SYSTEMS AND METHODS FOR ASSET BASED EVENT PRIORITIZATION FOR REMOTE ENDPOINT SECURITY
Systems and methods for event threat prioritization are provided. In some embodiments, an event priority engine receives event data detected by event agents executing on devices. The events are prioritized and ranked according to threat scores for events generated according to threat indicators which are fed event data and threat data. In some embodiments, security systems may take the approach of prioritizing events based on the endpoints from which they originate using attributes associated with those endpoints. In this way, events can be prioritized at least in part based on the damage to the enterprise that may occur if those events were to compromise security, not just the likelihood of those events actually resulting in a security breach.
1 . A system for evaluating event priority for events, the system comprising:
a processor; and
a non-transitory computer-readable medium; and
stored instructions translatable by the processor for executing an event priority engine, the event priority engine being coupled over a network to a plurality of devices and being configured to:
receive events from the plurality of devices, each device executing an event agent to detect the events;
receive threat intelligence data associated with known threats;
for each received event:
determine a count of occurrences of sensitive data on a device associated with the event by scanning the device;
generate a priority score for the event based on:
a comparison of the event to the threat intelligence data; and
the count of occurrences of sensitive data on the device associated with the event; and
rank the events based on the generated priority scores.