Dropzone.ai, Inc.

Changhwan Oh

Xue Jun Wu

Eric Joseph Hammerle

Robert Rowland Foley

Michael Francis Buono

Colin James Phillips

Embodiments perform automated threat hunting in computing environments. A threat hunt plan is obtained to guide collection of candidate evidence items from evidence sources. Portions of candidate evidence items are discarded based on relevance scores, and evidence items are determined from non-discarded portions. Threat indicators associated with the evidence items are identified based on criteria in the threat hunt plan. Threat profiles are obtained based on the evidence items and threat indicators such that threat profiles include threat assessment metrics and are included in a report. Collection agents may interface with system logs, network traffic captures, endpoints, databases, email services, or user activity records to gather evidence items based on time ranges, filtering criteria, or sampling rates.

Automated threat hunting

Embodiments manage context repositories in computing environments to enhance automated security analysis. Embodiments obtain context records containing supplemental information associated with security events and integrates them into prompts for large language models (LLMs) to generate severity scores for event classification. Embodiments apply criteria to invalidate outdated or unreliable context records based on age, source reliability, and usage frequency, then modifies prompts and repositories accordingly. Enhanced prompts incorporate context record summaries and entity relationship mappings to improve subsequent event analysis. Embodiments dynamically evaluates context records through quality filters, consolidates duplicates, and maintains audit trails with provenance tracking. User interfaces are dynamically transformed based on telemetry metrics and user feedback to optimize analyst workflows. Embodiments enable organizations to maintain curated, high-quality context repositories that continuously improve AI-assisted security analysis while reducing false positives and enhancing incident response effectiveness.

Context repository management

Embodiments are directed to surveying security environments. A subject index that includes entries may be generated based on a survey of a content system. A question of a client may be compared to entries in the subject index. A prompt associated with the content system may be generated based on the entries, the data sources, or the question. Query models may be employed to obtain data associated with the question from the data sources. Other prompts may be generated based on the data from the data sources to generate candidate answers based on the question and the data from the data sources. An evaluation prompt that includes the candidate answers and the question may be generated to rank the candidate answers for correctness. Answers may be determined based on the ranking of the candidate questions such that top ranked candidate answers are provided to the client.

System for surveying security environments

Embodiments are directed to surveying security environments. A subject index that includes entries may be generated based on a survey of a content system. A question a client may be matched to entries in the subject index. A prompt associated with the content system may be generated based on the entries, the data sources, or the question. Query models may be employed to obtain data associated with the question from the data sources. Other prompts may be generated based on the data from the data sources to generate candidate answers based on the question and the data from the data sources. An evaluation prompt that includes the candidate answers and the question may be generated to rank the candidate answers for correctness. Answers may be determined based on the ranking of the candidate questions such that top ranked candidate answers are provided to the client.

Growing community of inventors

Shoreline, WA, United States of America

Changhwan Oh