Elastic Machine Learning Threat Detection (Phase 2)
Description
The AI is intended to solve the problem of effectively identifying and prioritizing cyber threats. By creating aggregation models and decision tree models, the AI aims to synthesize information from various sources, including Phase 1 models and new use cases, to provide a comprehensive understanding of user behavior and machine communication patterns. This will allow for the isolation and ranking of cyber threats, facilitating faster and more accurate escalation to threat hunting and incident response teams.
AI / analytics pattern
Classical/Predictive Machine Learning
Automation level / stage
c) Deployed - The use case is being actively authorized or utilized to support the functions or mission of an agency.
Expected benefit
Efficiency, productivity, service quality
Controls / human review
Inventory row should be validated against agency governance and M-25-21 controls.