Patent ID: 9298910
Filing Date: 2016-03-29
CPC Classification: G06F

Claim Text:
1. A method, comprising: receiving, in an external handler associated with a virtualized platform, an event notification associated with an event in a virtual partition of the virtualized platform, wherein the external handler operates externally to the virtual partition, and wherein a helper agent operating within the virtual partition creates one or more threads for receiving communications from the external handler; causing, by the external handler, a module within the virtual partition to suspend a thread of a process in the virtual partition that caused the event; instructing, by a task request from the external handler, the helper agent to execute a task to identify context information associated with the event and to return results based on the task to the external handler, wherein the task is executed in at least one of the threads created by the helper agent in the virtual partition while the thread of the process that caused the event is suspended; determining, externally to the virtual partition, whether the event violates a security policy, wherein the determining is based, at least in part, on the results returned by the helper agent; and if the event violates the security policy, providing instructions indicating a policy action to be taken within the virtual partition.