Selectively prioritizing alerts received for an advanced cybersecurity threat prioritization system

Abstract

A computer-implemented method, according to one approach includes having a historical risk score generated for a current cybersecurity event in response to detecting the current cybersecurity event. A sigma rule detection score is also generated for the current cybersecurity event, in addition to an anomaly risk score that is generated for the current cybersecurity event. An IoC score is further generated for the current cybersecurity event. A machine learning model is used to evaluate the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score. The machine learning model is also used to create a consolidated risk score corresponding to: the current cybersecurity event, the consolidated risk score incorporating the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score.