Threatconnect, Inc.

Andrew Pendergast

Daniel Cole

Danny Tineo

Bhaskar Karambelkar

Marika Chauvin

Mashell Rodriguez

Christopher Johnson

Kathryn Grayson Nanz

Andrew Gidwani

Jason Spies

Edward Hinkle

Techniques are disclosed relate to systems, methods, and non-transitory computer readable media for implementing a browser extension for cyber threat intelligence and response. One system to perform operations comprising: scanning, in a sandbox of a browser by a browser extension, at least part of a web page to produce a set of items of interests; transmitting the set of items of interests to a cloud-based enrichment and analysis of cybersecurity threat intelligence system to request information on the set of items; receiving a response from the cloud-based enrichment and analysis of cybersecurity threat intelligence system, the response including a scan result based on the transmitted set of items of interests, and the scan result including at least one of an indicator of compromise of the at least scanned part of the web page; and displaying the scan results including the at least one of an indicator of compromise.

Browser extension for cybersecurity threat intelligence and response

Techniques are disclosed relate to systems, methods, and non-transitory computer readable media for implementing a browser extension for cyber threat intelligence and response. One system to perform operations comprising: receiving, in a sandbox of a browser by a browser extension, a selection of at least one particular indicator of compromise of the at least one of the indicator of compromise of at least scanned part of a web page; displaying one or more orchestrated responses; receiving a selection of at least one particular orchestrated response of the one or more orchestrated responses; transmitting the selected at least one particular orchestrated response to the cloud-based enrichment and analysis of cybersecurity threat intelligence system; receiving a response including a result of the at least one particular orchestrated response; and displaying the result of the at least one particular orchestrated response.

Techniques are disclosed which can provide an orchestrated response to a cybersecurity threat. This orchestrated response may be based upon, at least in part, a reputation score. Threat model(s) may be received that identify cybersecurity threat(s). An indication of observations, false positives, and/or page views for the threat may be obtained. Data feeds may be received including known good data feeds, known bad data feeds, and enrichment data feeds. The data feeds may provide information about one or more indicators of compromise (IOC). For each IOC, a weighted criticality score may be determined. The weighted criticality score may be mapped to a corresponding point value. An aggregated score may be determined based upon at least the corresponding point value. A reputation score may be computed, and in some configurations, provided to a user.

Enrichment and analysis of cybersecurity threat intelligence and orchestrating application of threat intelligence to selected network security events

Growing community of inventors

Columbia, MD, United States of America

Andrew Pendergast