Security threat information analysis

摘要

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for analyzing data that includes security threat information. One of the methods includes identifying intelligence types that each categorizes a subset of data, associating, for each of the intelligence types, each of the subsets of data, which are categorized by the respective intelligence type, with the respective intelligence type, determining rules for a third party that each indicate that the third party should receive data associated with particular types of potential security threats and priority information for the data, determining, for each of the potential security threats indicated in the rules, a group of the subsets that include information associated with the respective potential security threat, assigning, for each subset in each of the groups, a priority to the respective subset using the priority information, and providing the determined subsets to the third party using the respective priorities.

主权项

1. A computer-implemented method comprising:
determining, by one or more computers in an analysis system, one or more intelligence types; categorizing, by at least one of the computers and for each dataset from multiple datasets that each include information about potential security threats, each subset of data for the respective dataset, the categorizing comprising:
identifying, by at least one of the computers and for each of the subsets of data in the respective dataset, an intelligence type that categorizes the subset of data; andassociating, by at least one of the computers and for each of the subsets of data in the respective dataset, the subset of data with the corresponding intelligence type; determining, by at least one of the computers, one or more third party rules that each indicate particular data a particular third party system should receive from the analysis system and third party priority information that represents an order in which the particular data should be provided to the particular third party system, the particular data comprising at least one of i) data representing particular types of the potential security threats, or ii) data categorized by one or more particular intelligence types; determining, by a rule application module on at least one of the computers and for each of the one or more third party rules, a group of the subsets that include information associated with the particular types of the potential security threats or the particular intelligence types; assigning, by a prioritization module on at least one of the computers and for each subset in each of the groups, a priority to the respective subset using the priority information from the third party rules; and sending, by at least one of the computers and to the particular third party system, the subsets in the group of the subsets using the respective priorities.