Patent ID: 11876819
Assignee: SENTINEL LABS ISRAEL LTD.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 10:
11. A computer-implemented method for protecting security of an elastic computer network, the elastic computer network comprising one or more endpoint devices and an enterprise network, the computer-implemented method comprising:
monitoring, by one or more manager computing systems, through each software agent of a plurality software agents operating on the one or more endpoint devices forming the elastic computer network, one or more network communications of a corresponding endpoint device to obtain endpoint data, wherein the one or more endpoint devices comprise one or more cellphones, servers, virtual machines, laptops, tablets, desktop computers, Internet of Things (IoT) devices, wearable devices, or smart home devices;
receiving, by the one or more manger computing system, the endpoint data transmitted by each software agent through an electronic communications network, wherein the endpoint data is configured to allow the one or more manager computing system to identify network access behaviors or processor behaviors of the one or more endpoint devices;
analyzing, by the one or more manager computing system, the endpoint data;
identifying, by the one or more manager computing system, one or more anomalous indicators on one or more endpoint devices based at least in part on the normalized endpoint data;
transmitting, by the one or more manager computing system, one or more alerts through the electronic communications network, the one or more alerts based on the one or more anomalous indicators;
generating, by the one or more manager computing system, a visualization of one or more network characteristics related to security and network management functionalities, the generating the visualization based at least in part on the identification of the one or more anomalous indicators on the one or more endpoint devices, the visualization configured for display to a user via a dynamic user interface;
receiving, by the one or more manager computing system from a user via the dynamic user interface, one or more user inputs, the one or more user inputs comprising commands for responding to the one or more anomalous indicators on the one or more endpoint devices; and
responding, by the one or more manager computing system, to the one or more anomalous indicators based at least in part on the one or more user inputs comprising commands for responding to the one or more anomalous indicators, wherein the responding comprises limiting one or more operating system processes or network communications of the one or more endpoint devices,
wherein the one or more endpoint devices and the one or more manager computing system comprise one or more electronic processors and one or more electronic data stores.