Abstract: Systems, methods, and related technologies for threat attribution are described. A method includes accessing network traffic to determine an incident based on a correlation of events as being associated with a same coordinated attack. The incident includes indicators of compromise (IoCs) and a Tactics, Techniques and Procedures (TTPs). The method also includes computing a first probability function based on the IoCs, wherein the first probability function comprises a first set of probability of attributions for a first list of known threat actors, and computing a second probability function based on the TTPs, wherein the second probability function comprises a second set of probability of attributions for a second list of known threat actors.

Abstract: A method includes accessing events associated with a network and determining an issue based on a correlation of a portion of the events, wherein the issue represents an incident associated with the portion of the events, and wherein the correlation of the portion of the events is based on information associated with the network and at least in part on an event type of the portion of the events. A priority associated with the issue is determined at least based on the event type of the portion of the events. A first event type that is associated with an operational technology (OT) entity has a higher priority than a second event type that is not associated with the OT entity. Data associated with the issue is stored.

Abstract: A method includes accessing events associated with a network and determining an issue based on a correlation of a portion of the events, wherein the issue represents an incident associated with the portion of the events, and wherein the correlation of the portion of the events is based on information associated with the network and at least in part on an event type of the portion of the events. A priority associated with the issue is determined at least based on the event type of the portion of the events. A first event type that is associated with an operational technology (OT) entity has a higher priority than a second event type that is not associated with the OT entity. Data associated with the issue is stored.

Abstract: Systems, methods, and related technologies for threat attribution are described. A method includes accessing network traffic to determine an incident based on a correlation of events as being associated with a same coordinated attack. The incident includes indicators of compromise (IoCs) and a Tactics, Techniques and Procedures (TTPs). The method also includes computing a first probability function based on the IoCs, wherein the first probability function comprises a first set of probability of attributions for a first list of known threat actors, and computing a second probability function based on the TTPs, wherein the second probability function comprises a second set of probability of attributions for a second list of known threat actors.

Abstract: A method includes accessing events associated with a network and determining an issue based on a correlation of a portion of the events, wherein the issue represents an incident associated with the portion of the events, and wherein the correlation of the portion of the events is based on information associated with the network and at least in part on an event type of the portion of the events. A priority associated with the issue is determined at least based on the event type of the portion of the events. A first event type that is associated with an operational technology (OT) entity has a higher priority than a second event type that is not associated with the OT entity. Data associated with the issue is stored.

Abstract: Systems, methods, and related technologies for determining an issue based on a plurality of events. The determining of an issue may include accessing network traffic from a network and accessing a plurality of events associated with the network traffic. An issue can be determined based on a correlation of a portion of the plurality of events, where the issue represents an incident associated with the portion of the plurality of events. The correlation of the portion of the plurality of events is based on network specific information. Information associated with the issue including the portion of the plurality of events may then be stored.

Abstract: Systems, methods, and related technologies for determining an issue based on a plurality of events. The determining of an issue may include accessing network traffic from a network and accessing a plurality of events associated with the network traffic. An issue can be determined based on a correlation of a portion of the plurality of events, where the issue represents an incident associated with the portion of the plurality of events. The correlation of the portion of the plurality of events is based on network specific information. Information associated with the issue including the portion of the plurality of events may then be stored.

Abstract: An apparatus for painting an object, the apparatus having a painting head equipped with a spraying nozzle arranged to deliver a flow of paint on a surface. The apparatus also includes a device for moving the painting head in the space according to at least two degrees of freedom. An identification device is also provided for identifying the three-dimensional shape of the surface. A processing means is also provided to process the detected projected image and to determine the spatial coordinates of each point.

Abstract: An apparatus for painting an object, the apparatus having a painting head equipped with a spraying nozzle arranged to deliver a flow of paint on a surface. The apparatus also includes a device for moving the painting head in the space according to at least two degrees of freedom. An identification device is also provided for identifying the three-dimensional shape of the surface. A processing means is also provided to process the detected projected image and to determine the spatial coordinates of each point.