Abstract: A computer-implemented method of investigating a potential cyber incident detected by a cyber security system is described. The method comprises using artificial intelligence (AI) based analysis to perform an investigation into the potential cyber incident based on one or more user-selected hypotheses selected by a user responsive to one or more alerts generated by the cyber security system. The method further comprises causing one or more actions to be performed based on an outcome of the investigation.

Abstract: A cyber security appliance can detect a cyber threat with a set of LoRA attachments, a base machine learning model, and an ensemble machine learning model. Each LoRa attachment in the set is specifically trained on identifying and confirming a particular indication of the cyber threat and/or another property being analyzed for cyber security purposes. The base machine learning model and one or more of the LoRa attachments in the set of attachments are paired to work in tandem with each other to analyze input data to look for the particular indication of the cyber threat and/or other property being analyzed for cyber security purposes.

Abstract: An apparatus to protect a network from a potential cyber threat associated with a new endpoint to that network is described. The apparatus comprises a memory to store a representation of an artificial intelligence (AI) model. The AI model is at least partly trained based on information aggregated from a first information source and a second information source. The first information source comprises information about a first factor that at least partly characterizes endpoints. The second information source comprises information about a second, different, factor that at least partly characterizes endpoints. The apparatus further comprises a processor. The processor is to receive information about the new endpoint to that network. The processor is further to determine, using the AI model, whether the information about the new endpoint indicates that a characteristic of the new endpoint overlaps with a profile of characteristics associated with endpoints known to be associated with a cyber threat.