Patent ID: 7707637

Claim:
A method for managing a security threat in a distributed system, comprising: configuring a processor to perform the steps of: detecting data correlated to suspicious activity in a distributed element of the distributed system; and reporting data correlated to the suspicious activity from a distributed element to a threat management agent configured to achieve a coordinated response to the threat; determining, by the threat management agent based on an aggregate of data correlated to the suspicious activity received from distributed elements in the distributed system, whether an attack is taking place at least at one distributed element identified by the data correlated to the suspicious activity; and deploying a coordinated countermeasure to the attack including a preventive deployment of a countermeasure to at least one distributed element not initially reporting data correlated to suspicious activity, as directed by the threat management agent, based on the attack determination by the threat management agent, within a time window based on the preventive deployment of a countermeasure when a next attack is predicted to occur, wherein the coordinated countermeasure comprises adjustment of at least one distributed element of the distributed system where the data correlated to suspicious activity was not detected.