Threat mitigation system and method
A computer-implemented method, computer program product and computing system for generating one or more detection rules that are indicative of a security event, wherein the one or more detection rules are based upon historical suspect activity and/or historical security events; monitoring activity within a computing platform, thus defining monitored activity; comparing such monitored activity to the one or more detection rules to determine if such monitored activity includes suspect activity indicative of a security event; generating an initial notification of the security event, wherein the initial notification includes a computer-readable language portion that defines one or more specifics of the security event; and iteratively processing the initial notification using a generative AI model and a formatting script to produce a summarized human-readable report for the initial notification.
1. A computer-implemented method executed on a computing device comprising:
generating one or more detection rules that are indicative of a security event, wherein the one or more detection rules are based upon one or more of historical suspect activity and historical security events;
monitoring activity within a computing platform, thus defining monitored activity;
comparing such monitored activity to the one or more detection rules to determine if such monitored activity includes suspect activity indicative of a security event;
generating an initial notification of the security event, wherein the initial notification includes a computer-readable language portion that defines one or more specifics of the security event; and
iteratively processing the initial notification using a generative AI model and a formatting script to produce a summarized human-readable report for the initial notification, wherein the formatting script is configured to
format model prompts for the generative AI model to one or more of tailor the model prompts to fit specific use cases and to elicit more accurate responses from the generative AI model.
2. The computer-implemented method of claim 1 wherein the computing platform includes a plurality of security-relevant subsystems.
3. The computer-implemented method of claim 1 wherein monitoring activity within a computing platform includes:
monitoring activity within one or more of the plurality of security-relevant subsystems of the computing platform.
4. The computer-implemented method of claim 1 further comprising:
updating the one or more detection rules based upon one or more of current suspect activity, current security events, future suspect activity and future security events.
5. The computer-implemented method of claim 1 wherein iteratively processing the initial notification using a generative AI model and a formatting script to produce a summarized human-readable report for the initial notification includes:
iteratively processing the initial notification using one or more of the generative AI model, the formatting script and one or more tools to produce the summarized human-readable report for the initial notification.
6. The computer-implemented method of claim 4 wherein the one or more tools includes one or more of:
a decoding tool to decode an encoded initial notification;
a decompression tool to decompress a compressed initial notification; and
an identification tool to identify an owner of a domain associated with the initial notification.
7. The computer-implemented method of claim 1 wherein iteratively processing the initial notification using a generative AI model and a formatting script to produce a summarized human-readable report for the initial notification includes:
iteratively processing the initial notification using a large language model.
8. The computer-implemented method of claim 1 wherein iteratively processing the initial notification using a generative AI model and a formatting script to produce a summarized human-readable report for the initial notification includes:
utilizing prompt engineering to produce the summarized human-readable report for the initial notification.
9. The computer-implemented method of claim 1 wherein iteratively processing the initial notification using a generative AI model and a formatting script to produce a summarized human-readable report for the initial notification includes:
utilizing one or more of several loops and nested loops to produce the summarized human-readable report for the initial notification.
10. The computer-implemented method of claim 1 wherein the summarized human-readable report defines one or more of recommended next steps and disclaimers.
11. A computer program product residing on a non-transitory computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:
generating one or more detection rules that are indicative of a security event, wherein the one or more detection rules are based upon one or more of historical suspect activity and historical security events;
monitoring activity within a computing platform, thus defining monitored activity;
comparing such monitored activity to the one or more detection rules to determine if such monitored activity includes suspect activity indicative of a security event;
generating an initial notification of the security event, wherein the initial notification includes a computer-readable language portion that defines one or more specifics of the security event; and
iteratively processing the initial notification using a generative AI model and a formatting script to produce a summarized human-readable report for the initial notification, wherein the formatting script is configured to
format model prompts for the generative AI model to one or more of tailor the model prompts to fit specific use cases and to elicit more accurate responses from the generative AI model.
12. The computer program product of claim 11 wherein the computing platform includes a plurality of security-relevant subsystems.
