Automatically investigating security alerts for security operations center (soc)

Abstract

Systems and methods for automatically investigating potential cyber security alerts threats are provided. A method includes receiving logs related to security alerts from multiple sources, the security alerts representing potential cyber security threats in a compute domain; and performing an automated investigation procedure configured to determine whether the logs represent actual cyber security threats, the automated investigation procedure including a plan generation stage in which high-level logical steps are planned for analyzing the logs and retrieving evidences for proving it either malicious or benign, a log comprehension stage in which details of the logs are analyzed to obtain observations of the logs, a plan execution stage in which the steps of the plan generation stage are executed with respect to the observations of the logs, a reasoning stage to conclude the case, and a re-planning stage to generate a new investigation plan for newly discovered entities or signal.