Automated lifecycle system operations for threat mitigation

Abstract

Techniques are described for automatically performing lifecycle operations to mitigate identified threats via an intrusion detection (IDS) system and a lifecycle operations manager (LOM). In one example, a notification from an IDS is received at a LOM, the notification indicating a malicious activity associated with a particular application included in an enterprise software environment monitored by the IDS. The application can be associated with a first endpoint accessible via a navigation target, where the navigation target sends requests received at the navigation target to the first endpoint. In response to receiving the notification, automatically and without user input, the LOM executes at least one countermeasure operation including creating a new copy of the application, associating the new copy of the application with a different second endpoint, and updating the navigation target to cause the navigation target to send requests to the new copy of the application at the second endpoint.