SYSTEM AND METHOD EMPLOYING STRUCTURED INTELLIGENCE TO VERIFY AND CONTAIN THREATS AT ENDPOINTS

摘要

A system and method to detect and contain threatening executable code by employing a threat monitor, verifier, endpoint agent, and a security information and event management module.

主权项

1. A computerized method to identify potentially malicious code at an endpoint in a network, the method comprising the steps of:
via a threat monitor:
monitoring network data;extracting at least one set of network data;processing the at least one set of network data to generate a report; via a verifier including an agent coordinator, issuing at least one of (i) instructions, and (ii) indicators to an endpoint agent based on the report; and processing, via the endpoint agent, the at least one of (i) instructions, and (ii) indicators to generate verification information.