| CPC G06F 21/554 (2013.01) [G06F 21/566 (2013.01); G06F 21/577 (2013.01)] | 23 Claims |
|
1. A method comprising:
monitoring applications and processes executing on an endpoint for behavior indicative of malicious activity;
generating a plurality of messages based on the monitoring, the messages being placed in a queue for access by a router;
routing, by the router, a first subset of the messages from the queue as defined by a routing policy to be transmitted to a cloud-connected monitoring platform;
transmitting, by the router, a second subset of messages from the queue as defined by the routing policy to an aggregation, correlation, and detection core (AC+DC);
processing, by the AC+DC, the second subset of messages to result in a plurality of modified messages, the plurality of modified messages being smaller than the second subset of messages; and
causing, by the AC+DC, the modified messages to be placed into the queue for subsequently selective routing by the router according to the routing policy.
|