Elastic Machine Learning Threat Detection (Phase 2)
Description
The AI is intended to solve the problem of effectively identifying and prioritizing cyber threats. By creating aggregation models and decision tree models, the AI aims to synthesize information from various sources, including Phase 1 models and new use cases, to provide a comprehensive understanding of user behavior and machine communication patterns. This will allow for the isolation and ranking of cyber threats, facilitating faster and more accurate escalation to threat hunting and incident response teams.
AI / analytics pattern
Classical/Predictive Machine Learning: Models trained on data to make predictions or classifications based on identified patterns or relationships.
Automation level / stage
c) Deployed – The use case is being actively authorized or utilized to support the functions or mission of an agency.
Controls / human review
ATO: Not reported; PIA: Not published