Expel, Inc.

A system, method, and computer-program product includes obtaining a security event, retrieving a set of historical security events related to the security event in response to searching an embeddings space, automatically generating a plurality of metadata similarity assessment prompts and a plurality of proposed event handling prompts after retrieving the set of historical security events, automatically providing the plurality of metadata similarity assessment prompts and the plurality of proposed event handling prompts to one or more language models, obtaining, from the one or more language models, a plurality of metadata similarity findings and a plurality of proposed event handling actions based on the one or more language models processing the plurality of metadata similarity assessment prompts and the plurality of proposed event handling prompts, and displaying, on a user interface, the security event in association with the plurality of metadata similarity findings and the plurality of proposed event handling actions.

A system, method, and computer-implemented method includes generating a security alert for a subscriber, executing an automated investigation protocol for the security alert, obtaining, in response to executing a first plurality of computer-executable investigation queries and a second plurality of computer-executable investigation queries, a corpus of investigation findings data indicative of whether the security alert corresponds to a security threat or a benign security alert, and displaying, using a graphical user interface, the security alert in association with the corpus of investigation findings data.

A system and method for accelerating a disposition of non-malicious electronic communications includes extracting one or more corpora of feature vectors from an electronic communication based on providing the electronic communication as input to a feature extractor; computing, by a machine learning-based electronic communication classification model, an electronic communication-type classification inference that includes a probability of the electronic communication being of the target non-malicious electronic communication type in response to the machine learning-based electronic communication classification model receiving the one or more corpora of feature vectors; attributing a classification label of the target non-malicious electronic communication type to the electronic communication based on the probability of the electronic communication-type classification inference satisfying a minimum electronic communication classification threshold; and automatically routing a security alert associated with the electronic communication to an alert disposal queue based on the electronic communication having the classification label of the target non-malicious electronic communication type.

A system, method, and computer-program product includes generating a polling task that is configured to retrieve raw event data of a subscriber that occurred during a target time span from a third-party security service, computing an optimal polling frequency control value for the polling task in response to generating the polling task, partitioning the target time span into a plurality of distinct sub-intervals of time based on the optimal polling frequency control value computed for the polling task, automatically transmitting, to an application programming interface endpoint of the third-party security service, a plurality of distinct network requests to optimally perform the polling task, receiving the raw event data of the subscriber from the third-party security service that occurred during the target time span in response to transmitting the plurality of distinct network request, and generating one or more security alerts in response to processing the raw event data.

A system, method, and computer-program product includes displaying, via a data integration building user interface, a plurality of integration-identifying user interface input elements configured to receive one or more strings of text for specifying a set of integration identification parameters that characterize an in-development security integration for a third-party security service, displaying, via the data integration building user interface, a signal-specific data mapping container based on receiving an input selecting a signal mapping addition control button of the data integration building user interface, displaying, via the data integration building user interface, a raw event simulation container based on receiving an input selecting a simulation addition control button of the data integration building user interface, and displaying, via the data integration building user interface, an integration deployment control element that, when operated, transitions the in-development security integration to a deployed security integration.

A system, method, and computer-implemented method includes generating a security alert for a subscriber, executing an automated investigation protocol for the security alert, obtaining, in response to executing a first plurality of computer-executable investigation queries and a second plurality of computer-executable investigation queries, a corpus of investigation findings data indicative of whether the security alert corresponds to a security threat or a benign security alert, and displaying, using a graphical user interface, the security alert in association with the corpus of investigation findings data.

A system and method for generating event-specific handling instructions for accelerating a threat mitigation of a cybersecurity event includes identifying a cybersecurity event; generating a cybersecurity event digest based on the cybersecurity event, computing a cybersecurity hashing-based signature of the cybersecurity event based on the cybersecurity event digest; searching, based on the distinct cybersecurity hashing-based signature of the cybersecurity event, an n-dimensional space comprising a plurality of historical cybersecurity event hashing-based signatures; returning one or more historical cybersecurity events or historical cybersecurity alerts homogeneous to the cybersecurity event based on the search; deriving one or more cybersecurity event-specific handling actions for the cybersecurity event based on identifying a threat handling action corresponding to each of the one or more historical cybersecurity events or historical cybersecurity alerts homogeneous to the cybersecurity event; and executing one or more cybersecurity threat mitigation actions to resolve or mitigate the cybersecurity event.

A system and method for using digitally signed web tokens to securely share sensitive data includes identifying an API request that includes an authorization header comprising authentication data; assessing the authentication data of the API request against a corpus of valid authentication data; identifying the authentication data as valid authentication data and a target entity that corresponds to the authentication data; obtaining a set of permissions associated with the target entity; generating a digitally signed protobuf web token that includes a representation of the target entity and a representation of the set of permissions associated with the target entity; and based on the generation of the digitally signed protobuf web token: adapting the API request to an adapted API request that includes a header component comprising the digitally signed protobuf web token; and transmitting the adapted API request to a target API-processing service.

A system and method for accelerating a disposition of non-malicious electronic communications includes extracting one or more corpora of feature vectors from an electronic communication based on providing the electronic communication as input to a feature extractor; computing, by a machine learning-based electronic communication classification model, an electronic communication-type classification inference that includes a probability of the electronic communication being of the target non-malicious electronic communication type in response to the machine learning-based electronic communication classification model receiving the one or more corpora of feature vectors; attributing a classification label of the target non-malicious electronic communication type to the electronic communication based on the probability of the electronic communication-type classification inference satisfying a minimum electronic communication classification threshold; and automatically routing a security alert associated with the electronic communication to an alert disposal queue based on the electronic communication having the classification label of the target non-malicious electronic communication type.

A method includes generating a polling task that is configured to retrieve raw event data of a subscriber that occurred during a target time span from a third-party security service, computing an optimal polling frequency control value for the polling task in response to generating the polling task, partitioning the target time span into a plurality of distinct sub-intervals of time based on the optimal polling frequency control value computed for the polling task, automatically transmitting, to an application programming interface endpoint of the third-party security service, a plurality of distinct network requests to optimally perform the polling task, receiving the raw event data of the subscriber from the third-party security service that occurred during the target time span in response to transmitting the plurality of distinct network request, and generating one or more security alerts in response to processing the raw event data.