Patent ID: 11949719
Assignee: OPEN TEXT HOLDINGS, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 0:
1. A method for endpoint security monitoring, the method comprising:
providing, by a computer in an enterprise network, editable security definitions to a user device, the user device having a user interface adapted for composing, modifying, or enhancing the editable security definitions, wherein the editable security definitions having same format are converted from security definitions in disparate formats, wherein the security definitions include an indicator of compromise (IOC) definition, wherein an IOC refers to an artifact or a piece of data that can serve as forensic evidence of an unusual activity on the enterprise network, and wherein the IOC definition comprises a Boolean structure or references another IOC definition, a behavior rule, or a vulnerability description;
receiving or retrieving, by the computer from the user device, a composed or modified security definition, wherein the composed or modified security definition preserves the Boolean structure or the reference to another IOC definition, to the behavioral rule, or to the vulnerability description; and
compiling, by the computer, the composed or modified security definition into an executable rule, wherein the executable rule is executable by the computer or an endpoint of the enterprise network to produce a result indicative of an endpoint security action needed in view of an endpoint event that meets the composed or modified security definition.