Patent Document ID: 20170302685
Application ID: 15130244
Patent Status: 0

Claim One:
1. A computer program product for forensic analysis for computer processes, the computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on a computing device, performs the steps of: instrumenting a first endpoint to monitor a number of causal relationships among a number of computing objects, and to record a sequence of events causally relating the number of computing objects; detecting a security compromise event associated with one of the number of computing objects; in response to detecting the security compromise event, traversing an event graph based on the sequence of events in a reverse order from the one of the computing objects associated with the security compromise event to one or more preceding ones of the computing objects; applying a cause identification rule to the preceding ones of the computing objects and the causal relationships while traversing the event graph to identify one of the computing objects as a cause of the security compromise event; and traversing the event graph forward from the cause of the security compromise event to identify one or more other ones of the computing objects compromised by the cause.