Abstract: A plurality of data sets characterizing prior intrusive activities with respect to computing resources associated with one or more entities are received at a security platform. One or more rule generation policies each pertaining to at least one type of intrusive activity are received at a security platform. The one or more rule generation policies are applied to the plurality of data sets characterizing the prior intrusive activities to generate a plurality of intrusive activity detection rules. The plurality of intrusive activity detection rules are caused to be used to detect subsequent intrusive activities.

Abstract: A method comprises collecting network data associated with data transmission in a computing environment. The method also comprises identifying, using one or more machine learning models, at least one intrusion type affecting the computing environment. The identification of the at least one intrusion type is based at least in part on the collected network data. In the method, one or more remedial communications addressing the at least one intrusion type are generated, and the one or more remedial communications are transmitted to a user.