Abstract: Techniques for conversational-based searching are described. A system may receive a first spoken user input, and may determine that the first spoken user input corresponds to a request for information associated with an entity. The system may retrieve item results corresponding to the entity. The system may determine a suggested user input based on the retrieved item results, and may determine output data corresponding to the suggested user input. The system may send output data to a user device, where the output data includes the item results and the suggested user input. The system may receive a second spoken user input, and may determine that the second spoken user input corresponds to the suggested user input. In response, the system may send the previously determined output data to the device.

Abstract: A method for disrupting a detected cyberthreat can include receiving a request, the request identifying suspected malicious content; identifying one or more indicators of compromise (IOCs) associated with the content; enriching the request with the IOCs; verifying the request; and reporting the verified request and the one or more IOCs to a disruption network.

Abstract: Systems and methods are described for managing high volumes of alerts to increase security, reduce noise, reduce duplication of work, and increase productivity of analysts dealing with and triaging alerts. A work unit queue may be configured to buffer or smooth workflows and decouple heavy processing which may improve performance and scalability to prevent duplicate assignments. Queueing services provide lag times to prevent over-assignment or double assignment of alerts to work units. System security may be improved by creating an authentication or verification step before allowing users to update alert statuses such that only users with work unit tokens that match alert tokens may update alert statuses.

Abstract: A method for disrupting a detected cyberthreat can include receiving a request, the request identifying suspected malicious content; identifying one or more indicators of compromise (IOCs) associated with the content; enriching the request with the IOCs; verifying the request; and reporting the verified request and the one or more IOCs to a disruption network.

Abstract: A method for disrupting a detected cyberthreat can include receiving a request, the request identifying suspected malicious content; identifying one or more indicators of compromise (IOCs) associated with the content; enriching the request with the IOCs; verifying the request; and reporting the verified request and the one or more IOCs to a disruption network.

Abstract: A system for processing user utterances and/or text based queries that tracks context data of a current dialog between the system and the user, can determine values for slots by determining if the value was mentioned in a previous turn of the dialog. The system may employ a question-answer model and construct a question including the domain name, slot name, and potential slot values. The system may process the previous turns of the dialog and the constructed question to determine the slot value. The system may track a dialog that relates to multiple domains and may determine the slot value based on a slot value that is mentioned in relation to another domain.

Abstract: A method may include a database storing a plurality of tasks, each task having a task ID, a date, a severity level, an enterprise ID, a status, and an assignment field; a user device; a processor; and a server configured to receive a work unit request from the user device, the request comprising a strategy for selecting tasks; create a work unit, the work unit having a state indicator; assign a token ID to the work unit; select a task from the database based on the strategy; add the task ID for the selected task to the work unit to create a populated work unit; change the status of the selected task to indicate the task is checked out; insert the token ID into the assignment field; send the populated work unit to the user device; and change the state indicator to indicate the work unit is checked out.