New patent application published for: SYSTEMS AND METHODS FOR INTELLIGENT CONFIGURATION AND DEPLOYMENT OF ALERT SUPPRESSION PARAMETERS IN A CYBERSECURITY THREAT DETECTION AND MITIGATION PLATFORM

SYSTEMS AND METHODS FOR INTELLIGENT CONFIGURATION AND DEPLOYMENT OF ALERT SUPPRESSION PARAMETERS IN A CYBERSECURITY THREAT DETECTION AND MITIGATION PLATFORM

Claims

1. A computer-implemented method for accelerating a configuration and deployment of event suppression instructions, the computer-implemented method comprising: at a cybersecurity event detection and response service: identifying an event suppression candidate based on identifying a cybersecurity event that satisfies automated event suppression criteria of the cybersecurity event detection and response service; displaying, via a user interface, a representation of the cybersecurity event that includes: a plurality of distinct pieces of event data associated with the cybersecurity event, and an event suppression user interface element, wherein the representation of the cybersecurity event includes the event suppression user interface element in response to identifying the cybersecurity event as the event suppression candidate, wherein the event suppression user interface element includes: a textual summary comprising a numerical quantity of a total number of historical cybersecurity events that are substantially similar to the cybersecurity event, wherein each cybersecurity event of the historical cybersecurity events was previously identified as non- malicious by the cybersecurity event detection and response service, and a selectable hyperlink that, when selected, instantiates an event suppression construction user interface object overlaid on the user interface; in response to receiving a user input selecting the selectable hyperlink, automatically constructing, over one or more iterations, a computer-executable event suppression instruction by pre-populating a subset of the plurality of distinct pieces of event data into corresponding event suppression configuration data fields included in the event suppression construction user interface object overlaid on the user interface; performing, using the event suppression construction user interface object, one or more event suppression simulations in response to constructing the computer-executable event suppression instruction, wherein each of the one or more event suppression simulations include: automatically assessing one or more corpora of historical cybersecurity event data of a predetermined time span against the computer-executable event suppression instruction; and automatically computing a plurality of distinct cybersecurity threat-informative simulation metrics based on the automatic assessing of the one or more corpora of historical cybersecurity event data against the computer-executable event suppression instruction; and implementing, via one or more processors, the computer-executable event suppression instruction into one or more subscriber-specific cybersecurity environments of the cybersecurity event detection and response service.
2. The computer-implemented method according to claim 1, wherein identifying the cybersecurity event includes: automatically assessing, via the one or more processors, a plurality of distinct clusters of cybersecurity event data; and automatically identifying, via the one or more processors, a target cluster of cybersecurity event data of the plurality of distinct clusters of cybersecurity event data that satisfies the automated event suppression criteria based on the assessing of the plurality of distinct clusters of cybersecurity event data, wherein the target cluster of cybersecurity event data includes the cybersecurity event.
3. The computer-implemented method according to claim 2, wherein: the target cluster of cybersecurity event data satisfies the automated event suppression criteria based on: identifying, via the one or more processors, that each distinct cybersecurity event included in the target cluster of cybersecurity event data corresponds to a non-malicious cybersecurity event; identifying, via the one or more processors, that a total quantity of cybersecurity events included in the target cluster of cybersecurity event data satisfies a service-defined cluster size threshold; and identifying, via the one or more processors, that a plurality of distinct pieces of event metadata corresponds to each distinct cybersecurity event of the target cluster of cybersecurity event data.
4. The computer-implemented method according to claim 3, wherein: the subset of the plurality of distinct pieces of event data includes the plurality of distinct pieces of event metadata that corresponds to each distinct cybersecurity event of the target cluster of cybersecurity event data, and each distinct piece of event metadata included in the subset of the plurality of distinct pieces of event data defines a distinct suppression parameter of the computer-executable event suppression instruction.
5. The computer-implemented method according to claim 1, further comprising: automatically evaluating, via the one or more processors, the cybersecurity event against the one or more corpora of historical cybersecurity event data; detecting, via the one or more processors, that the cybersecurity event corresponds to a plurality of historical, non-malicious cybersecurity events based on the evaluating of the cybersecurity event against the one or more corpora of historical cybersecurity event data, wherein a numerical quantity of the plurality of historical, non-malicious cybersecurity events satisfies an event suppression quantity threshold; and wherein the cybersecurity event satisfies the automated event suppression criteria based on detecting that the numerical quantity of the plurality of historical, non-malicious cybersecurity events satisfies the event suppression quantity threshold.
6. The computer-implemented method according to claim 1, wherein automatically computing the plurality of distinct cybersecurity threat-informative simulation metrics include: computing, via the one or more processors, a numerical quantity of malicious cybersecurity events that the computer-executable event suppression instruction, if retroactively implemented, would have automatically suppressed or automatically disposed.
7. The computer-implemented method according to claim 1, wherein automatically computing the plurality of distinct cybersecurity threat-informative simulation metrics include: computing, via the one or more processors, a numerical quantity of cybersecurity investigations that the cybersecurity event detection and response service would have inadvertently bypassed based on identifying a subset of investigation-required cybersecurity events of the one or more corpora of historical cybersecurity event data that the computer-executable event suppression instruction, if retroactively implemented, would have automatically suppressed or automatically disposed.
8. The computer-implemented method according to claim 1, wherein implementing the computer-executable event suppression instruction into the one or more subscriber-specific cybersecurity environments of the cybersecurity event detection and response service includes implementing the computer-executable event suppression instruction into a target subscriber-specific cybersecurity environment that corresponds to a subscriber associated with the cybersecurity event.
9. The computer-implemented method according to claim 1, wherein implementing the computer-executable event suppression instruction into the one or more subscriber-specific cybersecurity environments of the cybersecurity event detection and response service includes implementing the computer-executable event suppression instruction into a plurality of distinct subscriber-specific cybersecurity environments that corresponds to a plurality of distinct subscribers.
10. The computer-implemented method according to claim 1, wherein: the event suppression user interface element comprises one or more emphasized regions that visually emphasizes the event suppression user interface element from portions external to the event suppression user interface element.
