Automatically generating security policies

A system comprising:

• a processor;
• a data bus coupled to the processor;
• and
• a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
• gathering information related to an organization, the information related to the organization comprising electronically-observable information related to the organization, the monitoring being performed by a protected endpoint, the protected endpoint comprising an endpoint agent executing on an endpoint device, the endpoint agent comprising an entity-specific security policy feature pack;
• converting the electronically-observable information related to the organization into electronic information related to the organization;
• using the electronic information related to the organization to automatically generate a plurality of organization specific rules;
• generating an organization specific security policy, the organization specific security policy comprising at least one organization specific rule, the organization specific security policy comprising an aggregation of a plurality of entity specific security policies, each of the plurality of entity specific security policies corresponding to a respective entity, each respective entity having a corresponding user profile, each corresponding user profile comprising a collection of information that uniquely describes an identify of the respective entity, the collection of information comprising a user profile attribute, a user behavior factor and a user mindset factor, the mindset factor comprising information used to determine a mental state of a user at a particular point in time;
• the organization specific security policy comprises a risk-adaptive security policy, the risk-adaptive security policy comprising a security policy implemented to be revised to adaptively remediate risk associated with a user behavior, the user behavior being represented via a plurality of risk-adaptive behavior factors, the plurality of risk-adaptive behavior factors comprising at least one user behavior factor and a user mindset factor and
• using the organization specific security policy to perform a security analytics operation, the security analytics operation identifying anomalous, abnormal, unexpected, or malicious user behavior, the security analytics operation being performed by a security analytics system, the security analytics system communicating with the protected endpoint via a network.

A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:

• gathering information related to an organization, the information related to the organization comprising electronically-observable information related to the organization, the monitoring being performed by a protected endpoint, the protected endpoint comprising an endpoint agent executing on an endpoint device, the endpoint agent comprising an entity-specific security policy feature pack,
• converting the electronically-observable information related to the organization into electronic information related to the organization;
• using the electronic information related to the organization to automatically generate a plurality of organization specific rules;
• generating an organization specific security policy, the organization specific security policy comprising at least one organization specific rule, the organization specific security policy comprising an aggregation of a plurality of entity specific security policies, each of the plurality of entity specific security policies corresponding to a respective entity, each respective entity having a corresponding user profile, each corresponding user profile comprising a collection of information that uniquely describes an identify of the respective entity, the collection of information comprising a user profile attribute, a user behavior factor and a user mindset factor, the mindset factor comprising information used to determine a mental state of a user at a particular point in time;
• the organization specific security policy comprises a risk-adaptive security policy, the risk-adaptive security policy comprising a security policy implemented to be revised to adaptively remediate risk associated with a user behavior, the user behavior being represented via a plurality of risk-adaptive behavior factors, the plurality of risk-adaptive behavior factors comprising at least one user behavior factor and a user mindset factor and,
• using the organization specific security policy to perform a security analytics operation, the security analytics operation identifying anomalous, abnormal, unexpected, or malicious user behavior, the security analytics operation being performed by a security analytics system, the security analytics system communicating with the protected endpoint via a network.