Endpoint detection and response system event characterization data transfer

A computer-implemented method comprising:

• monitoring, by an endpoint computer system, data relating to a plurality of events occurring within an operating environment of the endpoint computer system, the monitoring comprising (a) receiving and/or inferring the data using one or more sensors executing on the endpoint computer system and (b) receiving and/or inferring at least some of the data using additional data generated external to the endpoint computer system and received by the endpoint computer system by way of a communications interface over a communications network;
• storing, for the endpoint computer system, (i) the events, (ii) artifacts used in connection with the plurality of events, and/or (iii) metadata associated with the events and/or the artifacts, in a tamper resistant, self-contained vault maintained on such endpoint computer system;
• identifying and retrieving, by the endpoint computer system in response to a trigger, data from the vault that is associated with the trigger;
• and
• providing, by the endpoint computer system, the identified and retrieved data to a remote server;
• wherein the storing of the artifacts in the vault further comprises determining, based on one or more criteria, to retain in the vault a first subset of the artifacts associated with a software-based attack and to exclude from the vault a second subset of the data not associated with a software-based attack.

A system comprising:

• at least one data processor;
• and
• memory storing instructions which, when executed by the at least one data processor, implements operations comprising:
• monitoring, by an endpoint computer system, data relating to a plurality of events occurring within an operating environment of the endpoint computer system, the monitoring comprising receiving and/or inferring the data using one or more sensors executing on the endpoint computer system;
• storing and encrypting, for the endpoint computer system, artifacts used in connection with the plurality of events in a vault maintained on such endpoint computer system;
• identifying and retrieving, by the endpoint computer system in response to a trigger, metadata characterizing the artifacts associated with the trigger from the vault;
• and
• providing, by the endpoint computer system, the identified and retrieved metadata to a remote server;
• wherein the storing and encrypting of the artifacts in the vault further comprises determining, based on one or more criteria, to retain in the vault a first subset of the artifacts associated with a software-based attack and to exclude from the corresponding vault a second subset of the data not associated with a software-based attack.

A system comprising:

• a plurality of endpoint computer systems;
• and
• a server;
• wherein the plurality of endpoint computer systems and the server operate in concert to implement operations comprising:
• monitoring, by each of endpoint computer systems, data relating to a plurality of events occurring within an operating environment of the endpoint computer system, the monitoring comprising receiving and/or inferring the data using one or more sensors executing on the endpoint computer system;
• storing, for each endpoint computer system, artifacts used in connection with the plurality of events in a vault maintained on such endpoint computer system;
• identifying and retrieving, by each endpoint computer system in response to a trigger, metadata characterizing artifacts among the stored artifacts that are associated with the trigger from the vault;
• and
• providing, by each endpoint computer system, the identified and retrieved metadata to a remote server;
• wherein:
• the data is initially monitored according to a first set of data collection criteria;
• a machine learning model determines that a heightened level of alert is necessary;
• and
• storing of the artifacts in the vault further comprises determining, based on one or more criteria, to retain in the vault, a first subset of the artifacts associated with a software-based attack and to exclude from such vault a second subset of the data not associated with a software-based attack.

A non-transitory computer program product storing instructions which, when executed by at least one data processor forming part of at least one computing device, result in operations comprising:

• initially monitoring, by an endpoint computer system, data relating to a plurality of events occurring within an operating environment of the endpoint computer system, the monitoring comprising receiving and/or inferring the data using one or more sensors executing on the endpoint computer system;
• determining that a heightened level of alert is necessary;
• subsequently monitoring, by the endpoint computer system, data relating to the plurality of events occurring within the operating environment according to a second set of data collection criteria which causes (i) an increased amount of data to be monitored and (ii) a greater amount of artifacts to be stored in the vault;
• storing and encrypting, for the endpoint computer system, the artifacts used in connection with the plurality of events in a tamper resistant, self-contained vault maintained on such endpoint computer system;
• identifying and retrieving, by the endpoint computer system in response to a trigger, metadata characterizing the artifacts associated with the trigger from the vault;
• and
• providing, by the endpoint computer system, the identified and retrieved metadata to a remote server;
• wherein storing and encrypting of the artifacts in the vault further comprises determining, based on one or more criteria, to retain in the vault a first subset of the artifacts associated with a software-based attack and to exclude from such vault a second subset of the data not associated with a software-based attack.