Granted Patent B2

US 12,596,800 · App. 18/962,112 · Granted Apr 7, 2026

Inventors: Eshel Yaron (Amsterdam, NL); Barak Bercovitz (Even-Yehuda, IL)

Assignee: Wiz, Inc.

G06F21/554G06N20/00G06F2221/034

Abstract

Claims (77)

1 . A method for alert prioritization, comprising:

clustering a plurality of cybersecurity alerts from a plurality of alert sources into a plurality of clusters, where each cybersecurity alert in the plurality of cybersecurity alerts has a first features vector, where the plurality of cybersecurity alerts are clustered based on features distances between cybersecurity alerts among the plurality of cybersecurity alerts;

determining a center for each cluster in the plurality of clusters, where the center is represented by a second features vector;

selecting a plurality of first cybersecurity alerts based on a distance, where the distance is between the first features vector for the cybersecurity alert and the second features vector for the center of the cluster containing the cybersecurity alert, where at least one first cybersecurity alert is from each cluster of the plurality of clusters;

obtaining training prioritizations for each first cybersecurity alerts in the plurality of cybersecurity alerts;

determining a plurality of features for each of the first cybersecurity alerts in the plurality of cybersecurity alerts;

creating a training set including the plurality of first cybersecurity alerts, the plurality of features and the plurality of training prioritizations;

training a prioritization machine learning model on the training set;

applying the prioritization machine learning model with respect to a plurality of second cybersecurity alerts from the plurality of alert sources;

determining a priority for the plurality of cybersecurity alerts based on outputs of the prioritization machine learning model; and

performing a plurality of remediation actions based on the determined priority.

2 . The method of claim 1 , further comprising:

selecting a plurality of groupings based on the plurality of clusters;

presenting, via a user device, the plurality of grouping to a user; and

creating the training prioritization data is based on user inputs received from the user device in response to the presented plurality of groupings.

3 . A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising: clustering a plurality of cybersecurity alerts from a plurality of alert sources into a plurality of clusters, where each cybersecurity alert in the plurality of cybersecurity alerts has a first features vector, where the plurality of cybersecurity alerts are clustered based on features distances between cybersecurity alerts among the plurality of cybersecurity alerts;

determining a center for each cluster in the plurality of clusters, where the center is represented by a second features vector;

selecting a plurality of first cybersecurity alerts based on a distance, where the distance is between the first features vector for the cybersecurity alert and the second features vector for the center of the cluster containing the cybersecurity alert, where at least one first cybersecurity alert is from each cluster of the plurality of clusters;

obtaining training prioritizations for each first cybersecurity alerts in the plurality of cybersecurity alerts;

determining a plurality of features for each of the first cybersecurity alerts in the plurality of cybersecurity alerts;

creating a training set including the plurality of first cybersecurity alerts, the plurality of features and the plurality of training prioritizations;

training a prioritization machine learning model on the training set;

applying the prioritization machine learning model with respect to a plurality of second cybersecurity alerts from the plurality of alert sources;

determining a priority for the plurality of cybersecurity alerts based on outputs of the prioritization machine learning model; and

performing a plurality of remediation actions based on the determined priority.

4 . A system for alert prioritization, comprising:

a processing circuitry; and

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

cluster a plurality of cybersecurity alerts from a plurality of alert sources into a plurality of clusters, where each cybersecurity alert in the plurality of cybersecurity alerts has a first features vector, where the plurality of cybersecurity alerts are clustered based on features distances between cybersecurity alerts among the plurality of cybersecurity alerts;

determine a center for each cluster in the plurality of clusters, where the center is represented by a second features vector;

select a plurality of first cybersecurity alerts based on a distance, where the distance is between the first features vector for the cybersecurity alert and the second features vector for the center of the cluster containing the cybersecurity alert, where at least one first cybersecurity alert is from each cluster of the plurality of clusters;

obtain training prioritizations for each first cybersecurity alerts in the plurality of cybersecurity alerts;

determine a plurality of features for each of the first cybersecurity alerts in the plurality of cybersecurity alerts;

create a training set including the plurality of first cybersecurity alerts, the plurality of features and the plurality of training prioritizations;

train a prioritization machine learning model on the training set;

apply the prioritization machine learning model with respect to a plurality of second cybersecurity alerts from the plurality of alert sources;

determine a priority for the plurality of cybersecurity alerts based on outputs of the prioritization machine learning model; and

perform a plurality of remediation actions based on the determined priority.

