Abstract: Systems and methods are described for creating event-driven orchestrated workflows with automated actions in response to security incidents. In an example, a method is described that includes receiving an indication to create a workflow for automating a response to one or more users engaging in an action associated with a security incident and receiving a selection of the action associated with the security incident from a plurality of selectable actions. The selected action is configured into the workflow and configured to trigger execution of the workflow by a user of the one or more users taking the selected action.

Abstract: Methods, apparatus, systems and articles of manufacture to generate regex and detect data similarity are disclosed. An example apparatus includes a token graph generator to generate a token graph including nodes based on a cluster of strings corresponding to a group of messages that are known to be spam; a pivot engine to identify pivot nodes in the cluster of strings; a pivot applicator to tag corresponding ones of the nodes of the token graph as the pivot nodes; and a regex converter to generate the anti-spam signature based on: (a) the tagged nodes and (b) at least one of the node of the token graph that is not tagged as a pivot node.

Abstract: Methods, apparatus, systems and articles of manufacture to generate regex and detect data similarity are disclosed. An example apparatus includes a token graph generator to generate a token graph including nodes based on a cluster of strings corresponding to a group of messages that are known to be spam; a pivot engine to identify pivot nodes in the cluster of strings; a pivot applicator to tag corresponding ones of the nodes of the token graph as the pivot nodes; and a regex converter to generate the anti-spam signature based on: (a) the tagged nodes and (b) at least one of the node of the token graph that is not tagged as a pivot node.

Abstract: A graymail detection and filtering system predicts whether a user will consider an email to be graymail using a classifier model based on features extracted from the email. The email is labelled as graymail or non-graymail based on the prediction. User actions are tracked on the email to determine whether the user actually considered the email to be graymail or non-graymail and the classifier model is trained using machine learning techniques to improve the prediction, without requiring explicit user feedback on whether the user considered the email to be graymail or non-graymail.

Abstract: A graymail detection and filtering system predicts whether a user will consider an email to be graymail using a classifier model based on features extracted from the email. The email is labelled as graymail or non-graymail based on the prediction. User actions are tracked on the email to determine whether the user actually considered the email to be graymail or non-graymail and the classifier model is trained using machine learning techniques to improve the prediction, without requiring explicit user feedback on whether the user considered the email to be graymail or non-graymail.