Automatically investigating security alerts for Security Operations Center (SOC)
Systems and methods for automatically investigating potential cyber security alerts threats are provided. A method includes receiving logs related to security alerts from multiple sources, the security alerts representing potential cyber security threats in a compute domain; and performing an automated investigation procedure configured to determine whether the logs represent actual cyber security threats, the automated investigation procedure including a plan generation stage in which high-level logical steps are planned for analyzing the logs and retrieving evidences for proving it either malicious or benign, a log comprehension stage in which details of the logs are analyzed to obtain observations of the logs, a plan execution stage in which the steps of the plan generation stage are executed with respect to the observations of the logs, a reasoning stage to conclude the case, and a re-planning stage to generate a new investigation plan for newly discovered entities or signal.
1 . A method comprising steps of:
receiving logs related to security alerts from multiple sources, the security alerts representing potential cyber security threats in a compute domain; and
performing an automated investigation procedure configured to determine whether the logs represent actual cyber security threats, the automated investigation procedure including
a plan generation stage in which high-level logical steps are planned for analyzing the logs and retrieving evidences for proving it either malicious or benign, wherein the plan generation stage generates an executable investigation playbook comprising an ordered set of evidence-retrieval steps,
a log comprehension stage in which details of the logs are analyzed to obtain observations of the logs for a case, wherein the observations comprise a structured knowledge layer linking events and entities in the logs,
a plan execution stage in which the high-level logical steps of the plan generation stage are executed with respect to the observations of the logs to retrieve evidence specified by the executable investigation playbook,
a reasoning stage to conclude the case as malicious or benign based on the retrieved evidence, and
a re-planning stage to generate a new investigation plan for newly discovered entities or signals of the case or a new case, wherein the newly discovered entities or signals are identified during the plan execution stage and cause regeneration of the executable investigation playbook to include additional evidence-retrieval steps.
2 . The method of claim 1 , wherein the plan generation stage is configured to receive planning assistance from a neural-symbolic AI model including a Large Language Model (LLM), wherein the neural-symbolic AI model combines symbolic reasoning over structured knowledge with neural inference by the LLM to generate the executable investigation playbook.
3 . The method of claim 2 , wherein the plan generation stage is further configured to receive planning assistance from a security expert knowledge, wherein the security expert knowledge is provided by a security team or auto-acquired by
(1) learning from humans' past investigation stored in case management system,
(2) learning from past live feedback, or
(3) learning from provided textbooks, and
wherein the security expert knowledge constrains or guides generation of the executable investigation playbook by defining permissible investigation steps, evidence types, or reasoning rules.
4 . The method of claim 3 , where in the security expert knowledge is (1) encoded as plain texts and used via Retrieval Augmented Generation (RAG) in the LLM or (2) encoded as a knowledge graph and leveraged by the neural-symbolic AI model.
5 . The method of claim 1 , wherein the plan generation stage involves creating and editing a cyber security investigation and response playbook that is executed during the plan execution stage.
6 . The method of claim 1 , wherein the plan generation stage involves logic-based abductive reasoning, and wherein the logic-based abductive reasoning for reversely inferring potential root causes of suspicious activities observed in the security alerts.
7 . The method of claim 1 , wherein the log comprehension stage includes comprehension assistance from generative AI models trained specifically from sequences of events from one or more compute domains.
8 . The method of claim 1 , wherein the log comprehension stage includes a step of performing an unsupervised learning procedure on the logs to obtain a knowledge layer about the intent of user activities.
9 . The method of claim 1 , wherein the plan execution stage includes executing a variety of different actions.
10 . The method of claim 9 , wherein the variety of different actions include
(1) a step of presenting auto-generated predefined questions to one or more end users regarding the potential cyber security threats,
(2) a step of auto translating a natural language question to database queries or Application Programming Interface (API) calls, or
(3) a step of retrieving answers to investigation questions specified in the plan generation stage using institutional knowledge specific to each company, where the institutional knowledge is via Retrieval Augmented Generation (RAG) in a Large Language Model (LLM).
11 . The method of claim 1 , wherein the re-planning stage involves generating a new investigation plan for entities or signals discovered from an earlier plan execution stage.
12 . The method of claim 1 , wherein the automated investigation procedure further includes a report generation stage in which results of executing the high-level logical steps of the plan generation stage are provided to a security team.
