Generating an entity behavior profile based upon sessions

A system comprising:

• a processor;
• a data bus coupled to the processor;
• and
• a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
• monitoring an entity, the monitoring observing at least one electronically-observable data source, the monitoring comprising monitoring at least one of a plurality of electronically-observable actions via a protected endpoint;
• deriving an observable based upon the monitoring of the electronically-observable data source;
• identifying a security related activity of the entity, the security related activity being based upon the observable derived from the electronic data source, the security related activity being of analytic utility;
• associating the security related activity with a session;
• processing an entity behavior profile of the entity and contextual information relating to the entity to generate an inference regarding the entity;
• generating an entity behavior profile element based upon the security related activity and the session;
• and
• performing the security operation via the protected endpoint and a security analytics system, the security operation using the entity behavior entity behavior profile element and the inference regarding the entity, the security analytics system executing on a security analytics system hardware processor.

A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:

• monitoring an entity, the monitoring observing at least one electronically-observable data source, the monitoring comprising monitoring at least one of a plurality of electronically-observable actions via a protected endpoint;
• deriving an observable based upon the monitoring of the electronically-observable data source;
• identifying a security related activity of the entity, the security related activity being based upon the observable derived from the electronic data source, the security related activity being of analytic utility;
• associating the security related activity with a session;
• processing an entity behavior profile of the entity and contextual information relating to the entity to generate an inference regarding the entity;
• generating an entity behavior profile element based upon the security related activity and the session;
• and,
• performing the security operation via the protected endpoint and a security analytics system, the security operation using the entity behavior entity behavior profile element and the inference regarding the entity, the security analytics system executing on a security analytics system hardware processor.