Patent ID: 8689335

Claim:
A method performed by an enterprise security assessment sharing system deployed in an enterprise network for cross-mapping between object types in an enterprise security environment, the object types including user and host machine, the enterprise network comprising a plurality of servers, each server hosting a respective security product endpoint, the method comprising the steps of: associating objects in the environment across object types by tracking usage of host machines by users, at least one of the objects being of an object type selected from the group consisting of a host, user, service and enterprise; receiving a first security assessment from one of the plurality of servers, the first security assessment describing a security incident involving an object in the environment, the first security assessment being arranged to provide contextual meaning to the security incident and being defined with a time interval over which the security assessment is valid; cross object mapping the object described by the first security assessment using the tracked usage to identify potentially compromised objects of a different type; and sharing a second security assessment with at least one server of the plurality of servers, the second security assessment describing the potentially compromised objects identified by the cross object mapping for use by the respective security product endpoint hosted on the at least one server; wherein each security product endpoint incorporates a respective security product in the enterprise network for response to the security incident, the respective security product being different than the security products incorporated by the other security product endpoints.