Malware detection verification and enhancement by coordinating endpoint and malware detection systems

A non-transitory computer-readable medium including software that, upon execution within a security logic engine, conducts analyses to determine whether an object is malicious representative of a cyber-attack is being conducted on a network, comprising:

• receiving a first set of events associated with a first object and a second set of events associated with a second object that is different from the first set of events, wherein (1) the first set of events is provided from a first endpoint of a plurality of endpoints within a network and each event of the first set of events corresponds to information related to a behavior monitored during processing of the first object by the first endpoint, and (2) the second set of events is provided from an analysis system different from an endpoint of the plurality of endpoints and each event of the second set of events corresponds to information related to a behavior monitored during processing of the second object by the analysis system;
• generating, by the security logic engine, a first determination of a likelihood of the cyber-attack being conducted on the network by at least correlating the first set of events and the second set of events with at least events associated with at least known malicious objects;
• generating a first alert to report the first determination of the likelihood of the cyber-attack occurring at the first endpoint;
• and
• determining a scope of the cyber-attack by at least identifying whether one or more endpoints of the plurality of endpoints having a different software profile than the first endpoint are vulnerable to the cyber-attack based on (i) obtaining the different software profile from the one or more endpoints, (ii) providing the different software profile to the analysis system, (iii) receiving a third set of events corresponding to analysis results representing a processing of the first object by an endpoint with the different software profile, (iv) performing a second determination to confirm or modify the likelihood of the cyber-attack being conducted on the network based on the analysis results, and (v) generating a second alert to report the second determination to enlarge the scope of the cyber-attack in response to confirming the cyber-attack being directed to multiple of different endpoints within the network.