Patent ID: 11888883
Assignee: INTERNATIONAL BUSINESS MACHINES CORPORATION
Field: Computer technology (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 16:
17. A computer program product in a non-transitory computer readable medium for use in a data processing system for threat disposition analysis, the computer program product holding computer program instructions that, when executed by the data processing system, are operative to:
retrieve a threat disposition score (TDS) in response to receipt of a security threat identified in an alert, the threat disposition score generated from a machine learning scoring model built from information about historical security threats, including historical disposition of one or more alerts associated with the historical security threats, the TDS based in part on an effectiveness of a prior calculated TDS to predict a particular historical disposition associated with the alert;
augment the alert to include the threat disposition score to generate an enriched alert; and
present the enriched alert for further handling;
wherein the historical disposition of at least one alert comprises feedback from a second security analyst on handling of the at least one alert by a first security analyst.