Musarubra US LLC

Mcafee, Inc.

Leandro I Costantino

Dmitri Rubakha

Francisco Matias Cuenca-Acuna

Hector R Juarez

Diego Naza Pamio

Cristian A Sanchez

Juan Manuel Olle

Jonathan Lewis Edwards

David McCormack

Manish Kumar

Juan M Olle

Embodiments are disclosed herein for remote retrieval of information from endpoints and comprise receiving a master query at an endpoint in a network environment and executing a set of one or more subqueries defined in the master query. Embodiments also comprise an execution of a first subquery that includes executing a function to produce a first output, applying one or more conditions to the first output to determine a second output, and determining a result of the master query based, at least in part, on the second output. In specific embodiments, the master query is received from another node over a network connection. In more specific embodiments, the function is executed on the endpoint to collect real-time information based on one or more parameters. In further embodiments, the function is one of a plug-in or a script.

Query engine for remote endpoint information retrieval

There is disclosed in one example a computing apparatus, including: a hardware platform including a processor and a memory; and instructions encoded within the memory to instruct the processor to: trace, for a plurality of actions having different direct parent actors, a common responsible parent actor, wherein the instructions determine that the common responsible parent actor caused or directed the plurality of actions; compile a report of the plurality of actions, wherein the actions are grouped by the common responsible parent actor; send the report to a machine or human analysis agent; responsive to the report, receive from the analysis agent a remedial action; and execute the remedial action.

Responsible parent process identification

A system for securing electronic devices includes a processor, a storage medium communicatively coupled to the processor, and a monitoring application comprising computer-executable instructions on the medium. The instructions are readable by the processor. The monitoring application is configured to receive an indication that a client has been affected by malware, cause the client to boot from a trusted operating system image, cause a launch of a secured security application on the client from a trusted application image, and analyze a malware status of the client through the secured security application.

End-point visibility

Growing community of inventors

Villa Carlos Paz, Argentina

Leandro I Costantino