Systems and methods for managing cybersecurity alerts
A system and method for setting alert thresholds related to cybersecurity ratings of one or more affiliate entities. An example method includes: obtaining entity data including cybersecurity event data for an affiliate entity; calculating a time-series cybersecurity rating for the affiliate entity based on the entity data; associating an alert reporting threshold with the time-series cybersecurity rating, wherein a comparison of the alert reporting threshold to the time-series cybersecurity rating determines a number of alerts reported for the affiliate entity; applying an alternative alert reporting threshold against the time-series cybersecurity rating to determine an alternative number of alerts reported for the affiliate entity; and updating the alert reporting threshold for the time-series cybersecurity rating to the alternative alert reporting threshold.
1. A computer-implemented method of setting alert thresholds related to cybersecurity ratings of one or more affiliate entities, the method comprising:
obtaining entity data comprising a plurality of entity data sets, each entity data set associated with a respective affiliate entity from a plurality of affiliate entities and comprising cybersecurity event data associated with each respective affiliate entity;
calculating a time-series cybersecurity rating for one or more of the affiliate entities based on the respective entity data set;
associating an alert reporting threshold with the time-series cybersecurity rating,
wherein a comparison of the alert reporting threshold to the time-series cybersecurity rating determines a number of alerts reported for the one or more affiliate entities;
applying an alternative alert reporting threshold against the time-series cybersecurity rating to determine an alternative number of alerts reported for the one or more affiliate entities; and
updating the alert reporting threshold for the time-series cybersecurity rating to the alternative alert reporting threshold.
2. The method of claim 1 , wherein the plurality of affiliate entities comprises affiliates of an intended recipient of the alerts.
3. The method of claim 1 , wherein the time-series cybersecurity rating comprises a history of cybersecurity ratings during a previous time period.
4. The method of claim 1 , wherein the alert reporting threshold comprises a threshold cybersecurity rating.
5. The method of claim 1 , wherein the alert reporting threshold comprises a threshold rate of change in the time-series cybersecurity rating.
6. The method of claim 1 , wherein alerts are generated periodically while the time-series cybersecurity rating is either above or below the alert reporting threshold.
7. The method of claim 1 , wherein applying an alternative alert reporting threshold comprises iterating on the alert reporting threshold to achieve a desired number of alerts reported for the one or more affiliate entities during a previous time period.
8. The method of claim 7 , wherein iterating on the alert reporting threshold comprises receiving a user-specified desired number of alerts.
9. The method of claim 1 , wherein applying an alternative alert reporting threshold comprises iterating on the alert reporting threshold until a desired number of affiliate entities from the one or more affiliate entities trigger alerts during a previous time period.
10. The method of claim 1 , further comprising sending alerts to an intended recipient during a future time period using the updated alert reporting threshold.
11. A system comprising:
one or more computer systems programmed to perform operations comprising:
obtaining entity data comprising a plurality of entity data sets, each entity data set associated with a respective affiliate entity from a plurality of affiliate entities and comprising cybersecurity event data associated with each respective affiliate entity;
calculating a time-series cybersecurity rating for one or more of the affiliate entities based on the respective entity data set;
associating an alert reporting threshold with the time-series cybersecurity rating,
wherein a comparison of the alert reporting threshold to the time-series cybersecurity rating determines a number of alerts reported for the one or more affiliate entities;
applying an alternative alert reporting threshold against the time-series cybersecurity rating to determine an alternative number of alerts reported for the one or more affiliate entities; and
updating the alert reporting threshold for the time-series cybersecurity rating to the alternative alert reporting threshold.
12. The system of claim 11 , wherein the plurality of affiliate entities comprises affiliates of an intended recipient of the alerts.
13. The system of claim 11 , wherein the alert reporting threshold comprises a threshold cybersecurity rating.
14. The system of claim 11 , wherein the alert reporting threshold comprises a threshold rate of change in the time-series cybersecurity rating.
15. The system of claim 11 , wherein alerts are generated periodically while the time-series cybersecurity rating is either above or below the alert reporting threshold.
16. The system of claim 11 , wherein applying an alternative alert reporting threshold comprises iterating on the alert reporting threshold to achieve a desired number of alerts reported for the one or more affiliate entities during a previous time period.
17. The system of claim 16 , wherein iterating on the alert reporting threshold comprises receiving a user-specified desired number of alerts.
18. The system of claim 11 , wherein applying an alternative alert reporting threshold comprises iterating on the alert reporting threshold until a desired number of affiliate entities from the one or more affiliate entities trigger alerts during a previous time period.
19. The system of claim 11 , the operations comprising sending alerts to an intended recipient during a future time period using the updated alert reporting threshold.
20. A non-transitory computer-readable medium having instructions stored thereon that, when executed by one or more computer processors, cause the one or more computer processors to perform operations comprising:
obtaining entity data comprising a plurality of entity data sets, each entity data set associated with a respective affiliate entity from a plurality of affiliate entities and comprising cybersecurity event data associated with each respective affiliate entity;
calculating a time-series cybersecurity rating for one or more of the affiliate entities based on the respective entity data set;
associating an alert reporting threshold with the time-series cybersecurity rating,
wherein a comparison of the alert reporting threshold to the time-series cybersecurity rating determines a number of alerts reported for the one or more affiliate entities;
applying an alternative alert reporting threshold against the time-series cybersecurity rating to determine an alternative number of alerts reported for the one or more affiliate entities; and
updating the alert reporting threshold for the time-series cybersecurity rating to the alternative alert reporting threshold.