METHOD AND SYSTEM FOR AUTOMATED INCIDENT RESPONSE

摘要

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for implementing a response to one or more security incidents in a computing network. One of the methods includes identifying a security incident based on detecting one or more indicators of compromise associated with the security incident, comparing the security incident with a predefined ontology that maps the security incident to one or more courses of action, selecting a response strategy that includes one or more of the courses of action, and implementing the response strategy as an automated response. 400__ Identify Security Incident Compare Security Incident with Predefined Ontology Select Response Strategy -- ------------------ ----------- F Send One or More Notifications Implement Response Strategy