Systems, methods, and graphical user interfaces for configuring and implementing computer-executable detection instructions in a cybersecurity threat detection and mitigation platform

Patent metadata

Field	Value
Publication number	US-12346447-B2
Application number	US-202418793483-A
Country	US
Kind code	B2
Filing date	Aug 2, 2024
Priority date	Jun 20, 2023
Publication date	Jul 1, 2025
Grant date	Jul 1, 2025

Abstract

A system, method, and computer-program product includes obtaining a third-party security event of a subscriber, generating a technology source-agnostic security event signal for the third-party security event based on routing the third-party security event to an event normalization service, identifying a technology source-agnostic security event signal type that corresponds to the technology source-agnostic security event signal based on generating the technology source-agnostic security event signal, retrieving a corpus of computer-executable detection instructions digitally mapped to the technology source-agnostic security event signal type based on querying a detection instructions retrieval application programming interface (API), assessing the technology source-agnostic security event signal against each computer-executable detection instruction included in the corpus of computer-executable detection instructions, and generating, via the one or more processors, a prospective security alert based on the technology source-agnostic security event signal satisfying a set of alerting conditions of one of the computer-executable detection instructions.

First claim

We claim:

1. A computer-implemented method for accelerating a detection of a cybersecurity threat, the method comprising:
obtaining, via one or more processors, a third-party security event that involves a digital asset or computing asset of a subscriber;
generating a technology source-agnostic security event signal for the third-party security event based on routing the third-party security event to an event normalization service;
identifying, via the one or more processors, a technology source-agnostic security event signal type that corresponds to the technology source-agnostic security event signal in response to generating the technology source-agnostic security event signal;
retrieving, via the one or more processors, a corpus of computer-executable detection instructions digitally mapped to the technology source-agnostic security event signal type based on querying a detection instructions retrieval application programming interface (API);
assessing, via the one or more processors, the technology source-agnostic security event signal against each computer-executable detection instruction included in the corpus of computer-executable detection instructions;
generating, via the one or more processors, a prospective security alert based on the technology source-agnostic security event signal satisfying a set of alerting conditions of one of the computer-executable detection instructions of the corpus of computer-executable detection instructions; and
instantiating, via the one or more processors, a detection-building graphical user interface for constructing a target automated detection instruction based on receiving a request from a user, wherein the detection-building graphical user interface includes:
a plurality of detection-identifying user interface input elements configured to receive, from the user, one or more strings of text that characterize the target automated detection instruction, and
a set of user interface buttons, that when operated, is configured to control whether the target automated detection instruction is used for only the subscriber or across all subscribers subscribing to a cybersecurity event detection and response service.

2. The computer-implemented method according to claim 1 , wherein:
the one of the computer-executable detection instructions of the corpus of computer-executable detection instructions is configured to assign a predetermined degree of threat severity to the prospective security alert based on the technology source-agnostic security event signal satisfying the set of alerting conditions of the one of the computer-executable detection instructions,
the one of the computer-executable detection instructions of the corpus of computer-executable detection instructions is configured to assign a predetermined alert name to the prospective security alert based on the technology source-agnostic security event signal satisfying the set of alerting conditions of the one of the computer-executable detection instructions, and
the one of the computer-executable detection instructions of the corpus of computer-executable detection instructions is configured to assign a predetermined security threat classification or attack strategy to the prospective security alert based on the technology source-agnostic security event signal satisfying the set of alerting conditions of the one of the computer-executable detection instructions.

3. The computer-implemented method according to claim 1 , further comprising:
assessing, via the one or more processors, the prospective security alert against a corpus of computing environment data of the subscriber;
determining, via the one or more processors, the prospective security alert involves a critical computing asset of the subscriber based on assessing the prospective security alert against the corpus of computing environment data of the subscriber; and
routing, via the one or more processors, the prospective security alert to an alert queue based on the prospective security alert being a valid security alert.

4. The computer-implemented method according to claim 1 , further comprising:
assessing, via the one or more processors, the prospective security alert against one or more alert suppression instructions configured for the subscriber;
identifying, via the one or more processors, the prospective security alert as a suppressible alert based on the prospective security alert satisfying one of the one or more alert suppression instructions; and
routing, via the one or more processors, the prospective security alert to an alert disposal queue based on the prospective security alert being identified as the suppressible alert.

5. The computer-implemented method according to claim 1 , wherein:
the third-party security event is one of:
a raw security event obtained from a security information and event management (SIEM) security device associated with the subscriber,
a raw security event obtained from a third-party security device or third-party security application, and
a raw security event obtained from a cloud-based security device that is configured to monitor a cloud environment of the subscriber.

6. The computer-implemented method according to claim 1 , wherein:
each distinct computer-executable detection instruction of the corpus of computer-executable detection instructions is configured to assess the technology source-agnostic security event signal against a distinct set of predefined alerting conditions, and
each distinct computer-executable detection instruction of the corpus of computer-executable detection instructions is configured to generate a corresponding prospective security alert based on satisfying the distinct set of predefined alerting conditions associated with that distinct computer-executable detection instruction.

7. The computer-implemented method according to claim 6 , wherein:
the corpus of computer-executable detection instructions includes a first computer-executable detection instruction, a second computer-executable detection instruction, and a third computer-executable detection instruction,
the first computer-executable detection instruction is configured to generate a first type of prospective security alert based on the technology source-agnostic security event signal satisfying the distinct set of predefined alerting conditions of the first computer-executable detection instruction,
the second computer-executable detection instruction is configured to generate a second type of prospective security alert based on the technology source-agnostic security event signal satisfying the distinct set of predefined alerting conditions of the second computer-executable detection instruction,
the third computer-executable detection instruction is configured to generate a third type of prospective security alert based on the technology source-agnostic security event signal satisfying the distinct set of predefined alerting conditions of the third computer-executable detection instruction, and
the first type of prospective security alert, the second type of prospective security alert, and the third type of prospective security alert each correspond to a distinct type of prospective security alert.

8. The computer-implemented method according to claim 1 , wherein:
the corpus of computer-executable detection instructions digitally mapped to the technology source-agnostic security event signal type includes a first plurality of computer-executable detection instructions,
a second corpus of computer-executable detection instructions digitally mapped to a second technology source-agnostic security event signal type includes a second plurality of computer-executable detection instructions, and
a total number of computer-executable dete

Assignees

• Expel Inc

Inventors

• Whalen Dan
• Edgett Patrick

Classifications

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F21/554

  involving event detection and direct action · CPC title

• G06F21/566 Primary

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title