Machine learning model for recommending security threat response actions

Abstract

A security threat detection and response (STDR) system is disclosed capable of recommending actions for handling security events detected in a computer network. In embodiments, user actions taken via the graphical user interface of the system are recorded. The records are used as training data to train a machine learning model to recommend actions for different types of security events to subsequent users. The training may be performed online, so that the model continues to learn while it is used to make recommendations. In embodiments, the model may infer a priority of a recommended action based on observation data such as how quickly an action is taken, the order in which actions are taken, and the popularity of the action for the particular security event. In embodiments, the model may be configured to recommend actions that are new to the system or actions for new types of security events.