Abstract: A technique for dynamically updating a user interface for threat investigation may include receiving a scheduled transmittal of events in an event stream from an endpoint at a threat management facility, processing the event stream at the threat management facility to detect an intermediate threat, in response to detecting the intermediate threat at the threat management facility, requesting a transmittal of supplemental information from a data recorder on the endpoint, receiving the supplemental information in a supplemental transmittal from the endpoint to the threat management facility, and displaying a description of the intermediate threat and the supplemental information in a user interface hosted by the threat management facility, where the user interface is configured for user investigation and disposition of the intermediate threat.

Abstract: Disclosed are techniques for monitoring artificial intelligence (AI) and responding to cybersecurity threats in a computing environment. A method can include monitoring computational resources and network traffic to identify potential AI operations, determining AI-specific behavioral patterns based on applying heuristics to the AI operations, identifying deviations of the AI operations from normal operational patterns using deep learning anomaly detection techniques, and returning information about the identified deviations of the AI operations. The method can include generating cloned copies of workloads from a cloud computing environment, detecting AI operations based on the cloned copies, and identifying deviations of the detected AI operations from normal operational patterns using deep learning anomaly detection techniques.

Abstract: Disclosed are techniques and technology for fine-tuning a cybersecurity event response. A method can include receiving, by a computer system, analysis history data associated with the cybersecurity event response and a security outcome of user actions performed in the cybersecurity event response, identifying behavior patterns based on the analysis history data, generating a value for the cybersecurity event response that can correspond to the security outcome of the user actions performed in the cybersecurity event response and the identified behavior patterns, determining at least one suggestion for fine-tuning the cybersecurity event response based on the value for the cybersecurity event response, and returning the at least one suggestion for fine-tuning the cybersecurity event response.

Abstract: Endpoints and a corresponding switch within a heterogeneous network work cooperatively to respond to notifications of compromise in order to protect the enterprise network. Endpoints self-isolate when a local security agent detects a compromise, and shun a compromised one of the other endpoints in response to a corresponding notification. The switch forwards a notice of compromise from an endpoint to a threat management facility for the enterprise network and prevents communications from a compromised endpoint through the switch in response to receiving a corresponding request from the threat management facility.

Abstract: A threat management facility stores a number of entity models that characterize reportable events from one or more entities. A stream of events from compute instances within an enterprise network can then be analyzed using these entity models to detect behavior that is inconsistent or anomalous for one or more of the entities that are currently active within the enterprise network.

Abstract: In some implementations, a cybersecurity system is provided for summarizing network security investigations. The system receives a request to summarize an investigation sequence performed in response to a computer security incident, retrieves tokenized elements that correspond to the investigation sequence, and provides the tokenized elements to a large language model (LLM) for translation into a data operation format. The system receives, from the LLM, and for each tokenized element, a corresponding translated data operation. For each translated data operation, the system submits the translated data operation for execution by a data source, and receives a corresponding data operation response. The system performs a summarization process of the investigation sequence, and outputs a natural language summarization.

Abstract: Technologies for automated security incident analysis include a computing device that clusters security incidents and runbooks into multiple clusters based on investigation similarity. For each cluster, the computing device determines a summary of all security incidents in the cluster with a large language model, determines criteria for inclusion of a security incident in the cluster, and determines a suggested investigation step with a retrieval augmented generation pipeline. The suggested investigation step includes a natural language description and a programmatic query. Upon receiving approval from a user, the computing device stores the cluster information in a curated query repository. The computing device may receive a security incident for investigation, assign the security incident to a cluster based on the stored criteria, and retrieve a suggested investigation step from the curated query repository. The computing device may provide the suggested investigation step to a user.

Abstract: In some implementations, a cybersecurity threat detection and mitigation system is provided. The system refines an artificial intelligence (AI) model with a corpus of historical data that represents security events that occurred, queries that were submitted by security analysts in response to the security events, and actions that were performed for mitigating the security events. Telemetry data that corresponds to behavior and performance of a computer network is collected and provided to the AI model. Based on the telemetry data, the AI model predicts a potential security threat to the computer network and performs an assessment of risk to the computer network. When the assessment of risk to the computer network indicates that the potential security threat is an actual security threat, a security alert that corresponds to the actual security threat is triggered. Other embodiments are described and claimed.

Abstract: In a threat management platform, a number of endpoints log events in an event data recorder. A local agent filters this data and feeds a filtered data stream to a central threat management facility. The central threat management facility can locally or globally tune filtering by local agents based on the current data stream, and can query local event data recorders for additional information where necessary or helpful in threat detection or forensic analysis. The central threat management facility also stores and deploys a number of security tools such as a web-based user interface supported by machine learning models to identify potential threats requiring human intervention and other models to provide human-readable context for evaluating potential threats.

