US 11,816,501 B2
System and methods for managing high volumes of alerts
Samuel Kevin Small, Baltimore, MD (US); Steven Craig Hanna, Jr., Oakland, CA (US); and Zachary Michael Allen, Baltimore, MD (US)
Assigned to ZeroFOX, Inc., Baltimore, MD (US)
Filed by ZeroFOX, Inc., Baltimore, MD (US)
Filed on Nov. 8, 2019, as Appl. No. 16/678,816.
Prior Publication US 2021/0141666 A1, May 13, 2021
Int. Cl. G06F 9/48 (2006.01); G06F 16/23 (2019.01); G06N 20/00 (2019.01); G06F 16/25 (2019.01)
CPC G06F 9/4881 (2013.01) [G06F 16/2379 (2019.01); G06F 16/252 (2019.01); G06N 20/00 (2019.01)] 20 Claims
OG exemplary drawing
 
1. A system for managing a workflow of tasks comprising:
a database configured to store a plurality of tasks, each task having a unique task ID, a date, a severity level, an enterprise ID, a status, and an assignment field;
a user device;
one or more processors; and
a server configured for execution by the one or more processors to:
receive a work unit request from the user device, the request comprising a strategy for selecting tasks based on at least one of, the date, the enterprise ID, a source of a task, or a confidence level of a machine learning model that created the task;
create a work unit, the work unit having a state indicator, the work unit being a shell or packet that operates within the system;
assign a unique token ID to the work unit;
add, via a queueing service, the work unit to a work unit queue comprising a plurality of other work units, wherein the queueing service provides lag times associated with the plurality of other work units and a buffer between the plurality of other work units in the work unit queue,
wherein the work unit is accessed by the server independently from the plurality of other work units, and wherein the buffer and the lag times are used to prevent duplicate assignment of alerts to work units;
select at least one task from the plurality of tasks in the database based on the strategy;
add the task ID for the at least one selected task to the work unit to create a populated work unit;
change the status of the at least one selected task to indicate the at least one task is checked out only when the user device is authenticated, wherein the user device is authenticated when a work unit token associated with the user device matches the token ID;
insert the token ID into the assignment field;
send the populated work unit to the user device; and
change the state indicator to indicate the work unit is checked out.