Sumo Logic, Inc.

Dflabs S.p.a.

Sumo Logic Italy S.p.a

Vojtech Letal

Dario Valentino Forte

Michele Zambelli

A new cybersecurity incident is registered at a security incident response platform. At a playbook generation system, details are received of the new cybersecurity incident from the security incident response platform. At least some of the details correspond to a set of features of the new cybersecurity incident. A set or subset of nearest neighbors of the new cybersecurity incident is localized in a feature space. The nearest neighbors of the new cybersecurity incident are other cybersecurity incidents having a distance from the new cybersecurity incident within the feature space that is defined by differences in features of the nearest neighbors with respect to the set of features of the new cybersecurity incident. A custom playbook is created for responding to the new cybersecurity incident having prescriptive procedures based on occurrences of prescriptive procedures previously employed in response to the nearest neighbor cybersecurity incidents.

Cybersecurity incident response and security operation system employing playbook generation through custom machine learning

A new cybersecurity incident is registered at a security incident response platform. At a playbook generation system, details are received of the new cybersecurity incident from the security incident response platform. At least some of the details correspond to a set of features of the new cybersecurity incident. A set or subset of nearest neighbors of the new cybersecurity incident is localized in a feature space. The nearest neighbors of the new cybersecurity incident are other cybersecurity incidents having a distance from the new cybersecurity incident within the feature space that is defined by differences in features of the nearest neighbors with respect to the set of features of the new cybersecurity incident. A custom playbook is created for responding to the new cybersecurity incident. The custom playbook has one or more prescriptive procedures, for responding to the new cybersecurity incident registered by the security incident response platform, that are based on occurrences of prescriptive procedures previously employed in response to the nearest neighbor cybersecurity incidents, and on distances of the nearest neighbors of the new cybersecurity incident in the feature space. A user of the security incident response platform is presented with the custom playbook containing the one or more prescriptive procedures for responding to the new cybersecurity incident. The user of the security incident response platform initiates the one or more prescriptive procedures contained in the custom playbook to respond to the new cybersecurity incident.

Growing community of inventors

Pardubice, Czechia

Vojtech Letal