Automated system for triage of customer issues
A device for verifying previous determinations from cybersecurity devices comprising a processor and a storage device communicatively coupled to the processor. The storage device comprises submission analysis logic including object parsing logic to receive submission message data and then parse the submission message data into object data, along with workflow selector logic to receive the object data and process the object data to select at least one analyzer within analyzer logic. The analyzer logic can generate at least one analyzer based on the selected analyzer within the workflow selector logic, analyze the object data for potential threats and embedded object data, generate results data based on that analysis, and pass the embedded object data back to the workflow selector for further analysis. Finally, the submission analysis logic comprises triage ticket generation logic to generate triage tickets for analyst review and alert logic to generate automatic alerts.
1. An electronic device for automated triaging of cybersecurity threats, the electronic device comprising:
a processor; and
a non-transitory storage medium communicatively coupled to the processor, the non-transitory storage medium comprises submission analysis logic configured to receive and process a submission message from a submitter and triage the submission message data associated with the submission message by utilizing:
an object parsing logic configured to receive the submission message data and parse the submission message data into object data and context data;
a workflow selector logic configured to receive object data and process the object data to select at least one analyzer;
an analyzer logic configured to (i) utilize at least one analyzer based on the selected analyzer within the workflow selector logic, (ii) analyze the object data for maliciousness, and (iii) generate results data;
a correlation logic configured to receive the results data and generate score data based on the received results data; and
a triage ticket generation logic configured to receive the score data and generate triage data, wherein, in response to the triage data surpassing a pre-determined threshold, a triage ticket is generated.
2. The electronic device of claim 1 , wherein the workflow selector logic is configured to select the at least one analyzer within the analyzer logic in response to both the object data and the context data.
3. The electronic device of claim 1 , wherein the workflow selector logic is further configured to receive the object data and the context data.
4. The electronic device of claim 1 , wherein the correlation logic further receives results data and the context data and wherein the score data is generated in response to both the results data and the context data.
5. The electronic device of claim 1 , wherein the at least one analyzer, generated by the analyzer logic, emulates at least one computing environment with a plurality of computing environment settings.
6. The electronic device of claim 1 , wherein the at least one analyzer, generated by the analyzer logic, emulates at least one software program with a specified software version with a plurality of software settings.
7. The electronic device of claim 6 , wherein the context data comprises data relating to at least one of: computing environment, software version, software settings, computing environment settings, prior threat analysis methods, and prior threat analysis results.
8. The electronic device of claim 7 , wherein the selection of the at least one analyzer by the workflow selector logic comprises selecting an analyzer with different computing environment settings than the computer environment settings in the context data.
9. The electronic device of claim 7 , wherein the selection of the at least one analyzer by the workflow selector logic comprises selecting an analyzer with different software settings than the software settings in the context data.
10. The electronic device of claim 1 , wherein the submission analysis logic further comprises an alert logic, being processed by the processor, to receive the triage data and, in response to surpassing a pre-determined threshold, automatically generate at least one alert to the submitter.
11. The electronic device of claim 1 , wherein the analyzer logic utilizes at least one pre-generated analyzer.
12. The electronic device of claim 1 , wherein the analyzer logic further comprises passing embedded object data to the workflow selector for further analysis.
13. A method for automated triaging of cybersecurity threats, the method comprising:
parsing data associated with a received submission message into object data and context data;
generating at least one analyzer based, at least in part, on the parsed object data;
analyzing the object data within at least one analyzer for potential threats;
generating results data based on the analyzed object data;
generating score data based on the results data;
generating triage data based on the score data;
generating a triage report in response to the triage data surpassing a first pre-determined threshold; and
generating an alert to a submitter based on the triage data surpassing a second pre-determined threshold.
14. The method of claim 13 , wherein the alert is generated automatically in response to the triage data not surpassing the first pre-determined threshold.
15. The method of claim 13 , wherein the selecting of at least one analyzer is further based on the parsed context data.
16. The method of claim 13 , wherein the generating of the score data is further based on the parsed context data.
17. The method of claim 13 , wherein the at least one analyzer emulates at least one computing environment with a plurality of computing environment settings.
18. The method of claim 13 , wherein the at least one analyzer emulates at least one software program with a specified software version with a plurality of software settings.
19. The method of claim 18 , wherein the context data comprises data relating to at least one of: computing environment, software version, software settings, computing environment settings, prior threat analysis methods, and prior threat analysis results.
20. The method of claim 19 , wherein the selecting of the at least one analyzer comprises selecting an analyzer with different software settings than the software settings in the context data.
21. The method of claim 13 further comprising:
analyzing the object data within the at least one analyzer for embedded object data;
selecting an analyzer for the embedded object data; and
analyzing the embedded object data.