Adaptive Incident Prioritization Based on User Feedback

1 . A computer-implemented method for prioritizing security incidents, the method comprising:

maintaining one or more pre-trained Artificial Intelligence (AI) models that, when applied to features extracted from computer-system security incidents, produce a prioritization among the security incidents; and

for each computer system among a plurality of computer systems, running an iterative process that includes:

detecting one or more security incidents occurring in the computer system;

extracting features from the detected incidents;

applying the one or more pre-trained AI models to the extracted features, to produce a computer-system-specific prioritization;

presenting the computer-system-specific prioritization to a user of the computer system;

receiving user feedback that is indicative of a quality of the computer-system-specific prioritization, as decided by the user of the computer system; and

adjusting subsequent extraction of the features, for the computer system, based on the user feedback.

2 . The method according to claim 1 , wherein running the iterative process comprises producing different computer-system-specific prioritizations for different ones of the computer systems, in spite of using the same one or more pre-trained AI models.

3 . The method according to claim 1 , wherein extracting the features comprises assigning respective precision measures to one or more of the features, and wherein adjusting the subsequent extraction of the features comprises adjusting the precision measures in response to the user feedback.

4 . The method according to claim 1 , wherein, for a given computer system in the plurality, adjusting the subsequent extraction of the features is performed based on both (i) the user feedback received for the given computer system, and (ii) the user feedback received for one or more other computer systems in the plurality.

5 . The method according to claim 4 , wherein adjusting the subsequent extraction of the features comprises preventing distortion in the feature extraction of a given computer system due to the user feedback in another computer system.

6 . An apparatus for prioritizing security incidents, the apparatus comprising:

a memory, configured to store one or more pre-trained Artificial Intelligence (AI) models that, when applied to features extracted from computer-system security incidents, produce a prioritization among the security incidents; and

one or more processors, configured to run, for each computer system among a plurality of computer systems, an iterative process that includes:

detecting one or more security incidents occurring in the computer system;

extracting features from the detected incidents;

applying the one or more pre-trained AI models to the extracted features, to produce a computer-system-specific prioritization;

presenting the computer-system-specific prioritization to a user of the computer system;

receiving user feedback that is indicative of a quality of the computer-system-specific prioritization, as decided by the user of the computer system; and

adjusting subsequent extraction of the features, for the computer system, based on the user feedback.

7 . The apparatus according to claim 6 , wherein, in running the iterative process, the one or more processors are configured to produce different computer-system-specific prioritizations for different ones of the computer systems, in spite of using the same one or more pre-trained AI models.

8 . The apparatus according to claim 6 , wherein the one or more processors are configured to assign respective precision measures to one or more of the features, and to adjust the subsequent extraction of the features by adjusting the precision measures in response to the user feedback.

9 . The apparatus according to claim 6 , wherein, for a given computer system in the plurality, the one or more processors are configured to adjust the subsequent extraction of the features based on both (i) the user feedback received for the given computer system, and (ii) the user feedback received for one or more other computer systems in the plurality.

10 . The apparatus according to claim 9 , wherein the one or more processors are configured to prevent distortion in the feature extraction of a given computer system due to the user feedback in another computer system.

11 . A computer software product, the product comprising a tangible non-transitory computer-readable medium in which program instructions are stored, which instructions, when read by one or more processors, cause the one or more processors to:

maintain one or more pre-trained Artificial Intelligence (AI) models that, when applied to features extracted from computer-system security incidents, produce a prioritization among the security incidents; and

for each computer system among a plurality of computer systems, run an iterative process that includes:

detecting one or more security incidents occurring in the computer system;

extracting features from the detected incidents;

applying the one or more pre-trained AI models to the extracted features, to produce a computer-system-specific prioritization;

presenting the computer-system-specific prioritization to a user of the computer system;

receiving user feedback that is indicative of a quality of the computer-system-specific prioritization, as decided by the user of the computer system; and

adjusting subsequent extraction of the features, for the computer system, based on the user feedback.

12 . The apparatus according to claim 11 , wherein the instructions cause the one or more processors to produce different computer-system-specific prioritizations for different ones of the computer systems, in spite of using the same one or more pre-trained AI models.

13 . The apparatus according to claim 11 , wherein the instructions cause the one or more processors to assign respective precision measures to one or more of the features, and to adjust the subsequent extraction of the features by adjusting the precision measures in response to the user feedback.

14 . The apparatus according to claim 11 , wherein, for a given computer system in the plurality, the instructions cause the one or more processors to adjust the subsequent extraction of the features based on both (i) the user feedback received for the given computer system, and (ii) the user feedback received for one or more other computer systems in the plurality.

15 . The apparatus according to claim 14 , wherein the instructions cause the one or more processors to prevent distortion in the feature extraction of a given computer system due to the user feedback in another computer system.