13. The computer program product of claim 11 wherein monitoring activity within a computing platform includes:
monitoring activity within one or more of the plurality of security-relevant subsystems of the computing platform.
14. The computer program product of claim 11 further comprising:
updating the one or more detection rules based upon one or more of current suspect activity, current security events, future suspect activity and future security events.
15. The computer program product of claim 11 wherein iteratively processing the initial notification using a generative AI model and a formatting script to produce a summarized human-readable report for the initial notification includes:
iteratively processing the initial notification using one or more of the generative AI model, the formatting script and one or more tools to produce the summarized human-readable report for the initial notification.
16. The computer program product of claim 14 wherein the one or more tools includes one or more of:
a decoding tool to decode an encoded initial notification;
a decompression tool to decompress a compressed initial notification; and
an identification tool to identify an owner of a domain associated with the initial notification.
17. The computer program product of claim 11 wherein iteratively processing the initial notification using a generative AI model and a formatting script to produce a summarized human-readable report for the initial notification includes:
iteratively processing the initial notification using a large language model.
18. The computer program product of claim 11 wherein iteratively processing the initial notification using a generative AI model and a formatting script to produce a summarized human-readable report for the initial notification includes:
utilizing prompt engineering to produce the summarized human-readable report for the initial notification.
19. The computer program product of claim 11 wherein iteratively processing the initial notification using a generative AI model and a formatting script to produce a summarized human-readable report for the initial notification includes:
utilizing one or more of several loops and nested loops to produce the summarized human-readable report for the initial notification.
20. The computer program product of claim 11 wherein the summarized human-readable report defines one or more of recommended next steps and disclaimers.
21. A computing system including a processor and memory configured to perform operations comprising:
generating one or more detection rules that are indicative of a security event, wherein the one or more detection rules are based upon one or more of historical suspect activity and historical security events;
monitoring activity within a computing platform, thus defining monitored activity;
comparing such monitored activity to the one or more detection rules to determine if such monitored activity includes suspect activity indicative of a security event;
generating an initial notification of the security event, wherein the initial notification includes a computer-readable language portion that defines one or more specifics of the security event; and
iteratively processing the initial notification using a generative AI model and a formatting script to produce a summarized human-readable report for the initial notification, wherein the formatting script is configured to
format model prompts for the generative AI model to one or more of tailor the model prompts to fit specific use cases and to elicit more accurate responses from the generative AI model.
22. The computing system of claim 21 wherein the computing platform includes a plurality of security-relevant subsystems.
23. The computing system of claim 21 wherein monitoring activity within a computing platform includes;
monitoring activity within one or more of the plurality of security-relevant subsystems of the computing platform.
24. The computing system of claim 21 further comprising:
updating the one or more detection rules based upon one or more of current suspect activity, current security events, future suspect activity and future security events.
25. The computing system of claim 21 wherein iteratively processing the initial notification using a generative AI model and a formatting script to produce a summarized human-readable report for the initial notification includes:
iteratively processing the initial notification using one or more of the generative AI model, the formatting script and one or more tools to produce the summarized human-readable report for the initial notification.
26. The computing system of claim 24 wherein the one or more tools includes one or more of:
a decoding tool to decode an encoded initial notification;
a decompression tool to decompress a compressed initial notification; and
an identification tool to identify an owner of a domain associated with the initial notification.
27. The computing system of claim 21 wherein iteratively processing the initial notification using a generative AI model and a formatting script to produce a summarized human-readable report for the initial notification includes:
iteratively processing the initial notification using a large language model.
28. The computing system of claim 21 wherein iteratively processing the initial notification using a generative AI model and a formatting script to produce a summarized human-readable report for the initial notification includes:
utilizing prompt engineering to produce the summarized human-readable report for the initial notification.
29. The computing system of claim 21 wherein iteratively processing the initial notification using a generative AI model and a formatting script to produce a summarized human-readable report for the initial notification includes:
utilizing one or more of several loops and nested loops to produce the summarized human-readable report for the initial notification.
30. The computing system of claim 21 wherein the summarized human-readable report defines one or more of recommended next steps and disclaimers.