US 12,250,234 B2
Endpoint security architecture with programmable logic engine
John Dwyer, Hampstead, MD (US); Benjamin McNichols, West Friendship, MD (US); Martin Pillion, Rancho Cordova, CA (US); and Kevin Wenchel, Marriottsville, MD (US)
Assigned to Nuix Limited, Sydney (AU)
Filed by Nuix Limited, Sydney (AU)
Filed on Oct. 20, 2023, as Appl. No. 18/382,442.
Application 18/382,442 is a continuation of application No. 16/245,770, filed on Jan. 11, 2019, granted, now 11,831,658.
Claims priority of provisional application 62/620,110, filed on Jan. 22, 2018.
Prior Publication US 2024/0048571 A1, Feb. 8, 2024
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 29/00 (2006.01); H04L 9/40 (2022.01); H04L 41/046 (2022.01)
CPC H04L 63/1416 (2013.01) [H04L 41/046 (2013.01); H04L 63/0263 (2013.01); H04L 63/20 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A system for providing an integrated security management framework for an enterprise having a plurality of endpoint devices, each endpoint device comprising a deployed endpoint agent configured to continuously monitor and record activity on the respective endpoint device and further execute one or more sets of detection and response logic rules for managing the detection of, and response to, any activity associated with the respective endpoint device that poses a potential security threat to the enterprise, the system comprising:
a server configured to communicate and exchange data with the one or more of the endpoint devices over a network, the server comprising a hardware processor coupled to non-transitory, computer-readable memory containing instructions executable by the processor to cause the server to:
provide a security management platform comprising an interface with which an authorized user can interact to monitor endpoint agent activity and manage functionality of at least one endpoint agent deployed on one of the one or more endpoint devices;
provide an integrated development environment (IDE) operably coupled to the interface;
receive, from the authorized user via the interface, input comprising custom, declarative programming language input to the IDE to write, develop, and/or modify, on-the-fly, one or more customized sets of detection and response logic rules to be executed by an endpoint agent; and
output, to the endpoint agent, a customized set of detection and response logic rules.