Patent ID: 11882135
Assignee: FORTINET, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 14:
15. A method for generating a playbook to facilitate incident response by a Security Orchestration, Automation and Response (SOAR) platform, the method comprising:
capturing, by the SOAR platform, information regarding execution of a sequence of one or more actions performed by one or more analysts responsive to a first incident of a first type, wherein the one or more actions include one or more of: extracting one or more indicators of the first incident, determining a reputation score of one or more indicators of the first incident; analyzing a severity level of the incident based on a reputation score of at least one indicator of the first incident, or processing incident data of the first incident based on a severity level of the incident;
in response to a second incident observed by the SOAR platform that is similar in nature to the first incident or the first type, generating a recommended sequence of one or more actions for use by an analyst in connection with responding to the second incident, wherein the recommended sequence is generated based on applying a machine-learning model to the captured information; and
in response to rejection of the recommended sequence by the analyst, revising the recommended sequence based on input provided by the analyst and storing the revised recommendation sequence in a form of a revised playbook for response to subsequent incidents that are similar to the second incident.