11. The computer-implemented method according to claim 1, wherein the cybersecurity event satisfies the automated event suppression criteria based on: automatically identifying, via the one or more processors, that a plurality of historical, non-malicious cybersecurity alerts is substantially similar or substantially equivalent to the cybersecurity event; and automatically identifying, via the one or more processors, that a numerical quantity of a total number of the plurality of historical, non-malicious cybersecurity alerts satisfies a predefined alert quantity threshold.
12. The computer-implemented method according to claim 1, further comprising: tuning one or more suppression parameters of the computer-executable event suppression instruction based on identifying that a numerical quantity of historical malicious cybersecurity events related to the cybersecurity event exceeds a predefined malicious alert threshold value.
13. The computer-implemented method according to claim 1, further comprising: identifying, based on performing the one or more event suppression simulations, that one or more parameters of the computer-executable event suppression instruction caused one or more historical cybersecurity events that resulted in a security incident to be suppressed; and generating a new iteration of the computer-executable event suppression instruction by iteratively modifying the one or more parameters of the computer-executable event suppression instruction until the one or more historical cybersecurity events that resulted in the security incident are no longer suppressed, wherein implementing the computer-executable event suppression instruction into the one or more subscriber-specific cybersecurity environments includes implementing the new iteration of the computer-executable event suppression instruction into the one or more subscriber-specific cybersecurity environments.
14. The computer-implemented method according to claim 1, further comprising: after implementing the computer-executable event suppression instruction: identifying a set of event data signals associated with a subscriber, generating a security alert based on the set of event data signals, and automatically suppressing the security alert based on the security alert satisfying suppression criteria of the computer-executable event suppression instruction.
15. The computer-implemented method according to claim 14, further comprising: adding, based on automatically suppressing the security alert, a metadata tag to the security alert that indicates the security alert was closed via suppression.
16. The computer-implemented method according to claim 15, wherein: the metadata tag further includes a link to the computer-executable event suppression instruction that caused the suppression.
17. A method comprising: at a cybersecurity event detection and response service: identifying an event suppression candidate based on identifying a cybersecurity event that satisfies automated event suppression criteria of the cybersecurity event detection and response service; displaying, via a user interface, a representation of the cybersecurity event that includes: a plurality of distinct pieces of event data associated with the cybersecurity event, and an event suppression user interface element, wherein the representation of the cybersecurity event includes the event suppression user interface element in response to identifying the cybersecurity event as the event suppression candidate, wherein the event suppression user interface element includes: a textual summary comprising a numerical quantity of a total number of historical cybersecurity events that are substantially similar to the cybersecurity event, wherein each cybersecurity event of the historical cybersecurity events was previously identified as non- malicious by the cybersecurity event detection and response service, and a selectable hyperlink that, when selected, instantiates an event suppression construction user interface object overlaid on the user interface; based on receiving a user input selecting the selectable hyperlink, automatically constructing, over one or more iterations, a computer-executable event suppression instruction by pre-populating a subset of the plurality of distinct pieces of event data into corresponding event suppression configuration data fields included in the event suppression construction user interface object overlaid on the user interface; performing, using the event suppression construction user interface object, one or more event suppression simulations in response to constructing the computer-executable event suppression instruction, wherein each of the one or more event suppression simulations include: automatically assessing one or more corpora of historical cybersecurity event data of a predetermined time span against the computer-executable event suppression instruction; and automatically computing a plurality of distinct cybersecurity threat-informative simulation metrics based on the automatic assessing of the one or more corpora of historical cybersecurity event data against the computer-executable event suppression instruction; and implementing, via one or more processors, the computer-executable event suppression instruction into one or more subscriber-specific cybersecurity environments of the cybersecurity event detection and response service.
18. A method comprising: at a cybersecurity event detection and response service: identifying an event suppression candidate based on identifying a cybersecurity event that satisfies automated event suppression criteria of the cybersecurity event detection and response service; displaying, via a user interface, a representation of the cybersecurity event that includes: a plurality of distinct pieces of event data associated with the cybersecurity event, and an event suppression user interface element, wherein the representation of the cybersecurity event includes the event suppression user interface element in response to identifying the cybersecurity event as the event suppression candidate, wherein the event suppression user interface element includes: a textual summary comprising a numerical quantity of a total number of historical cybersecurity events that are substantially similar to the cybersecurity event, wherein each cybersecurity event of the historical cybersecurity events was previously identified as non- malicious by the cybersecurity event detection and response service, and a selectable hyperlink that, when selected, instantiates an event suppression construction user interface object overlaid on the user interface; based on receiving a user input selecting the selectable hyperlink, automatically constructing, over a plurality of iterations, a computer-executable event suppression instruction by pre-populating a subset of the plurality of distinct pieces of event data into corresponding event suppression configuration data fields included in the event suppression construction user interface object overlaid on the user interface; performing, using the event suppression construction user interface object, one or more event suppression simulations in response to constructing the computer-executable event suppression instruction, wherein each of the one or more event suppression simulations include: automatically assessing one or more corpora of historical cybersecurity event data of a predetermined time span against the computer-executable event suppression instruction; and automatically computing a plurality of distinct cybersecurity threat-informative simulation metrics based on the automatic assessing of the one or more corpora of historical cybersecurity event data against the computer-executable event suppression instruction; and implementing, via one or more processors, the computer-executable event suppression instruction into one or more subscriber-specific cybersecurity environments of the cybersecurity event detection and response service.