Forcepoint LLC

Assaf Almaz

Ofir Arkin

Andrew David Mortensen

David Coffey

Raffael Marty

Nicolas Christian Fischbach

A system, method, and computer-readable medium are disclosed for performing a security operation. The security operation includes monitoring a plurality of electronically-observable actions of an entity, the plurality of electronically-observable actions of the entity corresponding to a respective plurality of events enacted by the entity, the monitoring comprising monitoring the plurality of electronically-observable actions via a protected endpoint; converting the plurality of electronically-observable actions of the entity to electronic information representing the plurality of actions of the entity; generating a representation of occurrences of a particular event from the plurality of events enacted by the entity; and performing an anomaly detection operation based upon the representation of occurrences of the particular event from the plurality of events enacted by the entity, the anomaly detection operation determining when the representation of occurrences of the particular event exceeds a predetermined threshold.

Using content stored in an entity behavior catalog in combination with an entity risk score

A system, method, and computer-readable medium are disclosed for performing a security operation. The security operation includes monitoring a plurality of electronically-observable actions of a first entity, the plurality of electronically-observable actions of the first entity corresponding to a respective first plurality of events enacted by the first entity; monitoring a plurality of electronically-observable actions of a second entity, the plurality of electronically-observable actions of the second entity corresponding to a respective second plurality of events enacted by the second entity; determining whether a first event of the respective first plurality of events and a second event of the respective second plurality of events comprise an entity interaction between the first entity and the second entity; generating an entity interaction map, the entity interaction map providing a representation of the entity interaction between the first entity and the second entity; and, using the entity interaction map to perform a forensics analysis.

Using a security analytics map to perform forensic analytics

A system, method, and computer-readable medium are disclosed for performing a security operation. The security operation includes monitoring a plurality of electronically-observable actions of a first entity, the plurality of electronically-observable actions of the first entity corresponding to a respective first plurality of events enacted by the first entity; monitoring a plurality of electronically-observable actions of a second entity, the plurality of electronically-observable actions of the second entity corresponding to a respective second plurality of events enacted by the second entity; determining whether a first event of the respective first plurality of events and a second event of the respective second plurality of events comprise an entity interaction between the first entity and the second entity; generating an entity interaction map, the entity interaction map providing a representation of the entity interaction between the first entity and the second entity; and, using the entity interaction map to trace the entity interaction between the first entity and the second entity.

Using a security analytics map to trace entity interaction

Anomaly detection using endpoint counters

A system, method, and computer-readable medium are disclosed for performing a security analytics mapping operation. The security analytics mapping operation includes: monitoring a plurality of electronically-observable actions of a first entity, the plurality of electronically-observable actions of the first entity corresponding to a respective first plurality of events enacted by the first entity; monitoring a plurality of electronically-observable actions of a second entity, the plurality of electronically-observable actions of the second entity corresponding to a respective second plurality of events enacted by the second entity; determining whether a first event of the respective first plurality of events and a second event of the respective second plurality of events comprise an entity interaction between the first entity and the second entity; generating an entity interaction map, the entity interaction map providing a representation of the entity interaction between the first entity and the second entity.

Security analytics mapping system

A system, method, and computer-readable medium are disclosed for performing event risk score generation operation. The event risk score generation operation includes identifying an anomalous event from a plurality of events enacted by the entity; generating a first event risk severity score based upon the anomalous event; generating a second event risk severity score based upon a historical entity risk function, the historical entity risk function providing an indication of historical security risk of the entity; generating an entity risk severity score for the entity, the generating using the historical entity risk function and the event risk severity score; performing a risk-adaptive prevention operation, the risk-adaptive prevention operation using the entity risk severity score, the risk-adaptive prevention operation adaptively responding to mitigate risk associated with the anomalous event.

Using an entity reputation when calculating an entity risk score

Risk score calculation and distribution

A system, method, and computer-readable medium are disclosed for performing a event risk severity score generation operation. The event risk severity score generation operation includes monitoring a plurality of electronically-observable actions of an entity, the plurality of electronically-observable actions of the entity corresponding to a respective plurality of events enacted by the entity; converting the plurality of electronically-observable actions of the entity to electronic information representing the plurality of actions of the entity; identifying an anomalous event from the plurality of events enacted by the entity; generating an event severity risk score based upon the anomalous event; generating an entity risk severity score for the entity, the generating using the event risk severity score; and, performing a risk-adaptive prevention operation, the risk-adaptive prevention operation using the entity risk severity score, the risk-adaptive prevention operation adaptively responding to mitigate risk associated with the anomalous event.

Growing community of inventors

Raanana, Israel

Assaf Almaz