Threat mitigation system and method
A threat mitigation platform includes: an agent subsystem configured to generate an initial notification concerning a security event within a computing platform; a generative AI-based planner subsystem configured to receive the initial notification and generate a mitigation plan to address, in whole or in part, the security event within the computing platform; an executor subsystem configured to iteratively process the mitigation plan using a generative AI model to generate an output; and an output formatter subsystem configured to format the output and generate a summarized human-readable report for the initial notification.
1. A threat mitigation platform comprising:
an agent subsystem, comprising at least one processor coupled with a memory device, including one or more agents executed on one or more security-relevant subsystems, wherein the one or more agents are configured to generate an initial notification concerning a security event within a computing platform;
a generative AI-based planner subsystem including a plurality of generative AI models, wherein one or more of the plurality of generative AI models are configured to receive the initial notification and generate a mitigation plan to address, in whole or in part, the security event within the computing platform, including selecting a generative AI model from the plurality of generative AI models within a model repository based upon, at least in part, operation requirements;
an executor subsystem including the selected generative AI model, wherein the selected generative AI model is configured to iteratively process the mitigation plan to generate an output, wherein the selected generative AI model is further configured to utilize one or more tools to process the mitigation plan, wherein the one or more tools include:
a decompression tool to decompress a compressed initial notification; and
an identification tool to identify an owner of a domain associated with the initial notification; and
an output formatter subsystem including a large language model, wherein the large language model is configured to format the output and generate a summarized human-readable report for the initial notification.
2. The threat mitigation platform of claim 1 wherein the generative AI-based planner subsystem is configured to utilize one or more tools to process the initial notification.
3. The threat mitigation platform of claim 2 wherein the one or more tools includes one or more of:
a decoding tool to decode an encoded initial notification;
a decompression tool to decompress a compressed initial notification; and
an identification tool to identify an owner of a domain associated with the initial notification.
4. The threat mitigation platform of claim 1 wherein the one or more tools includes:
a decoding tool to decode an encoded initial notification.
5. The threat mitigation platform of claim 1 wherein the executor subsystem is configured to utilize several loops and/or nested loops to generate the output.
6. The threat mitigation platform of claim 1 wherein the output formatter subsystem is configured to utilize a formatting script to generate the summarized human-readable report for the initial notification.
7. The threat mitigation platform of claim 1 wherein the summarized human-readable report defines recommended next steps and/or disclaimers.
8. A threat mitigation platform comprising:
an agent subsystem, comprising at least one processor coupled with a memory device, including one or more agents executed on one or more security-relevant subsystems, wherein the one or more agents are configured to generate an initial notification concerning a security event within a computing platform;
a generative AI-based planner subsystem including a plurality of generative AI models, wherein one or more of the plurality of generative AI models are configured to receive the initial notification and generate a mitigation plan to address, in whole or in part, the security event within the computing platform, including selecting a generative AI model from the plurality of generative AI models within a model repository based upon, at least in part, operation requirements;
an executor subsystem including the selected generative AI model, wherein the selected generative AI model is configured to iteratively process the mitigation plan to generate an output, wherein the selected generative AI model is further configured to utilize one or more tools to process the mitigation plan, wherein the one or more tools include:
a decompression tool to decompress a compressed initial notification; and
an identification tool to identify an owner of a domain associated with the initial notification; and
an output formatter subsystem including a large language model, wherein the large language model is configured to format the output and generate a summarized human-readable report for the initial notification, wherein the summarized human-readable report defines recommended next steps and/or disclaimers.
9. The threat mitigation platform of claim 8 wherein the generative AI-based planner subsystem is configured to utilize one or more tools to process the initial notification.
10. The threat mitigation platform of claim 9 wherein the one or more tools includes:
a decoding tool to decode an encoded initial notification;
a decompression tool to decompress a compressed initial notification; and
an identification tool to identify an owner of a domain associated with the initial notification.
11. The threat mitigation platform of claim 8 wherein the one or more tools includes:
a decoding tool to decode an encoded initial notification.
12. The threat mitigation platform of claim 8 wherein the executor subsystem is configured to utilize several loops and/or nested loops to generate the output.
13. The threat mitigation platform of claim 8 wherein the output formatter subsystem is configured to utilize a formatting script to generate the summarized human-readable report for the initial notification.
14. A threat mitigation platform comprising:
an agent subsystem, comprising at least one processor coupled with a memory device, including one or more agents executed on one or more security-relevant subsystems, wherein the one or more agents are configured to generate an initial notification concerning a security event within a computing platform;
a generative AI-based planner subsystem including a plurality of generative AI models, wherein one or more of the plurality of generative AI models are configured to receive the initial notification and generate a mitigation plan to address, in whole or in part, the security event within the computing platform, including selecting a generative AI model from the plurality of generative AI models within a model repository based upon, at least in part, operation requirements;
an executor subsystem including the selected generative AI model, wherein the selected generative AI model is configured to iteratively process the mitigation plan to generate an output, wherein the selected generative AI model is further configured to utilize one or more tools to process the mitigation plan, wherein the one or more tools include:
a decompression tool to decompress a compressed initial notification; and
an identification tool to identify an owner of a domain associated with the initial notification; and
an output formatter subsystem including a large language model, wherein the large language model is configured to format the output and generate a summarized human-readable report for the initial notification, wherein:
the output formatter subsystem is configured to utilize a formatting script to generate the summarized human-readable report for the initial notification, and
the summarized human-readable report defines recommended next steps and/or disclaimers.
15. The threat mitigation platform of claim 14 wherein the generative AI-based planner subsystem is configured to utilize one or more tools to process the initial notification.
16. The threat mitigation platform of claim 15 wherein the one or more tools includes one or more of:
a decoding tool to decode an encoded initial notification;
a decompression tool to decompress a compressed initial notification; and
an identification tool to identify an owner of a domain associated with the initial notification.
17. The threat mitigation platform of claim 14 wherein the one or more tools includes:
a decoding tool to decode an encoded initial notification.
18. The threat mitigation platform of claim 14 wherein the executor subsystem is configured to utilize several loops and/or nested loops to generate the output.