System and method for cybersecurity analyzer update and concurrent management system

A method for seamlessly updating a cybersecurity system comprising:

• receiving a first plurality of suspicious objects for potential threat analysis;
• generating, by an analyzer logic of the cybersecurity system, a first analyzer configured to analyze the received first plurality of suspicious objects based on at least a portion of cybersecurity analytics content data;
• managing, by an inspection logic of the cybersecurity system, a queue to assign the received first plurality of suspicious objects to the first analyzer for analysis;
• receiving, by an update logic of the cybersecurity system, updated cybersecurity analytics content data;
• generating, by the analyzer logic, a second analyzer configured to analyze suspicious objects based on at least a portion of the updated cybersecurity analytics content data, wherein the second analyzer contains at least one change from the first analyzer in response to the received updated cybersecurity analytics content data;
• receiving, by the inspection logic, a second plurality of suspicious objects for potential threat analysis;
• and
• managing, by the inspection logic, the queue to transfer assigned suspicious objects from the received second plurality of suspicious objects that would have otherwise been directed to the first analyzer to the second analyzer for analysis wherein the transfer between the assignment of the first plurality of suspicious objects and the second plurality of suspicious objects does not comprise a pause in receiving suspicious objects as both the first analyzer and the second analyzer operate concurrently as the first analyzer continues to analyze objects associated with the first plurality of suspicious objects remaining in the queue for threat evaluation based on at least the portion of the cybersecurity analytics content data as the second analyzer analyzes objects associated with the second plurality of suspicious objects for threat evaluation based on at least the portion of the updated cybersecurity analytics content data.

A non-transitory storage medium including software for execution by a processor to seamlessly update a cybersecurity agent, comprising:

• an analyzer logic of the cybersecurity agent configured to receive cybersecurity analytics content data and generate a first analyzer, the first analyzer is configured to receive a suspicious object for threat evaluation and to conduct one or more threat evaluation operations based on a portion of the cybersecurity analytics content data;
• an inspection logic of the cybersecurity agent configured to manage a queue, and to receive and assign a first plurality of suspicious objects to the first analyzer for threat evaluation;
• and
• an update logic of the cybersecurity agent configured to receive updated cybersecurity analytics content data;
• wherein the analyzer logic receives the updated cybersecurity analytics content data and generates a second analyzer wherein the second analyzer that conducts one or more threat evaluation operations based on at least a portion of the updated cybersecurity analytics content data;
• and
• wherein the inspection logic, in response to the generation of the second analyzer, is configured to assign a second plurality of suspicious objects that would have otherwise been directed to the first analyzer to the second analyzer for threat evaluation while both the first analyzer and the second analyzer operate concurrently as the first analyzer continues to process the first plurality of suspicious objects remaining in the queue for threat evaluation based on at least the portion of the cybersecurity analytics content data as the second analyzer processes the second plurality of suspicious objects for threat evaluation based on at least the portion of the updated cybersecurity analytics content data.