Inline exploit detection via loose condition forwarding and cloud analysis

Abstract

Techniques for inline exploit detection via loose condition forwarding and cloud analysis (e.g., cloud-based security analysis) are disclosed. In some embodiments, a system/process/computer program product for inline exploit detection via loose condition forwarding and cloud analysis includes monitoring network traffic of a session at a security platform; selecting a subset of the monitored network traffic associated with the session to send to a cloud-based security service for analysis based on a security policy, wherein the selected subset of the monitored network traffic is determined to be associated with suspicious session traffic that is selected using a prefilter condition (e.g., a prefilter signature, heuristics, machine learning implemented prefiltering condition, etc.) for an unknown exploit; and receiving, from the cloud-based security service, results of the analysis based on the security policy, and performing a responsive action based on the results of the analysis based on the security policy.