Threat mitigation system and method
A computer-implemented method, computer program product and computing system for establishing connectivity with a plurality of security-relevant subsystems within a computing platform; receiving an initial notification of a security event from one of the security-relevant subsystems, wherein the initial notification includes a computer-readable language portion that defines one or more specifics of the security event; processing the initial notification using a generative AI model and a formatting script to define one or more recommended actions; automatically generating a playbook to effectuate at least one of the recommended actions; and processing the playbook to address at least a portion of the security event.
1. A computer-implemented method executed on a computing device comprising:
establishing connectivity with a plurality of security-relevant subsystems within a computing platform;
receiving an initial notification of a security event from one of the security-relevant subsystems, wherein the initial notification includes a computer-readable language portion that defines one or more specifics of the security event;
processing the initial notification using a generative AI model and a formatting script and one or more tools to define one or more recommended actions, wherein the formatting script is configured to:
preprocess user inputs for the generative AI model;
format model prompts for the generative AI model;
post process model outputs from the generative AI model; and
handle special formatting of outputs from the generative AI model; and
wherein the one or more tools includes one or more of a decompression tool to decompress a compressed initial notification and an identification tool to identify an owner of a domain associated with the initial notification;
automatically generating a playbook to effectuate at least one of the recommended actions; and
processing the playbook to address at least a portion of the security event.
2. The computer-implemented method of claim 1 wherein receiving an initial notification of a security event from one of the security-relevant subsystems includes:
receiving the initial notification of the security event from an agent executed on one of the security-relevant subsystems.
3. The computer-implemented method of claim 1 wherein the one or more tools includes:
a decoding tool to decode an encoded initial notification.
4. The computer-implemented method of claim 1 wherein processing the initial notification using a generative AI model and a formatting script to define one or more recommended actions includes:
processing the initial notification using a large language model.
5. The computer-implemented method of claim 1 wherein processing the initial notification using a generative AI model and a formatting script to define one or more recommended actions includes:
utilizing prompt engineering to define one or more recommended actions for the initial notification.
6. The computer-implemented method of claim 1 wherein processing the initial notification using a generative AI model and a formatting script to define one or more recommended actions includes:
utilizing several loops and/or nested loops to define one or more recommended actions for the initial notification.
7. The computer-implemented method of claim 1 wherein automatically generating a playbook to effectuate at least one of the recommended actions includes:
automatically generating a playbook based, at least in part, upon best practices defined via artificial intelligence.
8. The computer-implemented method of claim 1 wherein the playbook defines a set of procedures and/or guidelines configured to at least partially address the security event.
9. The computer-implemented method of claim 8 wherein processing the playbook to address at least a portion of the security event includes:
performing the set of procedures and/or guidelines defined within the playbook.
10. A computer program product residing on a non-transitory computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:
establishing connectivity with a plurality of security-relevant subsystems within a computing platform;
receiving an initial notification of a security event from one of the security-relevant subsystems, wherein the initial notification includes a computer-readable language portion that defines one or more specifics of the security event;
processing the initial notification using a generative AI model and a formatting script and one or more tools to define one or more recommended actions, wherein the formatting script is configured to:
preprocess user inputs for the generative AI model;
format model prompts for the generative AI model;
post process model outputs from the generative AI model; and
handle special formatting of outputs from the generative AI model; and
wherein the one or more tools includes one or more of a decompression tool to decompress a compressed initial notification and an identification tool to identify an owner of a domain associated with the initial notification;
automatically generating a playbook to effectuate at least one of the recommended actions; and
processing the playbook to address at least a portion of the security event.
11. The computer program product of claim 10 wherein receiving an initial notification of a security event from one of the security-relevant subsystems includes:
receiving the initial notification of the security event from an agent executed on one of the security-relevant subsystems.
12. The computer program product of claim 10 wherein the one or more tools includes:
a decoding tool to decode an encoded initial notification.
13. The computer program product of claim 10 wherein processing the initial notification using a generative AI model and a formatting script to define one or more recommended actions includes:
processing the initial notification using a large language model.
14. The computer program product of claim 10 wherein processing the initial notification using a generative AI model and a formatting script to define one or more recommended actions includes:
utilizing prompt engineering to define one or more recommended actions for the initial notification.
15. The computer program product of claim 10 wherein processing the initial notification using a generative AI model and a formatting script to define one or more recommended actions includes:
utilizing several loops and/or nested loops to define one or more recommended actions for the initial notification.
16. The computer program product of claim 10 wherein automatically generating a playbook to effectuate at least one of the recommended actions includes:
automatically generating a playbook based, at least in part, upon best practices defined via artificial intelligence.
17. The computer program product of claim 10 wherein the playbook defines a set of procedures and/or guidelines configured to at least partially address the security event.
18. The computer program product of claim 17 wherein processing the playbook to address at least a portion of the security event includes:
performing the set of procedures and/or guidelines defined within the playbook.
19. A computing system including a processor and memory configured to perform operations comprising:
establishing connectivity with a plurality of security-relevant subsystems within a computing platform;
receiving an initial notification of a security event from one of the security-relevant subsystems, wherein the initial notification includes a computer-readable language portion that defines one or more specifics of the security event;
processing the initial notification using a generative AI model and a formatting script and one or more tools to define one or more recommended actions, wherein the formatting script is configured to:
preprocess user inputs for the generative AI model;
format model prompts for the generative AI model;
post process model outputs from the generative AI model; and
handle special formatting of outputs from the generative AI model; and
wherein the one or more tools includes one or more of a decompression tool to decompress a compressed initial notification and an identification tool to identify an owner of a domain associated with the initial notification;
automatically generating a playbook to effectuate at least one of the recommended actions; and
processing the playbook to address at least a portion of the security event.
20. The computing system of claim 19 wherein receiving an initial notification of a security event from one of the security-relevant subsystems includes:
receiving the initial notification of the security event from an agent executed on one of the security-relevant subsystems.
21. The computing system of claim 19 wherein the one or more tools includes:
a decoding tool to decode an encoded initial notification.
22. The computing system of claim 19 wherein processing the initial notification using a generative AI model and a formatting script to define one or more recommended actions includes:
processing the initial notification using a large language model.
23. The computing system of claim 19 wherein processing the initial notification using a generative AI model and a formatting script to define one or more recommended actions includes:
utilizing prompt engineering to define one or more recommended actions for the initial notification.
24. The computing system of claim 19 wherein processing the initial notification using a generative AI model and a formatting script to define one or more recommended actions includes:
utilizing several loops and/or nested loops to define one or more recommended actions for the initial notification.
25. The computing system of claim 19 wherein automatically generating a playbook to effectuate at least one of the recommended actions includes:
automatically generating a playbook based, at least in part, upon best practices defined via artificial intelligence.
26. The computing system of claim 19 wherein the playbook defines a set of procedures and/or guidelines configured to at least partially address the security event.
27. The computing system of claim 26 wherein processing the playbook to address at least a portion of the security event includes:
performing the set of procedures and/or guidelines defined within the playbook.