Threatconnect, Inc.

Danny Tineo

Daniel Cole

Andrew Pendergast

Bhaskar Karambelkar

Andrew Gidwani

Jason Spies

Christopher Johnson

Systems, methods, and computer-readable storage devices are disclosed for improve cybersecurity intelligence by launching applications ahead of time. One method including: receiving, over a communications network, at least one threat model; determining whether a performance of an orchestrated response is triggered based on the at least one threat model, wherein the orchestrated response includes a plurality of applications to be executed in a predetermined sequence; and launching, when the performance of the orchestrated response is triggered, a first application and a second application of the plurality of applications of the orchestrated response, wherein the second application executes after execution of the first application has completed execution.

Ahead of time application launching for cybersecurity threat intelligence of network security events

Techniques are disclosed relate to systems, methods, and non-transitory computer readable media for improved cybersecurity intelligence using custom trigger events. One system may include a non-transitory memory configured to store at least threat model data; and one or more hardware processors coupled to the non-transitory memory and configured to read instructions from the non-transitory memory to cause the system to perform operations comprising: receiving, over a communications network, the at least one custom trigger event for a threat model which identifies a cybersecurity threat; determining whether the cybersecurity threat triggers the performance of the orchestrated response based on the custom trigger event; and launching, when the cybersecurity threat triggers the performance of the orchestrated response, a first application and a second application of the plurality of applications of the orchestrated response.

Custom triggers for a network security event for cybersecurity threat intelligence

Techniques are disclosed which can provide an orchestrated response to a cybersecurity threat. This orchestrated response may be based upon, at least in part, a reputation score. Threat model(s) may be received that identify cybersecurity threat(s). An indication of observations, false positives, and/or page views for the threat may be obtained. Data feeds may be received including known good data feeds, known bad data feeds, and enrichment data feeds. The data feeds may provide information about one or more indicators of compromise (IOC). For each IOC, a weighted criticality score may be determined. The weighted criticality score may be mapped to a corresponding point value. An aggregated score may be determined based upon at least the corresponding point value. A reputation score may be computed, and in some configurations, provided to a user.

Growing community of inventors

Charlotte, NC, United States of America

Danny Tineo