Adaptive severity functions for alerts

1. A computer-implemented method, comprising:

receiving, by a severity system server, a security alert associated with an entity;

determining, by the severity system server, a first severity level associated with the received security alert;

receiving, by the severity system server, data indicative of at least one environmental factor, comprising data relating to at least one factor that influences a severity of a security alert;

in response to a determination that the at least one environmental factor has an influence on a severity of the received security alert and prior to presenting the received security alert to a user associated with the entity, generating, by the severity system server and based at least on the received data, a second severity level associated with the received security alert that is different from the first severity level; and

transmitting the received security alert and associated second severity level to a computing device associated with the user associated with the entity.

2. The method of claim 1 , further comprising:

updating the second severity level to a third severity level for the received security alert based at least on a time factor.

3. The method of claim 1 , further comprising:

selecting a severity function template from a set of severity function templates based on a type of the received security alert; and

assigning the selected severity function template to the received security alert.

4. The method of claim 3 , further comprising:

generating a severity function based on the severity function template and one or more environmental factors related to a security situation; and

associating the severity function with the received security alert.

5. The method of claim 4 , wherein said generating, based at least on the received data, a second severity level associated with the received security alert comprises:

generating the second severity level based on the received data applied as input to the severity function.

6. The method of claim 5 , wherein said generating a severity function based on the severity function template comprises:

applying the one or more environmental factors to a machine learning algorithm to generate the severity function, the one or more environmental factors comprising at least one of an alert confidence measure, a resource importance indicator, a time factor, an alert type, other alerts and information thereof, a similarity of alerts measure, user information, or a similarity of users measure.

7. The method of claim 1 , wherein said transmitting the received security alert and associated second severity level to the computing device associated with the user further comprises:

transmitting explanatory information relating to a change from the first severity level to the second severity level of the received security alert.

8. A severity system server, comprising:

one or more processing circuits; and

one or more memory devices connected to the one or more processing circuits, the one or more memory devices storing program code that are executable by the one or more processing circuits, the program code comprising:

a severity determiner that

receives a security alert associated with an entity, and

determines a first severity level associated with the received security alert;

a severity modifier that

receives data indicative of at least one environmental factor, comprising data relating to at least one factor that influences a severity of a security alert, the at least one factor including a number of other alerts that are correlated with the entity or the security alert, and

in response to a determination that the at least one environmental factor has an influence on a severity of the received security alert:

selects a severity function template based on the received security alert,

assigns the selected severity function template to the received security alert,

generates a severity function based on the selected severity function template,

generates a second severity level associated with the received security alert that is different from the first severity level by applying the received data as input to the generated severity function; and

an alert manager that transmits the received security alert and associated second severity level to a computing device associated with a user associated with the entity.

9. The severity system server of claim 8 , wherein the severity modifier further:

updates the second severity level to a third severity level for the received security alert based at least on a time factor.

10. The severity system server of claim 8 , wherein the severity modifier:

selects the severity function template from a set of severity function templates based on a type of the received security alert.

11. The severity system server of claim 10 , wherein the severity modifier further:

generates the severity function based on the selected severity function template and one or more environmental factors related to a security situation; and

associates the generated severity function with the received security alert.

12. The severity system server of claim 11 , wherein the severity modifier further applies the one or more environmental factors to a machine learning algorithm to generate the severity function.

13. The severity system server of claim 8 , wherein the alert manager further transmits explanatory information relating to a change from the first severity level to the second severity level of the received security alert.

14. A computer-readable memory device having program instructions recorded thereon that, when executed by at least one processing circuit of a severity system server, perform a method by the severity system server for determining a severity level of a security alert, the method comprising:

receiving a security alert associated with an entity;

determining a first severity level associated with the received security alert;

monitoring the received security alert for a triggering event that relates to at least one factor that influences a severity of a security alert, the triggering event comprising a passage of time;

detecting the triggering event by detecting the passage of time;

in response to detecting the triggering event, and prior to presenting the received security alert to a user associated with the entity generating, based at least on the triggering event, a second severity level associated with the received security alert that is different from the first severity level; and

transmitting the received security alert and associated second severity level to a computing device associated with a user associated with the entity.

15. The computer-readable storage memory device of claim 14 , wherein the method further comprises:

selecting a severity function template from a set of severity function templates based on a type of the received security alert; and

assigning the selected severity function template to the received security alert.

16. The computer-readable storage memory device of claim 15 , wherein the method further comprises:

generating a severity function based on the severity function template and one or more environmental factors related to a security situation; and

associating the severity function with the received security alert.

17. The computer-readable storage memory device of claim 16 , wherein

said detecting the triggering event comprises receiving data indicative of the triggering event; and

the method further comprises:

generating the second severity level based on the received data applied as input to the severity function.

18. The severity system server of claim 12 , wherein the one or more environmental factors further comprises at least one of an alert confidence measure, a resource importance indicator, a time factor, an alert type, other alerts and information thereof, user information, or a similarity of users measure.

19. The computer-readable storage memory device of claim 14 , wherein the triggering event further comprises the reception of information about the security alert.

20. The computer-readable storage memory device of claim 14 , wherein said transmitting the received security alert and associated second severity level to the computing device associated with the user further comprises:

presenting explanatory information relating to a change from the first severity level to the second severity level of the received security alert.