5 . The system of claim 4 , wherein the system is further configured to:

select a plurality of groupings based on the plurality of clusters;

present, via a user device, the plurality of grouping to a user; and

create the training prioritization data is based on user inputs received from the user device in response to the presented plurality of groupings.

6 . The method of claim 1 , further comprising:

determining a first set plurality of root causes for each of the first cybersecurity alerts.

7 . The method of claim 6 , further comprising:

determining a first set of locations of the first set plurality of root causes; and

determining a first set plurality of actionability features for each of the first cybersecurity alerts based on the location of the first set of plurality of root causes.

8 . The method of claim 1 , further comprising:

obtaining a plurality of historical cybersecurity alerts, where each historical cybersecurity alert in the plurality of historical cybersecurity alerts have a first historical feature, where the first historical feature is based on a tool that generated the respective historical cybersecurity alert.

9 . The method of claim 1 , further comprising:

obtaining a plurality of historical cybersecurity alerts, where each historical cybersecurity alert in the plurality of historical cybersecurity alerts have a second historical feature, where the second historical feature is based on an underlying threat represented by the respective historical cybersecurity alert.

10 . The method of claim 1 , further comprising:

supplementing the training prioritization data with a first set of inferred training prioritization, where the first set of inferred training prioritization is based on historical data related to viewing to alerts; and

supplementing the training prioritization data with a second set of inferred training prioritization, where the second set of inferred training prioritization is based on historical data related to remediating to alerts.

11 . The method of claim 1 , further comprising:

training a normalization severity model on a plurality of historical cybersecurity alerts;

generating, via the normalized severity model, a plurality of normalized severities using the plurality of first cybersecurity alerts as an input; and

determining the plurality of features for each of the first cybersecurity alerts, where each feature in the plurality of features includes a first feature based on a normalized severity from the plurality of normalized severities.

12 . The method of claim 1 , further comprising:

presenting, via a user device, the plurality of first cybersecurity alerts to a user; and

creating the training prioritization data is based on user inputs received from the user device in response to the presented plurality of first cybersecurity alerts.

13 . The system of claim 4 , wherein the system is further configured to:

determine a first set plurality of root causes for each of the first cybersecurity alerts.

14 . The system of claim 13 , wherein the system is further configured to:

determine a first set of locations of the first set plurality of root causes; and

determine a first set plurality of actionability features for each of the first cybersecurity alerts based on the location of the first set of plurality of root causes.

15 . The system of claim 4 , wherein the system is further configured to:

obtain a plurality of historical cybersecurity alerts, where each historical cybersecurity alert in the plurality of historical cybersecurity alerts have a first historical feature, where the first historical feature is based on a tool that generated the respective historical cybersecurity alert.

16 . The system of claim 4 , wherein the system is further configured to:

obtain a plurality of historical cybersecurity alerts, where each historical cybersecurity alert in the plurality of historical cybersecurity alerts have a second historical feature, where the second historical feature is based on an underlying threat represented by the respective historical cybersecurity alert.

17 . The system of claim 4 , wherein the system is further configured to:

supplement the training prioritization data with a first set of inferred training prioritization, where the first set of inferred training prioritization is based on historical data related to viewing to alerts; and

supplement the training prioritization data with a second set of inferred training prioritization, where the second set of inferred training prioritization is based on historical data related to remediating to alerts.

18 . The system of claim 4 , wherein the system is further configured to:

train a normalization severity model on a plurality of historical cybersecurity alerts;

generate, via the normalized severity model, a plurality of normalized severities using the plurality of first cybersecurity alerts as an input; and

determine the plurality of features for each of the first cybersecurity alerts, where each feature in the plurality of features includes a first feature based on a normalized severity from the plurality of normalized severities.

Assignments (2)

Continuity (2)

References Cited (19)