Abstract: An endpoint in an enterprise network is instrumented with sensors to detect security-related events occurring on the endpoint. Event data from these sensors is augmented with contextual information about, e.g., a source of each event in order to facilitate improved correlation, analysis, and visualization at a threat management facility for the enterprise network.

Abstract: An automated system attempts to characterize code as safe or unsafe. For intermediate code samples not placed with sufficient confidence in either category, human-readable analysis is automatically generated to assist a human reviewer in reaching a final disposition. For example, a random forest over human-interpretable features may be created and used to identify suspicious features in a manner that is understandable to, and actionable by, a human reviewer. Similarly, a k-nearest neighbor algorithm may be used to identify similar samples of known safe and unsafe code based on a model for, e.g., a file path, a URL, an executable, and so forth. Similar code may then be displayed (with other information) to a user for evaluation in a user interface. This comparative information can improve the speed and accuracy of human interventions by providing richer context for human review of potential threats.

Abstract: An application executing on an endpoint accesses remote resources using a gateway. In response to a requested remote access, the application may be marked with a descriptor that specifies a target action and a pattern of occurrences of the target action. When a second observable action on the endpoint includes the pattern of events following the first observable action, a reportable event may be generated indicating a compromised state of the endpoint.

Abstract: A compute instance stores a programmable feature extractor associated with a machine learning model maintained by a server-based computing system configured to communicate with the compute instance by way of a network. The machine learning model is based on a feature set that includes a plurality of features. The compute instance executes the programmable feature extractor to generate a feature vector corresponding to a data instance accessed by the compute instance, where the feature vector includes a feature value specific to the data instance for each feature included in the feature set. The compute instance transmits the feature vector corresponding to the data instance to the server-based computing system for use as a training input to the machine learning model.

Abstract: In a threat management platform, a number of endpoints log events in an event data recorder. A local agent filters this data and feeds a filtered data stream to a central threat management facility. The central threat management facility can locally or globally tune filtering by local agents based on the current data stream, and can query local event data recorders for additional information where necessary or helpful in threat detection or forensic analysis. The central threat management facility also stores and deploys a number of security tools such as a web-based user interface supported by machine learning models to identify potential threats requiring human intervention and other models to provide human-readable context for evaluating potential threats.

Abstract: An automated system attempts to characterize code as safe or unsafe. For intermediate code samples not placed with sufficient confidence in either category, human-readable analysis is automatically generated to assist a human reviewer in reaching a final disposition. For example, a random forest over human-interpretable features may be created and used to identify suspicious features in a manner that is understandable to, and actionable by, a human reviewer. Similarly, a k-nearest neighbor algorithm may be used to identify similar samples of known safe and unsafe code based on a model for, e.g., a file path, a URL, an executable, and so forth. Similar code may then be displayed (with other information) to a user for evaluation in a user interface. This comparative information can improve the speed and accuracy of human interventions by providing richer context for human review of potential threats.

Abstract: Possible Denial of Service (DOS) activity is detected and remediated based on an initial heartbeat failure from a network asset, followed by externally directed network traffic from the network asset. In general, an interruption of the heartbeat can signal the possible presence of malware on the network asset, and the externally directed network traffic, and particularly certain patterns of traffic such as a high volume of traffic toward an address with a known, good reputation, can signal the possible presence of a DoS bot on the network asset that is sourcing the network traffic.

Abstract: An endpoint coupled in a communicating relationship with an enterprise network may include a data recorder configured to store an event stream of data indicating events on the endpoint including types of changes to computing objects, a filter configured to locally process the event stream into a filtered event stream including a subset of types of changes to the computing objects, and a local security agent. The local security agent may be configured to transmit the filtered event stream to a threat management facility, respond to a filter adjustment from the threat management facility by adjusting the filter to modify the subset of types of changes included in the filtered event stream, and respond to a query from the threat management facility by retrieving data stored in the data recorder over a time window before the query and excluded from the filtered event stream.

Abstract: Security is improved by adding a security heartbeat for and endpoint as a factor in a multi-factor authentication system. The security heartbeat may be used directly as an authentication factor, e.g., where the heartbeat provides a reliable and verifiable indication of identity, or the security heartbeat may be used as a gating input for some other verification method, e.g., where a text message with a temporary security code can only be transmitted to a user when the user's endpoint is providing a secure heartbeat.

Abstract: An application executing on an endpoint accesses remote resources using a gateway. In response to a requested remote access, the application may be marked with a descriptor that specifies a target action and a pattern of occurrences of the target action. When a second observable action on the endpoint includes the pattern of events following the first observable action, a reportable event may be generated indicating a compromised state of the endpoint. The gateway can then regulate usage of the remote resource based on the reportable event.

Abstract: A firewall uses information about an application that originates a network request to determine whether and how to forward the request over a network. The firewall may more generally rely on the identity of the originating application, the security state of the originating application, the security state of the endpoint, and any other information that might provide an indication of malicious activity, to make routing and forwarding decisions for endpoint-originated network traffic.