Threat mitigation system and method
A computer-implemented method, computer program product and computing system for deploying an agent to proactively monitor activity within a computing platform and generate an initial notification if a security event is detected; receiving the initial notification of the security event from the agent, wherein the initial notification includes a computer-readable language portion that defines one or more specifics of the security event; and iteratively processing the initial notification using a generative AI model and a formatting script to produce a summarized human-readable report for the initial notification.
1 . A computer-implemented method executed on a computing device comprising:
deploying an agent to proactively monitor activity within a computing platform and generate an initial notification if a security event is detected, including training the agent based upon, at least in part, supplemental information obtained from technical bulletins released by one or more of software houses, antivirus providers, and hardware manufacturers;
receiving the initial notification of the security event from the agent, wherein the initial notification includes a computer-readable language portion that defines one or more specifics of the security event;
iteratively processing the initial notification using a generative AI model and a formatting script and one or more tools to produce a summarized human-readable report for the initial notification, wherein the one or more tools include an identification tool to identify an owner of a domain associated with the initial notification;
prompting a user to provide feedback concerning the summarized human-readable report; and
utilizing the feedback to revise the formatting script.
2 . The computer-implemented method of claim 1 wherein the computing platform includes a plurality of security-relevant subsystems.
3 . The computer-implemented method of claim 1 wherein deploying an agent to proactively monitor activity within a computing platform and generate an initial notification if a security event is detected includes;
deploying the agent to proactively monitor activity within one or more of the security-relevant subsystems of the computing platform and generate the initial notification if the security event is detected.
4 . The computer-implemented method of claim 1 wherein the one or more tools further includes one or more of:
a decompression tool to decompress a compressed initial notification; and
a decoding tool to decode an encoded initial notification.
5 . The computer-implemented method of claim 1 wherein iteratively processing the initial notification using a generative AI model and a formatting script to produce a summarized human-readable report for the initial notification includes:
iteratively processing the initial notification using a large language model.
6 . The computer-implemented method of claim 1 wherein iteratively processing the initial notification using a generative AI model and a formatting script to produce a summarized human-readable report for the initial notification includes:
utilizing prompt engineering to produce the summarized human-readable report for the initial notification.
7 . The computer-implemented method of claim 1 wherein iteratively processing the initial notification using a generative AI model and a formatting script to produce a summarized human-readable report for the initial notification includes:
utilizing several loops and/or nested loops to produce the summarized human-readable report for the initial notification.
8 . The computer-implemented method of claim 1 wherein the summarized human-readable report defines recommended next steps and/or disclaimers.
9 . The computer-implemented method of claim 1 further comprising:
training the agent to proactively monitor activity within a computing platform and generate an initial notification if a security event is detected based, at least in part, upon best practices defined via artificial intelligence.
10 . A computer program product residing on a non-transitory computer readable storage medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:
deploying an agent to proactively monitor activity within a computing platform and generate an initial notification if a security event is detected, including training the agent based upon, at least in part, supplemental information obtained from technical bulletins released by one or more of software houses, antivirus providers, and hardware manufacturers;
receiving the initial notification of the security event from the agent, wherein the initial notification includes a computer-readable language portion that defines one or more specifics of the security event;
iteratively processing the initial notification using a generative AI model and a formatting script and one or more tools to produce a summarized human-readable report for the initial notification, wherein the one or more tools include an identification tool to identify an owner of a domain associated with the initial notification;
prompting a user to provide feedback concerning the summarized human-readable report; and
utilizing the feedback to revise the formatting script.
11 . The computer program product of claim 10 wherein the computing platform includes a plurality of security-relevant subsystems.
12 . The computer program product of claim 10 wherein deploying an agent to proactively monitor activity within a computing platform and generate an initial notification if a security event is detected includes;
deploying the agent to proactively monitor activity within one or more of the security-relevant subsystems of the computing platform and generate the initial notification if the security event is detected.
13 . The computer program product of claim 10 wherein the one or more tools further includes one or more of:
a decompression tool to decompress a compressed initial notification; and
a decoding tool to decode an encoded initial notification.
14 . The computer program product of claim 10 wherein iteratively processing the initial notification using a generative AI model and a formatting script to produce a summarized human-readable report for the initial notification includes:
iteratively processing the initial notification using a large language model.
15 . The computer program product of claim 10 wherein iteratively processing the initial notification using a generative AI model and a formatting script to produce a summarized human-readable report for the initial notification includes:
utilizing prompt engineering to produce the summarized human-readable report for the initial notification.
16 . The computer program product of claim 10 wherein iteratively processing the initial notification using a generative AI model and a formatting script to produce a summarized human-readable report for the initial notification includes:
utilizing several loops and/or nested loops to produce the summarized human-readable report for the initial notification.
17 . The computer program product of claim 10 wherein the summarized human-readable report defines recommended next steps and/or disclaimers.
18 . The computer program product of claim 10 further comprising:
training the agent to proactively monitor activity within a computing platform and generate an initial notification if a security event is detected based, at least in part, upon best practices defined via artificial intelligence.
19 . A computing system including a processor and memory configured to perform operations comprising:
deploying an agent to proactively monitor activity within a computing platform and generate an initial notification if a security event is detected, including training the agent based upon, at least in part, supplemental information obtained from technical bulletins released by one or more of software houses, antivirus providers, and hardware manufacturers;
receiving the initial notification of the security event from the agent, wherein the initial notification includes a computer-readable language portion that defines one or more specifics of the security event;
iteratively processing the initial notification using a generative AI model and a formatting script and one or more tools to produce a summarized human-readable report for the initial notification, wherein the one or more tools include an identification tool to identify an owner of a domain associated with the initial notification;
prompting a user to provide feedback concerning the summarized human-readable report; and
utilizing the feedback to revise the formatting script.
20 . The computing system of claim 19 wherein the computing platform includes a plurality of security-relevant subsystems.
21 . The computing system of claim 19 wherein deploying an agent to proactively monitor activity within a computing platform and generate an initial notification if a security event is detected includes;
deploying the agent to proactively monitor activity within one or more of the security-relevant subsystems of the computing platform and generate the initial notification if the security event is detected.
22 . The computing system of claim 19 wherein the one or more tools further includes one or more of:
a decompression tool to decompress a compressed initial notification; and
a decoding tool to decode an encoded initial notification.
23 . The computing system of claim 19 wherein iteratively processing the initial notification using a generative AI model and a formatting script to produce a summarized human-readable report for the initial notification includes:
iteratively processing the initial notification using a large language model.
24 . The computing system of claim 19 wherein iteratively processing the initial notification using a generative AI model and a formatting script to produce a summarized human-readable report for the initial notification includes:
utilizing prompt engineering to produce the summarized human-readable report for the initial notification.
25 . The computing system of claim 19 wherein iteratively processing the initial notification using a generative AI model and a formatting script to produce a summarized human-readable report for the initial notification includes:
utilizing several loops and/or nested loops to produce the summarized human-readable report for the initial notification.
26 . The computing system of claim 19 wherein the summarized human-readable report defines recommended next steps and/or disclaimers.
27 . The computing system of claim 19 further comprising:
training the agent to proactively monitor activity within a computing platform and generate an initial notification if a security event is detected based, at least in part, upon best practices defined via artificial intelligence.