# US 12,003,545 B2 · System account access manager utilizing an endpoint detection and response system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,003,545 B2 - Document ID: US12003545B2 - Status: Granted - Kind: B2 - Application number: 17/503,366 - Filed: 2021-10-18 - Published: 2022-06-30 - Granted: 2024-06-04 - Earliest claimed: 2020-12-28 - Assignees: Netwrix Corporation - Applicants: Netwrix Corporation - Inventors: Paul Lanzi; Timothy Keeler - Web page: https://patentgrep.com/patent/US12003545B2 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/0272: {Virtual private networks} - H04L 63/102: {Entity profiles} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In one aspect, a computerized system includes an access manager server connected to one or more target computer systems. The access manager server is connected to the one or more target computer systems via an Endpoint Detection and Response (EDR) system. The EDR system continually monitors one or more target computer systems (e.g. endpoints) and responds to mitigate a cyber threat to the one or more target computer systems. The EDR system includes an EDR control plane that manages and communicates with one or more EDR agents. The EDR control plane causes a specific computer security action in the one or more target computer systems via one or more EDR agents. One or more EDR agents are installed in the one or more target computer systems. The one or more EDR agents are made available via the EDR API. ## Claims ### Claim 1 A computerized system comprising: an access manager server connected to one or more target computer systems, wherein the access manager server is connected to the one or more target computer systems via an Endpoint Detection and Response (EDR) system, and wherein the access manager server is configured to detect that a network line of sight is not available to one or more target computers; an EDR system, wherein the EDR system continually monitors and responds to mitigate a cyber threat to the one or more target computer systems, wherein the EDR comprises: an EDR control plane that manages and communicates with one or more EDR agents, wherein the EDR control plane causes a specified action in the one or more target computer systems via one or more EDR agents, one or more EDR agents that are installed in the one or more target computer systems, wherein the one or more EDR agents are made available via the EDR API, and wherein through the EDR API, the access manager server communicates a request to the EDR control plane to implement various actions, and an EDR API that communicates the specified action from the access manager server to the EDR control plane; the one or more target computer systems compromises computer devices protected by a set of cyber security specified functionalities implemented by the access manager server. ### Claim 2 (depends on 1) The computer system of claim 1, wherein the specified action comprises a specified computer system security action, wherein the computer devices comprises a computer hardware device or a computer virtual device, and where the set of specified functionalities comprises a set of cyber security functionalities. ### Claim 3 (depends on 1) The computer system of claim 1, wherein the access manager server is configured to detect that the target computer is not using a virtual private network (VPN) to connect to a specified network from a remote location. ### Claim 4 (depends on 3) The computer system of claim 3, wherein the one or more target computers remains exposed to the EDR control plane via an indirect computer network when the access manager server detects that the network line of sight is not available to the one or more target computers. ### Claim 5 (depends on 4) The computer system of claim 4, wherein the access manager server interfaces with the EDR system to execute a specified computer system security action through EDR API. ### Claim 6 (depends on 4) The computer system of claim 4, wherein the access manager server leverages the EDR system to implement an application allow-listing in the one or more target computer systems. ### Claim 7 (depends on 4) The computer system of claim 4, wherein the access manager server leverages the EDR system to implement and/or retrieve data from a process level monitoring and logging operation in the one or more target computer systems. ### Claim 8 (depends on 4) The computer system of claim 4, wherein the access manager server leverages the EDR system to add and remove accounts from permission to access an application in the one or more target computer systems. ### Claim 9 (depends on 4) The computer system of claim 4, wherein the access manager server leverages the EDR system to implement a dynamic privilege management that temporarily gives privileges to a specified user in the one or more target computer systems. ### Claim 10 (depends on 4) The computer system of claim 4, wherein the access manager server leverages the EDR system to implement an account management operation in the one or more target computer systems. ### Claim 11 (depends on 4) The computer system of claim 4, wherein the access manager server leverages the EDR system to implement and/or determine a specified cyber security health state in the one or more target computer systems. ### Claim 12 (depends on 4) The computer system of claim 4, wherein the access manager server leverages the EDR system to implement a geofencing operation in the one or more target computer systems. ### Claim 13 (depends on 4) The computer system of claim 4, wherein the access manager server leverages the EDR system to implement a specified discovery of a risk event operation in the one or more target computer systems. ### Claim 14 (depends on 13) The computerized system of claim 13, wherein the access manager server periodically calls on the EDR API and collects a set of risk event data from the one or more target computer systems using the one or more EDR agents. ### Claim 15 (depends on 13) The computerized system of claim 13, wherein the access manager server causes the EDR system to set an event trigger in the one or mar target computer systems and to notify the access manager server about any specific security events that are detected by EDR agents in the one or more target computer systems that are related to the event trigger. ### Claim 16 (depends on 4) The computer system of claim 4, wherein the access manager server leverages the EDR system to register new endpoints when any new computer systems are added to the one or more EDR systems. ### Claim 17 (depends on 4) The computer system of claim 4, wherein the access manager server leverages the EDR system to provide reports about current managed target computer systems in the one or more EDR systems. ### Claim 18 (depends on 4) The computer system of claim 4, wherein the access manager server leverages the EDR system to revoke Just-In-Time Privileged Access Management (JITA) rights of systems that access the one or more target computer systems. ### Claim 19 (depends on 1) The computer system of claim 1, wherein the access manager server is configured to request that the one or more EDR agents implement the specified task on the target computer when the access manager server detects that the network line of sight is not available to the one or more target computers.