13 . The method of claim 1 , wherein the logs are obtained using Machine Learning (ML) models by measuring or testing email systems, cloud systems, Security Information and Event Management (SIEM) systems, Endpoint security tools including Endpoint Detection and Response (EDR) systems, Antivirus systems, device management systems, Network security tools including Network Detection and Response (NDR) systems, firewalls, proxies, virtual private network, web applications, secure service access edge (SASE), code development systems including source code management, continuous integration, and continuous deployment Managed Detection and Response (MDR) systems, Extended Detection and Response (XDR) systems, identity detection systems, and deception detection systems, of the compute domain.
14 . A system comprising:
a processing device, and
memory configured to store a computer program having logical code for investigating security threats in a compute domain being monitored, the computer program including instructions that, when executed, enable the processing device to
receive logs related to security alerts from multiple sources, the security alerts representing potential cyber security threats in a compute domain; and
perform an automated investigation procedure configured to determine whether the logs represent actual cyber security threats, the automated investigation procedure including
a plan generation stage in which high-level logical steps are planned for analyzing the logs and retrieving evidences for proving it either malicious or benign, wherein the plan generation stage an executable investigation playbook comprising an ordered set of evidence-retrieval steps,
a log comprehension stage in which details of the logs are analyzed to obtain observations of the logs for a case, wherein the observations comprise a structured knowledge layer linking events and entities in the logs,
a plan execution stage in which the high-level logical steps of the plan generation stage are executed with respect to the observations of the logs to retrieve evidence specified by the executable investigation playbook,
a reasoning stage to conclude the case as malicious or benign based on the retrieved evidence, and
a re-planning stage to generate a new investigation plan for newly discovered entities or signals of the case or a new case, wherein the newly discovered entities or signals are identified during the plan execution stage and cause regeneration of the executable investigation playbook to include additional evidence-retrieval steps.
15 . The system of claim 14 , wherein the plan generation stage is configured to receive planning assistance from a neural-symbolic AI model including a Large Language Model (LLM), and wherein the plan generation stage is further configured to receive planning assistance from a security expert knowledge, wherein the security expert knowledge is provided by a security team or auto-acquired by
(1) learning from humans' past investigation stored in case management system
(2) learning from past live feedback, or
(3) learning from provided textbooks.
16 . The system of claim 14 , wherein the plan generation stage involves creating and editing a cyber security investigation and response playbook that is executed during the plan execution stage.
17 . The system of claim 14 , wherein the plan execution stage includes executing a variety of different actions.
18 . The system of claim 17 , wherein the variety of different actions include
(1) a step of presenting auto-generated predefined questions to one or more end users regarding the potential cyber security threats,
(2) a step of auto translating an natural language question to database queries or Application Programming Interface (API) calls, or
(3) a step of retrieving answers to investigation questions specified in the plan generation stage using institutional knowledge specific to each company, where the institutional knowledge is via Retrieval Augmented Generation (RAG) in a Large Language Model (LLM).
19 . A non-transitory computer-readable medium configured to store computer logic having instructions that, when executed, cause one or more processing devices to:
receiving logs related to security alerts from multiple sources, the security alerts representing potential cyber security threats in a compute domain; and
performing an automated investigation procedure configured to determine whether the logs represent actual cyber security threats, the automated investigation procedure including
a plan generation stage in which high-level logical steps are planned for analyzing the logs and retrieving evidences for proving it either malicious or benign, wherein the plan generation stage generates an executable investigation playbook comprising an ordered set of evidence-retrieval steps,
a log comprehension stage in which details of the logs are analyzed to obtain observations of the logs for a case, wherein the observations comprise a structured knowledge layer linking events and entities in the logs,
a plan execution stage in which the high-level logical steps of the plan generation stage are executed with respect to the observations of the logs to retrieve evidence specified by the executable investigation playbook,
a reasoning stage to conclude the case as malicious or benign based on the retrieved evidence, and
a re-planning stage to generate a new investigation plan for newly discovered entities or signals of the case or a new case, wherein the newly discovered entities or signals are identified during the plan execution stage and cause regeneration of the executable investigation playbook to include additional evidence-retrieval steps.
20 . The non-transitory computer-readable medium of claim 19 , wherein the logs are obtained using Machine Learning (ML) models by measuring or testing email systems, cloud systems, Security Information and Event Management (SIEM) systems, Endpoint security tools including Endpoint Detection and Response (EDR) systems, Antivirus systems, device management systems, Network security tools including Network Detection and Response (NDR) systems, firewalls, proxies, virtual private network, web applications, secure service access edge (SASE), code development systems including source code management, continuous integration, and continuous deployment Managed Detection and Response (MDR) systems, Extended Detection and Response (XDR) systems, identity detection systems, and deception detection systems, of the compute domain.