Patent ID: 11882128
Assignee: FORTINET, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 0:
1. An endpoint device, on a data communication network, for automated response to suspicious incidents, comprising:
a processing resource;
a network interface, communicatively coupled to the processing resource and a data communication network; and
a non-transitory computer-readable medium, communicatively coupled to the processing resource, having stored therein instructions that when executed by the processing resource cause the processing resource to:
detect and block a connection associated with a suspicious incident;
identify other similar control alerts similar to the suspicious incident;
determine whether a file or a connection associated with the process was reported by other security controls, based on the similar control alerts;
determine whether other devices reported similar activity;
classify the suspicious incident based on whether the file was reported and whether other devices reported similar activity and augment the suspicious incident and reclassify an initial classification using user entity behavior analytics when initial classification of the suspicious incident is inconclusive;
enrich a notification of the suspicious incident with the classification and produce a final classification to reduce false positives; and
take an automated security remediation action based on the suspicious event classification from the enriched notification.