ACTIVE VERIFICATION OF SECURITY INFRASTRUCTURE

Abstract: in order to actively monitor functioning of security infrastructure such as local security agents on endpoints in an enterprise system, a security update is created for the endpoints that includes a detection rule for use by the local security agents, along with a separate computing object including a trigger for the detection rule. the security update can be stored, e.g., at a threat management facility or similar, for retrieval by endpoints during a security update. when the security update is retrieved by an endpoint, it can be unpacked to add the detection rule to the local security agent, and then to add the trigger to the endpoint protected by the local security agent. a successful detection of the trigger by the (updated) local security agent on an endpoint can be transmitted to the threat management facility as a verification that the endpoint security measures are properly functioning and receiving updates.

Inventor(s): Jonathan Michael Shaw

CPC Classification: H04L63/1416 ({Event detection, e.g. attack signature detection})

Search for rejections for patent application number 20250175473