Abstract: Embodiments of the disclosure are related to a method, apparatus, and system for identity threat detection and response for a client computer network including: collecting network security logs for the client computer network; monitoring the network security logs; generating an alert if a condition of the network security logs matches a correlation rule or an anomaly is determined to meet a predefined condition; and, based upon the alert, initiating an automated response including disabling a user account of the client computer network.

Abstract: Embodiments of the disclosure are related to a method, apparatus, and system for multi-tenancy machine-learning based on collected data from multiple clients, comprising: obtaining client data from multiple clients; sending the client data from the multiple clients to a database; pulling data from the database by a machine learning job based on job parameters; partitioning the data by each client for the machine learning job; analyzing the data from the multiple clients by the machine learning job; sending the results of the analysis of the data from the multiple clients by the machine learning job back to the database; querying the database for data specified by rules; and if rules are met by the queried data for one or more of the multiple clients, transmit an alert to an alerting platform.

Abstract: Embodiments of the disclosure are related to a method, apparatus, and system for generating scores for the security threat coverage in a client network based on collected network environment data, comprising: determining a client device list; creating a client-specific threat matrix based on the client device list and a general threat matrix; and determining one or more security threat coverage scores for the client network based on the client-specific threat matrix.

Abstract: Embodiments of the disclosure are related to a method, apparatus, and system for generating scores for the security threat coverage in a client network based on collected network environment data, comprising: determining a client device list; creating a client-specific threat matrix based on the client device list and a general threat matrix; and determining one or more security threat coverage scores for the client network based on the client-specific threat matrix.