Granted Patent B2

US 12,652,310 · App. 18/231,715 · Granted Jun 9, 2026

Inventors: Sourabh Satish (Fremont, CA); Oliver Friedrichs (Woodside, CA); Atif Mahadik (Fremont, CA); Govind Salinas (Sunnyvale, CA)

Assignee: Cisco Technology, Inc.

H04L63/1441G06F16/285G06F21/554H04L63/0236H04L63/1416H04L63/1425H04L63/1433H04L63/20H04L47/2425

Abstract

Claims (38)

1 . A computer-implemented method comprising:

receiving data indicating an occurrence of a security incident involving a computing asset of a computing environment;

obtaining enrichment information associated with the security incident from one or more internal or external sources;

determining, consequent to receiving the data indicating the occurrence of the security incident, a related process related to the security incident requires access to an application that is executing on the computing asset;

identifying, based on the enrichment information and the related process, a rule set for the security incident;

determining, based on the rule set, one or more action suggestions to respond to the security incident; and

providing the one or more action suggestions to an administration system.

2 . The method of claim 1 , wherein the determining the related process comprises analyzing information about processes or applications that are currently executing in the computing environment and that are associated with or require access to the application implicated in the security incident.

3 . The method of claim 1 , wherein at least one of the one or more action suggestions allows the related process to continue to access the application.

4 . The method of claim 1 , wherein the one or more action suggestions include taking a snapshot of the application, taking a snapshot of the computing asset, limiting a type of data that may be communicated by the computing asset, or preventing the application from initiating communications with external systems and processes.

5 . The method of claim 1 , further comprising determining that the security incident is related to communications with a particular IP address.

6 . The method of claim 5 , wherein obtaining enrichment information associated with the security incident from one or more internal or external sources comprises querying a database to determine whether the particular IP address is related to malicious activity.

7 . An apparatus comprising:

one or more non-transitory computer-readable storage media;

a processing system operatively coupled to the one or more non-transitory computer-readable storage media; and

computer-readable instructions stored on the one or more non-transitory computer-readable storage media that, when executed by the processing system, direct the processing system to perform operations comprising:

receiving data indicating an occurrence of a security incident involving a computing asset of a computing environment;

obtaining enrichment information associated with the security incident from one or more internal or external sources;

determining, consequent to receiving the data indicating the occurrence of the security incident, a related process related to the security incident requires access to an application that is executing on the computing asset;

identifying, based on the enrichment information and the related process, a rule set for the security incident;

determining, based on the rule set, one or more action suggestions to respond to the security incident; and

providing the one or more action suggestions to an administration system.

8 . The apparatus of claim 7 , wherein the determining the related process comprises analyzing information about processes or applications that are currently executing in the computing environment and that are associated with or require access to the application implicated in the security incident.

9 . The apparatus of claim 7 , wherein at least one of the one or more action suggestions allows the related process to continue to access the application.

10 . The apparatus of claim 7 , wherein the one or more action suggestions include taking a snapshot of the application, taking a snapshot of the computing asset, limiting a type of data that may be communicated by the computing asset, or preventing the application from initiating communications with external systems and processes.

11 . The apparatus of claim 7 , wherein the computer-readable instructions comprise further computer-readable instructions stored on the one or more non-transitory computer-readable storage media that, when executed by the processing system, further direct the processing system to determine that the security incident is related to communications with a particular IP address.

12 . The apparatus of claim 11 , wherein obtaining enrichment information associated with the security incident from one or more internal or external sources comprises querying a database to determine whether the particular IP address is related to malicious activity.

13 . A non-transitory, computer-readable storage medium storing instructions that, when executed by one or more processors, cause performance of operations comprising:

receiving data indicating an occurrence of a security incident involving a computing asset of a computing environment;

obtaining enrichment information associated with the security incident from one or more internal or external sources;

determining, consequent to receiving the data indicating the occurrence of the security incident, a related process related to the security incident requires access to an application that is executing on the computing asset;

identifying, based on the enrichment information and the related process, a rule set for the security incident;

determining, based on the rule set, one or more action suggestions to respond to the security incident; and

providing the one or more action suggestions to an administration system.

14 . The non-transitory, computer-readable storage medium of claim 13 , wherein the determining the related process comprises analyzing information about processes or applications that are currently executing in the computing environment and that are associated with or require access to the application implicated in the security incident.

15 . The non-transitory, computer-readable storage medium of claim 13 , wherein at least one of the one or more action suggestions allows the related process to continue to access the application.

16 . The non-transitory, computer-readable storage medium of claim 13 , wherein the one or more action suggestions include taking a snapshot of the application, taking a snapshot of the computing asset, limiting a type of data that may be communicated by the computing asset, or preventing the application from initiating communications with external systems and processes.

17 . The non-transitory, computer-readable storage medium of claim 13 , wherein the operations further comprise determining that the security incident is related to communications with a particular IP address.

Assignments (4)

Continuity (8)

References Cited (277)