Threat detection and security for edge devices

A method performed by instructions executed by at least one computing device, the method comprising:

• transmitting, from a management service to a gateway security process executed in a gateway device, a baseline behavior profile for a gateway virtual machine executed by a gateway hypervisor of the gateway device;
• receiving, by the management service from the gateway device, an anomaly notification comprising an indication that the gateway virtual machine is associated with an anomaly from the baseline behavior profile;
• generating, by the management service, a user interface comprising a description of the anomaly from the baseline behavior, wherein a user interface element indicates to permit the anomaly;
• generating, by the management service, an updated baseline behavior profile based on data describing the anomaly, wherein the updated baseline behavior profile permits the anomaly as an acceptable behavior;
• and
• transmitting, by the management service to the gateway security process, a command to apply the updated baseline behavior profile.

A non-transitory computer-readable medium comprising instructions executed by at least one processor, wherein the instructions, when executed by the at least one processor, cause the at least one computing device to at least:

• transmit, from a management service to a gateway security process executed in a gateway device, a baseline behavior profile for a gateway virtual machine executed by a gateway hypervisor of the gateway device;
• receive, by the management service from the gateway device, an anomaly notification comprising an indication that the gateway virtual machine is associated with an anomaly from the baseline behavior profile;
• and
• generate, by the management service, a user interface comprising a description of the anomaly from the baseline behavior, wherein a user interface element indicates to permit the anomaly;
• generate, by the management service, an updated baseline behavior profile based on data describing the anomaly, wherein the updated baseline behavior profile permits the anomaly as an acceptable behavior;
• and
• transmit, by the management service to the gateway security process, a command to apply the updated baseline behavior profile.