Security analytics system for performing a non-sanctioned entity interaction analysis operation when determining entity risk

A system comprising:

• a processor;
• a data bus coupled to the processor;
• and
• a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
• monitoring an entity, the monitoring observing an electronically-observable data source, the entity being included within a first entity group;
• identifying an interaction between the entity and another entity based upon the monitoring;
• analyzing the interaction between the entity and the another entity;
• determining whether the interaction between the entity and the another entity is a non-sanctioned entity interaction, the non-sanctioned entity interaction comprising an interaction between the entity and the another entity whose enactment does not comply with a policy instituted by the first entity group;
• and,
• performing a security operation via a security analytics system in response to the analyzing the interaction when the interaction is non-sanctioned, the security operation being performed by at least one of an endpoint device and the security analytics system, the endpoint device executing the security operation on a hardware processor associated with the endpoint device, the security analytics system executing the security operation on a hardware processor associated with the security analytics system.

A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:

• monitoring an entity, the monitoring observing an electronically-observable data source;
• identifying an interaction between the entity and another entity based upon the monitoring, the entity being included within a first entity group;
• analyzing the interaction between the entity and the another entity;
• determining whether the interaction between the entity and the another entity is a non-sanctioned entity interaction, the non-sanctioned entity interaction comprising an interaction between the entity and the another entity whose enactment does not comply with a policy instituted by the first entity group;
• and,
• performing a security operation via a security analytics system in response to the analyzing the interaction when the interaction is non-sanctioned, the security operation being performed by at least one of an endpoint device and the security analytics system, the endpoint device executing the security operation on a hardware processor associated with the endpoint device, the security analytics system executing the security operation on a hardware processor associated with the security analytics system.