Endpoint with remotely programmable data recorder

Patent metadata

Field	Value
Publication number	US-12079757-B2
Application number	US-202318449315-A
Country	US
Kind code	B2
Filing date	Aug 14, 2023
Priority date	Aug 31, 2018
Publication date	Sep 3, 2024
Grant date	Sep 3, 2024

Abstract

An endpoint coupled in a communicating relationship with an enterprise network may include a data recorder configured to store an event stream of data indicating events on the endpoint including types of changes to computing objects, a filter configured to locally process the event stream into a filtered event stream including a subset of types of changes to the computing objects, and a local security agent. The local security agent may be configured to transmit the filtered event stream to a threat management facility, respond to a filter adjustment from the threat management facility by adjusting the filter to modify the subset of types of changes included in the filtered event stream, and respond to a query from the threat management facility by retrieving data stored in the data recorder over a time window before the query and excluded from the filtered event stream.

First claim

What is claimed is:

1. A computer program product comprising a non-transitory computer readable medium embodying computer executable code that, when executing on one or more computing devices, causes the one or more computing devices to perform steps of:
storing in a data recorder an event stream of data indicating events on an endpoint including a plurality of types of changes to a plurality of computing objects on the endpoint;
processing the event stream with a filter into a filtered event stream including a subset of the plurality of types of changes to the plurality of computing objects;
transmitting the filtered event stream over an enterprise network to a threat management facility;
responding to a local change in security posture detected on the endpoint by adjusting the filter to modify the subset of the plurality of types of changes included in the filtered event stream;
receiving a query from the threat management facility for additional event data from the event stream stored in the data recorder in response to the change in security posture; and
responding to the query from the threat management facility by retrieving data stored in the data recorder over a time window before the query and excluded from the filtered event stream.

2. The computer program product of claim 1 , wherein the local change is based on a reputation score for one or more processes on the endpoint.

3. The computer program product of claim 1 , wherein the local change is based on a reputation score for one or more files on the endpoint.

4. The computer program product of claim 1 , wherein the local change includes a change in policy compliance posture of the endpoint.

5. The computer program product of claim 1 , wherein the local change includes a malware detection.

6. The computer program product of claim 1 , wherein adjusting the filter includes decreasing filtering of the types of changes included in the filtered event stream.

7. The computer program product of claim 1 , wherein adjusting the filter includes decreasing filtering for one or more of the plurality of computing objects.

8. A method comprising:
storing, in a data recorder, an event stream of data indicating events on an endpoint including a plurality of types of changes to a plurality of computing objects on the endpoint;
processing the event stream with a filter into a filtered event stream including a subset of the plurality of types of changes to the plurality of computing objects;
transmitting the filtered event stream over an enterprise network to a threat management facility;
responding to a change in security posture of the endpoint by adjusting the filter to modify the subset of the plurality of types of changes included in the filtered event stream;
receiving a query from the threat management facility for additional event data from the event stream stored in the data recorder in response to the change in security posture; and
responding to the query from the threat management facility by retrieving data stored in the data recorder over a time window before the query and excluded from the filtered event stream.

9. The method of claim 8 , wherein the change in security posture includes a change in policy compliance of the endpoint.

10. The method of claim 8 , wherein the change in security posture includes a malware detection by a local security agent.

11. The method of claim 8 , wherein the change in security posture is based on a change in a reputation score for one or more processes on the endpoint.

12. The method of claim 8 , wherein the change in security posture is based on a change in a reputation score for one or more files on the endpoint.

13. The method of claim 8 , wherein adjusting the filter includes decreasing filtering for one or more of the plurality of computing objects.

14. An endpoint coupled in a communicating relationship with an enterprise network, the endpoint comprising:
a data recorder configured to store an event stream of data indicating events on the endpoint including a plurality of types of changes to a plurality of computing objects on the endpoint;
a filter configured to locally process the event stream into a filtered event stream including a subset of the plurality of types of changes to the plurality of computing objects; and
a local security software agent configured to:
transmit the filtered event stream over the enterprise network to a threat management facility;
respond to a change in a security posture of the endpoint by adjusting the filter to modify the subset of the plurality of types of changes included in the filtered event stream;
receive a query from the threat management facility for additional event data from the event stream stored in the data recorder in response to the change in security posture; and
respond to the query from the threat management facility by retrieving data stored in the data recorder over a time window before the query and excluded from the filtered event stream.

15. The endpoint of claim 14 , wherein the change in security posture includes a change in policy compliance of the endpoint.

16. The endpoint of claim 14 , wherein the change in security posture includes a malware detection by the local security software agent.

17. The endpoint of claim 14 , wherein the change in security posture is based on a change in a reputation score for one or more processes on the endpoint.

18. The endpoint of claim 14 , wherein the change in security posture is based on a change in a reputation score for one or more files on the endpoint.

19. The endpoint of claim 14 , wherein adjusting the filter includes decreasing filtering for one or more of the plurality of computing objects.

Assignees

• Sophos Ltd

Inventors

• Ladnai Beata
• Harris Mark D
• Smith Andrew G P
• Ray Kenneth D
• Thomas Andrew J
• Humphries Russell

Classifications

• G06Q30/0283

  Price estimation or determination · CPC title

• G06Q30/0185

  Product, service or business identity fraud · CPC title

• G06N5/01

  Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound · CPC title

• G06F18/24143

  Distances to neighbourhood prototypes, e.g. restricted Coulomb energy networks [RCEN] · CPC title

• G06F18/23213

  with fixed number of clusters, e.g. K-means clustering · CPC title