US 11,716,346 B1
Prioritization and remediation of computer security attacks
Noah Kraemer, Moraga, CA (US); and Omer Azaria, San Francisco, CA (US)
Assigned to Sysdig, Inc., San Francisco, CA (US)
Filed by Sysdig, Inc., San Francisco, CA (US)
Filed on Aug. 29, 2022, as Appl. No. 17/898,171.
Int. Cl. H04L 29/00 (2006.01); H04L 9/40 (2022.01)
CPC H04L 63/1433 (2013.01) [H04L 63/0876 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A computer-implemented method for prioritizing security issues, comprising:
receiving, by one or more processors, a plurality of security events, from one or more clients, describing the security issues that have been detected,
wherein the security issues are related to computer security,
wherein each of the plurality of security events comprises attributes describing:
a type of security issue to be remedied,
one or more resources affected by the security issue, and
a risk score defining a level of security risk associated with the security issue based on a number of impacted computer resources or an amount of work to remedy the security issue;
aggregating, by the one or more processors, the plurality of security events into a set of recommendation categories of a plurality of categories based on the type of security issue to be remedied, wherein each recommendation category in the set of recommendation categories contains one or more aggregated security events having same type of security issue;
computing, by the one or more processors, an aggregated risk score for each recommendation category in the set of recommendation categories, wherein the aggregated risk score for said each recommendation category is based on one or more risk scores associated with the one or more aggregated security events belonging to said each recommendation category, wherein each of the one or more risk scores is defined as being either based on the number of impacted computing resources or the amount of work to remedy the corresponding security issue;
causing displaying, within a graphical user interface, information representing the set of recommendation categories based on the aggregated risk scores;
receiving, via the graphical user interface, user input selecting a particular recommendation category from the set of recommendation categories;
in response to selecting the particular recommendation category, causing displaying options to remedy the security issues within the particular recommendation category.