Abstract: Described herein are systems and methods for correcting one or more user aliases. One or more alias identifiers are identified by type based at least on one or more user aliases stored in an alias store, the one or more user aliases mapping the one or more alias identifiers to one or more users. Each of the one or more alias identifiers are assigned to one or more rules of a same type as the one or more alias identifiers. The one or more rules are executed against one or more user records in a user metadata store to establish a results table identifying one or more aliases by type found in the user metadata store. An alias correction table is established that identifies one or more aliases of the results table that do not match one or more user aliases and to one of flag, remove, or correct.

Abstract: Systems and methods are described for security event association rule refresh. One or more rules are executed against one or more user records in a user metadata store. The one or more rules may be configured to match a security event of one or more security events with a user of one or more users using user metadata. A count is determined of a number of times a rule of the one or more rules identifies a plurality of different users. It is further determined that one of the count exceeds a first threshold or a number of the plurality of different users exceeds a second threshold. Responsive to the determination, the rule via a user interface may display a prompt to take an action to one or more of review, remove or modify the rule by a system administrator.

Abstract: Systems and methods are described for creating event-driven orchestrated workflows with automated actions in response to security incidents. In an example, a method is described that includes receiving an indication to create a workflow for automating a response to one or more users engaging in an action associated with a security incident and receiving a selection of the action associated with the security incident from a plurality of selectable actions. The selected action is configured into the workflow and configured to trigger execution of the workflow by a user of the one or more users taking the selected action.

Abstract: Methods, apparatus, systems and articles of manufacture to generate regex and detect data similarity are disclosed. An example apparatus includes a token graph generator to generate a token graph including nodes based on a cluster of strings corresponding to a group of messages that are known to be spam; a pivot engine to identify pivot nodes in the cluster of strings; a pivot applicator to tag corresponding ones of the nodes of the token graph as the pivot nodes; and a regex converter to generate the anti-spam signature based on: (a) the tagged nodes and (b) at least one of the node of the token graph that is not tagged as a pivot node.

Abstract: Methods, apparatus, systems and articles of manufacture to generate regex and detect data similarity are disclosed. An example apparatus includes a token graph generator to generate a token graph including nodes based on a cluster of strings corresponding to a group of messages that are known to be spam; a pivot engine to identify pivot nodes in the cluster of strings; a pivot applicator to tag corresponding ones of the nodes of the token graph as the pivot nodes; and a regex converter to generate the anti-spam signature based on: (a) the tagged nodes and (b) at least one of the node of the token graph that is not tagged as a pivot node.

Abstract: A graymail detection and filtering system predicts whether a user will consider an email to be graymail using a classifier model based on features extracted from the email. The email is labelled as graymail or non-graymail based on the prediction. User actions are tracked on the email to determine whether the user actually considered the email to be graymail or non-graymail and the classifier model is trained using machine learning techniques to improve the prediction, without requiring explicit user feedback on whether the user considered the email to be graymail or non-graymail.

Abstract: A graymail detection and filtering system predicts whether a user will consider an email to be graymail using a classifier model based on features extracted from the email. The email is labelled as graymail or non-graymail based on the prediction. User actions are tracked on the email to determine whether the user actually considered the email to be graymail or non-graymail and the classifier model is trained using machine learning techniques to improve the prediction, without requiring explicit user feedback on whether the user considered the email to be graymail or non-graymail.