AUTOMATED RESPONSES TO SECURITY THREATS

摘要

Systems, methods, and software described herein provide security actions to computing assets of a computing environment. In one example, a method of operating an advisement system to manage security actions for a computing environment includes identifying a security incident for an asset in the environment, and obtaining enrichment information about the security incident. The method further includes identifying a rule set based on the enrichment information, identifying an action response based on the rule set, and initiating implementation of the action response in the computing environment.

主权项

1. A method of operating an advisement system to provide default security actions in a computing environment, the method comprising:
identifying a security incident for an asset in the computing environment; in response to identifying the security incident, identifying enrichment information about the security incident; determining a rule set for the security incident based on the enrichment information; identifying an action response for the security incident based on the rule set; and initiating implementation of the action response for the security incident in the computing environment.