US 12,346,447 B2
Systems, methods, and graphical user interfaces for configuring and implementing computer-executable detection instructions in a cybersecurity threat detection and mitigation platform
Dan Whalen, Herndon, VA (US); and Patrick Edgett, Westminster, CO (US)
Assigned to Expel, Inc., Herndon, VA (US)
Filed by Expel, Inc., Herndon, VA (US)
Filed on Aug. 2, 2024, as Appl. No. 18/793,483.
Application 18/793,483 is a continuation in part of application No. 18/749,222, filed on Jun. 20, 2024.
Claims priority of provisional application 63/533,238, filed on Aug. 17, 2023.
Claims priority of provisional application 63/521,968, filed on Jun. 20, 2023.
Prior Publication US 2025/0036765 A1, Jan. 30, 2025
Int. Cl. G06F 21/56 (2013.01)
CPC G06F 21/566 (2013.01) [G06F 2221/034 (2013.01)] 19 Claims
OG exemplary drawing
 
1. A computer-implemented method for accelerating a detection of a cybersecurity threat, the method comprising:
obtaining, via one or more processors, a third-party security event that involves a digital asset or computing asset of a subscriber;
generating a technology source-agnostic security event signal for the third-party security event based on routing the third-party security event to an event normalization service;
identifying, via the one or more processors, a technology source-agnostic security event signal type that corresponds to the technology source-agnostic security event signal in response to generating the technology source-agnostic security event signal;
retrieving, via the one or more processors, a corpus of computer-executable detection instructions digitally mapped to the technology source-agnostic security event signal type based on querying a detection instructions retrieval application programming interface (API);
assessing, via the one or more processors, the technology source-agnostic security event signal against each computer-executable detection instruction included in the corpus of computer-executable detection instructions;
generating, via the one or more processors, a prospective security alert based on the technology source-agnostic security event signal satisfying a set of alerting conditions of one of the computer-executable detection instructions of the corpus of computer-executable detection instructions; and
instantiating, via the one or more processors, a detection-building graphical user interface for constructing a target automated detection instruction based on receiving a request from a user, wherein the detection-building graphical user interface includes:
a plurality of detection-identifying user interface input elements configured to receive, from the user, one or more strings of text that characterize the target automated detection instruction, and
a set of user interface buttons, that when operated, is configured to control whether the target automated detection instruction is used for only the subscriber or across all subscribers subscribing to a cybersecurity event detection and response service.