Cybersecurity AI-driven workflow generation using policies

1 . A computer-implemented method for cybersecurity management comprising:

accessing a man-in-the-middle cybersecurity threat protection application and a ransomware cybersecurity threat protection application wherein the man-in-the-middle cybersecurity threat protection application and the ransomware cybersecurity threat protection application are deployed across a managed cybersecurity network, and wherein the man-in-the-middle cybersecurity threat protection application and the ransomware cybersecurity threat protection application are managed using a security orchestration, automation, and response (SOAR) platform;

assimilating, based on receiving user inputs in an artificial intelligence (AI) user interface, one or more cybersecurity network compliance requirements into the SOAR platform;

translating, using a machine learning (ML) model, the one or more cybersecurity network compliance requirements into one or more cybersecurity policies, wherein the ML model was trained using data gathered by one or more instantiations of the SOAR platform, and wherein the one or more cybersecurity policies provide cybersecurity network conformity with the compliance requirements;

generating a cybersecurity workflow for the managed cybersecurity network, based on the one or more cybersecurity policies, wherein generating the cybersecurity workflow is based on applying an embedded universal data layer comprising a first mapping and a second mapping wherein:

the first mapping includes a transformation of outputs of the man-in-the-middle cybersecurity threat protection application and the ransomware cybersecurity threat protection application,

the second mapping includes a transformation of inputs of the man-in-the-middle cybersecurity threat protection application and the ransomware cybersecurity threat protection application, and

in response to applying the first mapping and the second mapping, the generated cybersecurity workflow is configured to automatically swap the man-in-the-middle cybersecurity threat protection application with the ransomware cybersecurity threat protection application without modifying the cybersecurity workflow or creating a new cybersecurity workflow to address the swapped application; and

executing the cybersecurity workflow, using the SOAR platform, wherein:

inputs to the SOAR platform comprise the outputs of at least one of the man-in-the-middle cybersecurity threat protection application or the ransomware cybersecurity threat protection application that are transformed by the first mapping, and

the inputs of at least one of the man-in-the-middle cybersecurity threat protection application or the ransomware cybersecurity threat protection application comprise outputs of the SOAR platform that are transformed by the second mapping.

2 . The method of claim 1 wherein the compliance requirements are based on one or more of compliance standards, regulatory requirements, company policy documents, company incident response documents, and company industry segment standards.

3 . The method of claim 1 wherein the AI user interface comprises a natural language AI user interface.

4 . The method of claim 3 wherein the natural language AI user interface is embedded in the SOAR platform.

5 . The method of claim 3 wherein the natural language AI user interface is accessed by an application program interface (API) in the SOAR platform.

6 . The method of claim 3 wherein the natural language AI user interface is accessed by a user providing text input or voice input in the AI user interface.

7 . The method of claim 1 wherein the ML model is embedded in the SOAR platform.

8 . The method of claim 1 wherein the ML model is accessed through an API in the SOAR platform.

9 . The method of claim 1 further comprising augmenting the translating based on input received from an endpoint device of a cybersecurity representative.

10 . The method of claim 1 further comprising augmenting the translating based on input received from an endpoint device that includes publicly available cybersecurity threat applications.

11 . The method of claim 1 further comprising augmenting the translating based on input received from an endpoint device that includes company policy documentation.

12 . The method of claim 1 wherein generating the cybersecurity workflow is further based on applying another ML model to the one or more cybersecurity policies.

13 . The method of claim 12 wherein the other ML model is embedded in the SOAR platform.

14 . The method of claim 13 wherein the other ML model is trained using data gathered by the one or more instantiations of the SOAR platform.

15 . The method of claim 1 further comprising tagging a cybersecurity incident based on executing the cybersecurity workflow.

16 . The method of claim 15 wherein the tagging identifies a mismatch between the cybersecurity incident and a compliance requirement.

17 . The method of claim 1 wherein the cybersecurity workflow includes instructions to perform operations comprising: managing one or more of antivirus analysis, phishing attacks, security information and event management (SIEM) triage, threat hunting, insider threat protection, threat intelligence, identity verification reinforcement, endpoint protection, forensic investigation, cryptojacking, vulnerability management, cloud security orchestration, and end-to-end incident lifecycle case management.

18 . A system for cybersecurity management comprising:

one or more processors and memory storing instructions that, when executed, cause the one or more processors to perform operations comprising:

accessing a man-in-the-middle cybersecurity threat protection application and a ransomware cybersecurity threat protection application wherein the man-in-the-middle cybersecurity threat protection application and the ransomware cybersecurity threat protection application are deployed across a managed cybersecurity network, and wherein the man-in-the-middle cybersecurity threat protection application and the ransomware cybersecurity threat protection application are managed using a security orchestration, automation, and response (SOAR) platform;

assimilating, based on receiving user inputs in an artificial intelligence (AI) user interface, one or more cybersecurity network compliance requirements into the SOAR platform;

translating, using a machine learning (ML) model, the one or more cybersecurity network compliance requirements into one or more cybersecurity policies, wherein the ML model was trained using data gathered by one or more instantiations of the SOAR platform, and wherein the one or more cybersecurity policies provide cybersecurity network conformity with the compliance requirements;

generating a cybersecurity workflow for the managed cybersecurity network, based on the one or more cybersecurity policies, wherein generating the cybersecurity workflow is based on applying an embedded universal data layer comprising a first mapping and a second mapping wherein:

the first mapping includes a transformation of outputs of the man-in-the-middle cybersecurity threat protection application and the ransomware cybersecurity threat protection application,

the second mapping includes a transformation of inputs of the man-in-the-middle cybersecurity threat protection application and the ransomware cybersecurity threat protection application, and

in response to applying the first mapping and the second mapping, the generated cybersecurity workflow is configured to automatically swap the man-in-the-middle cybersecurity threat protection application with the ransomware cybersecurity threat protection application without modifying the cybersecurity workflow or creating a new cybersecurity workflow to address the swapped application; and

executing the cybersecurity workflow, using the SOAR platform, wherein:

inputs to the SOAR platform comprise the outputs of at least one of the man-in-the-middle cybersecurity threat protection application or the ransomware cybersecurity threat protection application that are transformed by the first mapping, and

the inputs of at least one of the man-in-the-middle cybersecurity threat protection application or the ransomware cybersecurity threat protection application comprise outputs of the SOAR platform that are transformed by the second mapping.

19 . The system of claim 18 wherein the compliance requirements are based on one or more of compliance standards, regulatory requirements, company policy documents, company incident response documents, and company industry segment standards.

20 . The system of claim 18 wherein the AI user interface comprises a natural language AI user interface.