System and method for collaborative smart evidence gathering and investigation for incident response, attack surface management, and forensics in a computing environment

Abstract

A system and method for collaborative smart evidence gathering and investigation for incident response attack surface management and forensics in a computing environment is disclosed. The system obtains evidence data from multiple sources with various entry points, capturing contextual information. Further, the system processes the data using an artificial intelligence (AI) root cause analysis, graph augmented retrieval, semantic classifier, meaning extraction, and causal discovery model. Furthermore, the system performs similarity analysis to assess evidence quality, sufficiency, and completeness. Based on the evaluation, the system determines appropriate actions to be taken on the processed evidence data. Additionally, the system executes the actions to resolve the incidents effectively by using a smart expert system, a human agent participation, or an AI co-pilot, as a first-class investigator and collaborator in the process.