US 12,113,814 B2
User device agent event detection and recovery
Adam Pettit, San Diego, CA (US); Wesley Pettit, San Diego, CA (US); Mark Daughters, San Diego, CA (US); and Brandon Modesitt, Encinitas, CA (US)
Assigned to Kandji, Inc., San Diego, CA (US)
Filed by Kandji, Inc., San Diego, CA (US)
Filed on Nov. 28, 2023, as Appl. No. 18/520,806.
Claims priority of provisional application 63/385,734, filed on Dec. 1, 2022.
Prior Publication US 2024/0187427 A1, Jun. 6, 2024
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/1416 (2013.01) [H04L 63/145 (2013.01)] 18 Claims
OG exemplary drawing
 
1. A method, comprising:
receiving, from a remote management platform, a plurality of security rules at an endpoint detection and response (EDR) module at a user device;
subscribing, by the EDR module, to one or more event types at the user device;
receiving, at the EDR module, a notification of an event corresponding to one of the subscribed event types;
upon determining, by the EDR module, that the event is associated with a file stored at the user device, instantiating, by an event tracer module, an event tracer tree that is associated with the file;
identifying, by the EDR module, a plurality of files in a file system at the user device to be scanned;
for each identified file, instantiating, by the EDR module, a respective sequential file reading thread;
upon receiving file data from each associated sequential file reading thread by a plurality of hash function threads at the EDR module, generating a plurality of file hash values by calculating a plurality of hash functions concurrently for each sequential file reading thread;
generating, by the EDR module, a file hash value of the plurality of file hash values for the file using the event tracer tree;
upon determining, by the EDR module, that the file hash value satisfies a security rule, quarantining the file; and
reporting to a management platform that the file has been quarantined.