Granted Patent B2

US 12,204,652 · App. 17/735,448 · Granted Jan 21, 2025

Inventors: Brian P. Murphy (Tampa, FL); Joe Partlow (Tampa, FL); Colin O'Connor (Tampa, FL); Jason Pfeiffer (Tampa, FL)

Assignee: RELIAQUEST HOLDINGS, LLC

G06F21/577G06F8/65G06F18/20G06F18/214G06F21/53G06F21/55G06F21/554G06F21/56G06F21/561G06F21/562G06F21/566G06F21/568G06F30/20G06N20/00H04L63/0227H04L63/0263H04L63/1416H04L63/1425H04L63/1433H04L63/1441H04L63/145H04L63/164H04L63/20G06F2221/034G06F2221/2115

Abstract

Claims (60)

1. A computer-implemented method, executed on a computing device, comprising:

obtaining one or more artifacts concerning a detected security event from a plurality of security-relevant subsystems within a computing platform;

obtaining artifact information concerning the one or more artifacts;

generating a conclusion concerning the detected security event based, at least in part, upon the detected security event, the one or more artifacts, and the artifact information;

executing a remedial action plan based upon, at least in part, the conclusion, wherein executing the remedial action plan includes:

determining that a threat level associated with the detected security event is low, and permitting a suspect activity associated with the security event to continue;

determining that a threat level associated with the detected security event is moderate, and generating a security event report based, at least in part, upon the one or more artifacts concerning the security event, and providing the security event report to a third party for review; and

determining that a threat level associated with the detected security event is high, and executing a threat mitigation plan including one or more of shutting down a stream of content associated with the security event and closing a port of a computing device associated with the security event; and

allowing a third party to manually search through the one or more artifacts within the computing platform, using a single search operation including:

parsing a unified query to provide a plurality of security-relevant subsystem specific queries to the plurality of security-relevant subsystems; and

effectuating at least a portion of the plurality of security-relevant subsystem specific queries on respective security-relevant subsystems of the plurality of security-relevant subsystems.

2. The computer-implemented method of claim 1 further comprising:

documenting the conclusion.

3. The computer-implemented method of claim 1 further comprising:

reporting the conclusion to a third-party.

4. The computer-implemented method of claim 1 further comprising:

obtaining supplemental artifacts and artifact information when needed.

5. The computer-implemented method of claim 1 wherein obtaining artifact information concerning the one or more artifacts includes:

obtaining artifact information concerning the one or more artifacts from one or more investigation resources.

6. The computer-implemented method of claim 1 wherein the detected security event includes one or more of: access auditing; anomalies; authentication; denial of services; exploitation; malware; phishing; spamming; reconnaissance; and web attack.

7. A computer program product residing on a non-transitory computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:

obtaining one or more artifacts concerning a detected security event from a plurality of security-relevant subsystems within a computing platform;

obtaining artifact information concerning the one or more artifacts;

generating a conclusion concerning the detected security event based, at least in part, upon the detected security event, the one or more artifacts, and the artifact information;

executing a remedial action plan based upon, at least in part, the conclusion, wherein executing the remedial action plan includes:

determining that a threat level associated with the detected security event is low, and permitting a suspect activity associated with the security event to continue;

determining that a threat level associated with the detected security event is moderate, and generating a security event report based, at least in part, upon the one or more artifacts concerning the security event, and providing the security event report to a third party for review; and

determining that a threat level associated with the detected security event is high, and executing a threat mitigation plan including one or more of shutting down a stream of content associated with the security event and closing a port of a computing device associated with the security event; and

allowing a third party to manually search through the one or more artifacts within the computing platform, using a single search operation including:

parsing a unified query to provide a plurality of security-relevant subsystem specific queries to the plurality of security-relevant subsystems; and

effectuating at least a portion of the plurality of security-relevant subsystem specific queries on respective security-relevant subsystems of the plurality of security-relevant subsystems.

8. The computer program product of claim 7 further comprising:

documenting the conclusion.

9. The computer program product of claim 7 further comprising:

reporting the conclusion to a third-party.

10. The computer program product of claim 7 further comprising:

obtaining supplemental artifacts and artifact information when needed.

11. The computer program product of claim 7 wherein obtaining artifact information concerning the one or more artifacts includes:

obtaining artifact information concerning the one or more artifacts from one or more investigation resources.

12. The computer program product of claim 7 wherein the detected security event includes one or more of: access auditing; anomalies; authentication; denial of services; exploitation; malware; phishing; spamming; reconnaissance; and web attack.

13. A computing system including a processor and memory configured to perform operations comprising:

obtaining one or more artifacts concerning a detected security event from a plurality of security-relevant subsystems within a computing platform;

obtaining artifact information concerning the one or more artifacts;

generating a conclusion concerning the detected security event based, at least in part, upon the detected security event, the one or more artifacts, and the artifact information;

executing a remedial action plan based upon, at least in part, the conclusion, wherein executing the remedial action plan includes:

determining that a threat level associated with the detected security event is low, and permitting a suspect activity associated with the security event to continue;

determining that a threat level associated with the detected security event is moderate, and generating a security event report based, at least in part, upon the one or more artifacts concerning the security event, and providing the security event report to a third party for review; and

determining that a threat level associated with the detected security event is high, and executing a threat mitigation plan including one or more of shutting down a stream of content associated with the security event and closing a port of a computing device associated with the security event; and

allowing a third party to manually search through the one or more artifacts within the computing platform, using a single search operation including:

parsing a unified query to provide a plurality of security-relevant subsystem specific queries to the plurality of security-relevant subsystems; and

effectuating at least a portion of the plurality of security-relevant subsystem specific queries on respective security-relevant subsystems of the plurality of security-relevant subsystems.

14. The computing system of claim 13 further comprising:

documenting the conclusion.

15. The computing system of claim 13 further comprising:

reporting the conclusion to a third-party.

16. The computing system of claim 13 further comprising:

obtaining supplemental artifacts and artifact information when needed.

17. The computing system of claim 13 wherein obtaining artifact information concerning the one or more artifacts includes:

obtaining artifact information concerning the one or more artifacts from one or more investigation resources.

18. The computing system of claim 13 wherein the detected security event includes one or more of: access auditing; anomalies; authentication; denial of services; exploitation; malware; phishing; spamming; reconnaissance; and web attack.

Assignments (3)

Continuity (5)

References Cited (400)