Systems, methods, and graphical user interfaces for accelerating a construction of a data integration for a non-integrated technology data source

Patent metadata

Field	Value
Publication number	US-12598199-B2
Application number	US-202519207677-A
Country	US
Kind code	B2
Filing date	May 14, 2025
Priority date	Jun 20, 2023
Publication date	Apr 7, 2026
Grant date	Apr 7, 2026

Abstract

A system, method, and computer-program product includes displaying, via a data integration building user interface, a plurality of integration-identifying user interface input elements configured to receive one or more strings of text for specifying a set of integration identification parameters that characterize an in-development security integration for a third-party security service, displaying, via the data integration building user interface, a signal-specific data mapping container based on receiving an input selecting a signal mapping addition control button of the data integration building user interface, displaying, via the data integration building user interface, a raw event simulation container based on receiving an input selecting a simulation addition control button of the data integration building user interface, and displaying, via the data integration building user interface, an integration deployment control element that, when operated, transitions the in-development security integration to a deployed security integration.

First claim

We claim:

1 . A computer-program product comprising a non-transitory machine-readable storage medium storing computer instructions that, when executed by one or more processors, perform operations comprising:
providing, via the one or more processors, a graphical user interface that includes:
one or more input elements configured to receive one or more strings of text for specifying a set of parameters that characterize an in-development integration associated with a third-party service;
a signal-specific data mapping container configured to receive inputs of characters to map technology-specific data attributes of the third-party service to technology source-agnostic data attributes required by a distinct technology source-agnostic event signal type of a plurality of predetermined technology source-agnostic event signal types, wherein the signal-specific data mapping container includes a signal type user interface element that, when selected, displays a drop-down menu element of the plurality of predetermined technology source-agnostic event signal types provided by a cybersecurity event detection and response service;
a raw event simulation container configured to receive input of:
(i) a distinct raw event generated by the third-party service, and
(ii) an expected technology source-agnostic event signal type for validating that the in-development integration translates the distinct raw event to a respective technology-source agnostic event signal of the expected technology source-agnostic event signal type using mapping instructions specified by the signal-specific data mapping container; and

an integration deployment control element configured to receive an input for transitioning the in-development integration to a deployed integration for the third-party service;
receiving an unnormalized event from the third-party service; generating a technology-source agnostic event signal that corresponds to the unnormalized event using the deployed integration for the third-party security service; and executing a threat mitigation response that mitigates a security threat associated with the technology-source agnostic event signal corresponding to the unnormalized event.

2 . The computer-program product according to claim 1 , wherein:
executing the threat mitigation response that mitigates the security threat associated with the technology-source agnostic event signal includes reporting the security threat in real-time to a threat reporting user interface accessible by a subscribing entity.

3 . The computer-program product according to claim 1 , wherein:
executing the threat mitigation response that mitigates the security threat associated with the technology-source agnostic event signal includes surfacing the security threat via a threat reporting user interface.

4 . The computer-program product according to claim 1 , wherein:
the deployed integration for the third-party service defines a data integration nexus between the third-party service and the event detection and response service.

5 . The computer-program product according to claim 1 , wherein the computer instructions, when executed by the one or more processors, perform operations further comprising:
determining a threat severity of the technology-source agnostic event signal based on assessing the technology-source agnostic event signal against a set of automated detection decisioning workflows digitally mapped to a type of the technology-source agnostic event signal.

6 . The computer-program product according to claim 5 , wherein the computer instructions, when executed by the one or more processors, perform operations further comprising:
routing the technology-source agnostic event signal to one of a plurality of event queues, wherein:
the technology-source agnostic event signal is routed to an event escalation queue when the technology-source agnostic event signal satisfies escalation criteria of the set of automated detection decisioning workflows, and
the technology-source agnostic event signal is routed to an event disposal queue when the technology-source agnostic event signal satisfies disposal criteria of the set of automated detection decisioning workflows.

7 . A computer-implemented method comprising:
instantiating, via a data integration building user interface, a plurality of integration-identifying user interface input elements configured to receive one or more strings of text for specifying a set of integration identification parameters that characterize an in-development security integration for a third-party security service; instantiating, via the data integration building user interface, a signal-specific data mapping container based on receiving an input selecting a signal mapping addition control button of the data integration building user interface, wherein the signal-specific data mapping container is configured to receive inputs of characters to map technology-specific data attributes of the third-party security service to technology source-agnostic data attributes required by a target technology source-agnostic event signal type; instantiating, via the data integration building user interface, a raw event simulation container based on receiving an input selecting a simulation addition control button of the data integration building user interface, wherein the raw event simulation container is configured to receive input of:
(i) a distinct raw event generated by the third-party security service, and
(ii) an expected technology source-agnostic event signal type for validating that the in-development security integration accurately translates the distinct raw event to a technology source-agnostic event signal of the expected technology source-agnostic event signal type using mapping instructions specified by the signal-specific data mapping container; and
displaying, via the data integration building user interface, an integration deployment control element that, when operated, transitions the in-development security integration to a deployed security integration, wherein the raw event simulation container executes, via one or more processing devices, a computer-based integration simulation that generates a simulation output indicating whether a reconfiguration of the in-development security integration is needed before the in-development security integration is deployed into production by assessing whether the mapping instructions specified by the signal-specific data mapping container translated the distinct raw event to the technology-source agnostic event signal of the expected technology source-agnostic event signal type.

8 . The computer-implemented method according to claim 7 , further comprising:
at a cybersecurity event detection and response service:
identifying that the third-party security service is in inoperable communication with the cybersecurity event detection and response service; and
instantiating, via the one or more processing devices, the data integration building user interface based on identifying that the third-party security service is in inoperable communication with the cybersecurity event detection and response service, wherein the data integration building user interface is digitally accessible by a user of the cybersecurity event detection and response service.

9 . The computer-implemented method according to claim 7 , wherein:
transitioning the in-development security integration to the deployed security integration includes: installing, via the one or more processing devices, the mapping instructions associated with the in-development security integration into a database or repository storing a plurality of previously deployed security data integrations.

Assignees

• Expel Inc

Inventors

• Whalen Dan
• Edgett Patrick
• Hafiri Issa
• Ramesh Ashwin
• Pritchett Andrew
• Chiou Sam
• Rodriguez Joseph
• Walk Dave
• Timmons Max
• Dean Matt

Classifications

• G06F8/34 Primary

  Graphical or visual programming · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• H04L41/22

  comprising specially adapted graphical user interfaces [GUI] · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title