Granted Patent B2

US 12,373,566 · App. 17/747,086 · Granted Jul 29, 2025

Inventors: Brian P. Murphy (Tampa, FL); Joe Partlow (Tampa, FL); Colin O'Connor (Tampa, FL); Jason Pfeiffer (Tampa, FL)

Assignee: RELIAQUEST HOLDINGS, LLC

G06F21/577G06F8/65G06F18/20G06F18/214G06F21/53G06F21/55G06F21/554G06F21/56G06F21/561G06F21/562G06F21/566G06F21/568G06F30/20G06N20/00H04L63/0227H04L63/0263H04L63/1416H04L63/1425H04L63/1433H04L63/1441H04L63/145H04L63/164H04L63/20G06F2221/034G06F2221/2115

Abstract

Claims (81)

1. A computer-implemented method, executed on a computing device, comprising:

receiving platform information from a plurality of security-relevant subsystems including searching the plurality of security-relevant subsystems;

processing the platform information to generate processed platform information, including detecting a security event, including

obtaining one or more artifacts concerning the security event;

obtaining artifact information concerning the one or more artifacts from one or more investigation resources; and

generating a conclusion concerning the security event;

assigning a threat level to the security event;

identifying less threat-pertinent content included within the processed platform information associated with the security event;

routing the less threat-pertinent content to a long term storage system; and

receiving threat event information for the plurality of security-relevant subsystems within the computing platform; and

retroactively applying the threat event information to the processed platform information associated with the one or more of the plurality of security-relevant subsystems.

2. The computer-implemented method of claim 1 wherein processing the platform information to generate processed platform information includes:

parsing the platform information into a plurality of subcomponents to allow for compensation of varying formats and/or nomenclature.

3. The computer-implemented method of claim 1 wherein processing the platform information to generate processed platform information includes:

enriching the platform information by including supplemental information from external information resources.

4. The computer-implemented method of claim 1 wherein processing the platform information to generate processed platform information includes:

utilizing artificial intelligence/machine learning to identify one or more patterns/behaviors defined within the platform information.

5. The computer-implemented method of claim 1 wherein the plurality of security-relevant subsystems includes one or more of:

a data lake;

a data log;

a security-relevant software application;

a security-relevant hardware system; and

a resource external to the computing platform.

6. The computer-implemented method of claim 1 wherein identifying less threat-pertinent content included within the processed platform information includes:

processing the processed platform information to identify non-actionable content within the processed platform information that is not usable by a threat analysis engine.

7. The computer-implemented method of claim 1 further comprising:

allowing a third-party to access and search the long term storage system.

8. A computer program product residing on a non-transitory computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:

receiving platform information from a plurality of security-relevant subsystems including searching the plurality of security-relevant subsystems;

processing the platform information to generate processed platform information, including detecting a security event, including

obtaining one or more artifacts concerning the security event;

obtaining artifact information concerning the one or more artifacts from one or more investigation resources; and

generating a conclusion concerning the security event;

assigning a threat level to the security event;

identifying less threat-pertinent content included within the processed platform information associated with the security event;

routing the less threat-pertinent content to a long term storage system; and

receiving threat event information for the plurality of security-relevant subsystems within the computing platform; and

retroactively applying the threat event information to the processed platform information associated with the one or more of the plurality of security-relevant subsystems.

9. The computer program product of claim 8 wherein processing the platform information to generate processed platform information includes:

parsing the platform information into a plurality of subcomponents to allow for compensation of varying formats and/or nomenclature.

10. The computer program product of claim 8 wherein processing the platform information to generate processed platform information includes:

enriching the platform information by including supplemental information from external information resources.

11. The computer program product of claim 8 wherein processing the platform information to generate processed platform information includes:

utilizing artificial intelligence/machine learning to identify one or more patterns/behaviors defined within the platform information.

12. The computer program product of claim 8 wherein the plurality of security-relevant subsystems includes one or more of:

a data lake;

a data log;

a security-relevant software application;

a security-relevant hardware system; and

a resource external to the computing platform.

13. The computer program product of claim 8 wherein identifying less threat-pertinent content included within the processed platform information includes:

processing the processed platform information to identify non-actionable content within the processed platform information that is not usable by a threat analysis engine.

14. The computer program product of claim 8 further comprising:

allowing a third-party to access and search the long term storage system.

15. A computing system including a processor and memory configured to perform operations comprising:

receiving platform information from a plurality of security-relevant subsystems including searching the plurality of security-relevant subsystems;

processing the platform information to generate processed platform information, including detecting a security event, including

obtaining one or more artifacts concerning the security event;

obtaining artifact information concerning the one or more artifacts from one or more investigation resources; and

generating a conclusion concerning the security event;

assigning a threat level to the security event;

identifying less threat-pertinent content included within the processed platform information associated with the security event;

routing the less threat-pertinent content to a long term storage system; and

receiving threat event information for the plurality of security-relevant subsystems within the computing platform; and

retroactively applying the threat event information to the processed platform information associated with the one or more of the plurality of security-relevant subsystems.

16. The computing system of claim 15 wherein processing the platform information to generate processed platform information includes:

parsing the platform information into a plurality of subcomponents to allow for compensation of varying formats and/or nomenclature.

17. The computing system of claim 15 wherein processing the platform information to generate processed platform information includes:

enriching the platform information by including supplemental information from external information resources.

18. The computing system of claim 15 wherein processing the platform information to generate processed platform information includes:

utilizing artificial intelligence/machine learning to identify one or more patterns/behaviors defined within the platform information.

19. The computing system of claim 15 wherein the plurality of security-relevant subsystems includes one or more of:

a data lake;

a data log;

a security-relevant software application;

a security-relevant hardware system; and

a resource external to the computing platform.

20. The computing system of claim 15 wherein identifying less threat-pertinent content included within the processed platform information includes:

processing the processed platform information to identify non-actionable content within the processed platform information that is not usable by a threat analysis engine.

21. The computing system of claim 15 further comprising:

allowing a third-party to access and search the long term storage system.

Assignments (2)

Continuity (5)

References Cited (400)