Microsoft Technology Licensing, LLC

Yaron David Fruchtmann

Hani Hana Neuvirth

Ely Abramovitch

Amir Keren

Ishai Wertheimer

The principles described herein relate to the training and implementation of a model designed to estimate the probability of new security incidents being true incidents. This occurs in an environment where a service such as a SIEM monitors a network of computing systems and other resources and detects a variety of incidents that could be security threats. These incidents are reported to the SOC for investigation and the SOC will take appropriate action to mitigate potential threats of true security breaches. As part of the investigation process, the SOC can label whether a security incident is true, false or benign. After labeling enough security incidents a model can be produced to estimate the probability that new security incidents are true incidents. This would help the SOC filter through security incidents more efficiently and allow for quicker response of the most likely security breaches.

Growing community of inventors

Herzliya, Israel

Yaron David Fruchtmann