Programmatic threat intelligence aggregation and distribution system
A system for enhancing security in networked environments through the aggregation, transformation, and dissemination of security incident data. The system collects data from various sources, including human threat intelligence and machine-readable logs, and transforms this data into a machine-executable data structure. The system stores the transformed data in a threat intelligence data store, making the threat intelligence data store accessible via application programming interface (API) calls. The system includes components that implement large language models (LLMs) to generate security incident summaries and visualizations tailored to specific user roles.
1 . A computer-implemented method comprising:
under control of a computing system comprising memory and one or more computer processors configured to execute specific instructions:
receiving first data in a first format, wherein the first data includes human intelligence from an incident responder regarding a security incident;
receiving second data in a second format, wherein the second data includes machine-readable data extracted from logs of computing devices associated with the security incident;
transforming the first data and the second data into a machine-executable data structure, wherein the machine-executable data structure is formatted for input into models and for access by a network-accessible service via an application programming interface (API);
storing the machine-executable data structure in a threat intelligence data store;
causing a first model to generate security incident summary documentation of the security incident from the machine-executable data structure; and
causing a second model to generate visualizations from the machine-executable data structure corresponding to the security incident.
2 . The computer-implemented method of claim 1 , wherein transforming the first data and the second data to a machine-executable data structure further comprises transforming, by a computing device implementing a third model, the first data and the second data to the machine-executable data structure.
3 . The computer-implemented method of claim 2 , further comprising generating, by the third model, recommendation alerts associated with the security incident, wherein the recommendation alerts are generated in association with the security incident.
4 . The computer-implemented method of claim 1 , further comprising:
comparing data from the security incident summary documentation and the visualizations to personal identifiable information stored in the threat intelligence data store; and
when personally identifiable information is present, removing personally identifiable information from the security incident summary documentation.
5 . The computer-implemented method of claim 1 , wherein the machine-executable data structure is in a JavaScript Object Notation (JSON) format.
6 . The computer-implemented method of claim 1 , wherein when retrieved by the network-accessible service via an API call, the machine-executable data structure is executable by the network-accessible service to mitigate security vulnerabilities.
7 . The computer-implemented method of claim 1 , wherein when retrieved by the network-accessible service via an API call, the machine-executable data structure is executable by the network-accessible service to identify security vulnerabilities.
8 . The computer-implemented method of claim 1 , further comprising causing execution of the machine-executable data structure to present one or more of threat actor tactics and techniques, a region of unauthorized events, session credentials associated with the security incident, unauthorized activity by user identity type, multi-factor authentication enablement by user identity type, or occurrence of initial access identifiers.
9 . One or more non-transitory computer-readable media comprising computer-executable instructions that, when executed by a computing system, cause the computing system to:
receive first data in a first format, wherein the first data includes human intelligence from an incident responder regarding a security incident;
receive second data in a second format, wherein the second data includes machine-readable data extracted from logs of computing devices associated with the security incident;
transform the first data and the second data to a machine-executable data structure;
cause a first model to generate security incident summary documentation of the security incident from the machine-executable data structure; and
cause a second model to generate visualizations from the machine-executable data structure corresponding to the security incident.
10 . The one or more non-transitory computer-readable media of claim 9 , wherein transforming the first data and the second data to a machine-executable data structure is performed by a computing device implementing a third model.
11 . The one or more non-transitory computer-readable media of claim 10 , further comprising generating, by the computing device implementing the third model, recommendation alerts associated with the security incident, wherein the recommendation alerts are generated in association with the security incident.
12 . The one or more non-transitory computer-readable media of claim 9 , further comprising:
comparing data from the security incident summary documentation and the visualizations to personal identifiable information stored in a threat intelligence data store; and
when personally identifiable information is present, removing personally identifiable information from the security incident summary documentation.
13 . The one or more non-transitory computer-readable media of claim 9 , wherein the machine-executable data structure is in a JavaScript Object Notation (JSON) format.
14 . The one or more non-transitory computer-readable media of claim 9 , wherein when retrieved by a network-accessible service via an application programming interface (API) call, the machine-executable data structure is executable by the network-accessible service to mitigate security vulnerabilities.
15 . The one or more non-transitory computer-readable media of claim 9 , wherein when retrieved by a network-accessible service via an API call, the machine-executable data structure is executable by the network-accessible service to identify security vulnerabilities.
16 . The one or more non-transitory computer-readable media of claim 9 , further comprising causing execution of the machine-executable data structure to present one or more of threat actor tactics and techniques, a region of unauthorized events, session credentials associated with the security incident, unauthorized activity by user identity type, multi-factor authentication enablement by user identity type, or occurrence of initial access identifiers.
17 . A system comprising:
a data transformation system, comprising a processor and memory, wherein the memory comprises executable instructions that, when executed by the processor, cause the processor to:
receive first data in a first format, wherein the first data includes human intelligence from an incident responder regarding a security incident;
receive second data in a second format, wherein the second data includes machine-readable data extracted from logs of computing devices associated with the security incident;
transform the first data and the second data into a machine-executable data structure, wherein the machine-executable data structure is formatted for input large language models (LLMs) and for access by a network-accessible service via an application programming interface (API); and
store the machine-executable data structure in a threat intelligence data store, wherein when retrieved by the network-accessible service via an API call, the machine-executable data structure is executable by the network-accessible service to mitigate security vulnerabilities;
a first computing device implementing a first LLM, wherein the first LLM comprises an instance of an incident documentation model to send one or more output of the incident documentation model to the data transformation system, the first LLM configured to:
obtain the machine-executable data structure from the threat intelligence data store; and
generate security incident summary documentation of the security incident from the machine-executable data structure; and
a second computing device implementing a second LLM, wherein the second LLM comprises an incident visualization model to send one or more output of the incident visualization model to the data transformation system, the second LLM configured to:
obtain the machine-executable data structure from the threat intelligence data store; and
generate visualizations from the machine-executable data structure corresponding to the security incident that is specific to a particular user status identifier, wherein the visualizations adjust according to the user status identifier.
18 . The system of claim 17 , wherein executable instructions, when executed, further cause the processor to execute a third LLM, wherein the third LLM comprises a data transformation model to send one or more output of the data transformation model to the threat intelligence data store, the third LLM configured to transform the first data and the second data to the machine-executable data structure.
19 . The system of claim 18 , wherein the third LLM is further configured to generate recommendation alerts associated with the security incident, wherein the recommendation alerts are generated in association with the security incident.
20 . The system of claim 17 , wherein the executable instructions, when executed, further cause the processor to:
compare data from the security incident summary documentation and the visualizations to personal identifiable information stored in the threat intelligence data store; and
when the data transformation system determines personally identifiable information is present, remove personally identifiable information from the security incident summary documentation.