Dropzone.ai, Inc.

Colin James Phillips

Xue Jun Wu

Eric Joseph Hammerle

Robert Rowland Foley

Changhwan Oh

Michael Francis Buono

Embodiments perform automated threat hunting in computing environments. A threat hunt plan is obtained to guide collection of candidate evidence items from evidence sources. Portions of candidate evidence items are discarded based on relevance scores, and evidence items are determined from non-discarded portions. Threat indicators associated with the evidence items are identified based on criteria in the threat hunt plan. Threat profiles are obtained based on the evidence items and threat indicators such that threat profiles include threat assessment metrics and are included in a report. Collection agents may interface with system logs, network traffic captures, endpoints, databases, email services, or user activity records to gather evidence items based on time ranges, filtering criteria, or sampling rates.

Automated threat hunting

Embodiments manage context repositories in computing environments to enhance automated security analysis. Embodiments obtain context records containing supplemental information associated with security events and integrates them into prompts for large language models (LLMs) to generate severity scores for event classification. Embodiments apply criteria to invalidate outdated or unreliable context records based on age, source reliability, and usage frequency, then modifies prompts and repositories accordingly. Enhanced prompts incorporate context record summaries and entity relationship mappings to improve subsequent event analysis. Embodiments dynamically evaluates context records through quality filters, consolidates duplicates, and maintains audit trails with provenance tracking. User interfaces are dynamically transformed based on telemetry metrics and user feedback to optimize analyst workflows. Embodiments enable organizations to maintain curated, high-quality context repositories that continuously improve AI-assisted security analysis while reducing false positives and enhancing incident response effectiveness.

Growing community of inventors

Kirkland, WA, United States of America

Colin James Phillips