System and method for operating a protected endpoint device

A system comprising:

• a processor;
• a data bus coupled to the processor;
• and
• a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
• receiving, at an endpoint collector operating on the protected endpoint, information corresponding to activities occurring on an endpoint platform of the endpoint device wherein the endpoint platform comprises one or more of the kernel and user space of the endpoint device;
• placing, by the endpoint collector, a plurality of events corresponding to the activities on a message bus;
• receiving, at an endpoint agent comprising an ingress filter and an egress filter, one or more of the plurality of events from the message bus at an input of the ingress filter;
• selectively processing, by the endpoint agent, one or more of the plurality of events received on the message bus, wherein
• the plurality of events selectively processed by the endpoint agent are events to which the endpoint agent has subscribed,
• the events to which the endpoint agent has subscribed are selectively passed by the ingress filter to an output of the ingress filter to the exclusion of non-subscribed events,
• the endpoint agent comprises an event analysis module and an egress filter both configured to receive events from the output of the ingress filter,
• said selectively processing comprises
• generating, by the event analysis module, endpoint agent communications based on an analysis of the events received from the output of the ingress filter, and
• selectively passing events received from the output of the ingress filter through the egress filter to a service connection, and
• the endpoint agent communications are broadcast on the message bus;
• and
• providing the service connection between the endpoint agent and a software service, wherein communications between the endpoint agent and software service include information corresponding to one or more of the subscribed events.

A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:

• receiving, at an endpoint collector operating on the protected endpoint, information corresponding to activities occurring on an endpoint platform of the endpoint device wherein the endpoint platform comprises one or more of the kernel and user space of the endpoint device;
• placing, by the endpoint collector, a plurality of events corresponding to the activities on a message bus;
• receiving, at an endpoint agent comprising an ingress filter and an egress filter, one or more of the plurality of events from the message bus at an input of the ingress filter;
• selectively processing, by the endpoint agent, one or more of the plurality of events received on the message bus, wherein
• the plurality of events selectively processed by the endpoint agent are events to which the endpoint agent has subscribed,
• the events to which the endpoint agent has subscribed are selectively passed by the ingress filter to an output of the ingress filter to the exclusion of non-subscribed events,
• the endpoint agent comprises an event analysis module and an egress filter both configured to receive events from the output of the ingress filter,
• said selectively processing comprises
• generating, by the event analysis module, endpoint agent communications based on an analysis of the events received from the output of the ingress filter, and
• selectively passing events received from the output of the ingress filter through the egress filter to a service connection, and
• the endpoint agent communications are broadcast on the message bus;
• and
• providing the service connection between the endpoint agent and a software service, wherein communications between the endpoint agent and software service include information corresponding to one or more of the subscribed events.