US 11,658,999 B2
Systems and methods for intelligent cyber security threat detection and mitigation through an extensible automated investigations and threat mitigation platform
Matt Peters, Herndon, VA (US); Peter Silberman, Rockville, MD (US); Dan Whalen, Herndon, VA (US); Elisabeth Weber, Herndon, VA (US); Jon Hencinski, Herndon, VA (US); and John Begeman, Herndon, VA (US)
Assigned to Expel, Inc., Herndon, VA (US)
Filed by Expel, Inc., Herndon, VA (US)
Filed on Feb. 15, 2022, as Appl. No. 17/672,140.
Application 17/672,140 is a continuation of application No. 17/488,800, filed on Sep. 29, 2021, granted, now 11,303,666.
Claims priority of provisional application 63/091,409, filed on Oct. 14, 2020.
Prior Publication US 2022/0337621 A1, Oct. 20, 2022
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); G06F 9/54 (2006.01); G06N 5/04 (2023.01); G06N 5/022 (2023.01)
CPC H04L 63/1441 (2013.01) [G06F 9/547 (2013.01); G06N 5/022 (2013.01); G06N 5/04 (2013.01); H04L 63/1416 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method for accelerating a remediation of a cybersecurity event, the method comprising:
initializing an ensemble of automated investigation tasks based on detecting a cybersecurity event, wherein:
the ensemble of automated investigation tasks being defined by a subset of a plurality of distinct automated investigation tasks that is electronically linked to a likely cybersecurity event type associated with the cybersecurity event, and
obtaining a corpus of cybersecurity threat-probative data based on executing the ensemble of automated investigation tasks, wherein executing the ensemble of automated investigation tasks includes:
automatically sourcing one or more pieces of cybersecurity threat-probative data by one or more distinct automated investigative tasks of the ensemble of automated investigation tasks;
configuring threat response collateral based on the one or more pieces of cybersecurity threat-probative data, wherein the threat response collateral informs one or more threat mitigation responses to the cybersecurity event or informs a de-escalation response to the cybersecurity event; and
computing a cybersecurity threat severity value associated with the cybersecurity event based on extracting selective pieces of data from the one or more pieces of cybersecurity threat-probative data, wherein:
the cybersecurity threat severity value informs a routing of the cybersecurity event to one of a plurality of distinct threat mitigation or threat disposal routes.