

Inventors

• Whalen Dan
• Edgett Patrick
• Hafiri Issa
• Ramesh Ashwin
• Pritchett Andrew
• Chiou Sam
• Rodriguez Joseph
• Walk Dave
• Timmons Max
• Dean Matt

Classifications

• G06F8/34 Primary

  Graphical or visual programming · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• H04L41/22

  comprising specially adapted graphical user interfaces [GUI] · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title