Systems and methods for endpoint process metadata based policy enforcement

A non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors of a cloud-based security service to perform steps of:

• monitoring traffic, via the cloud-based security service, the traffic being monitored inline between one or more endpoints and one or more destinations;
• identifying, by the cloud based security service, within a request from an endpoint, endpoint process metadata associated with an endpoint process used to make the request, wherein the endpoint process metadata includes one or more of a signor name, signature timestamp, product name, product version, original file name, executable hash, Process Identity (PID), process name, process owner, and process running duration of the endpoint process;
• processing, by the cloud-based security service, the endpoint process metadata which includes the product version, the processing includes determining if the product version of the endpoint process is a latest version available;
• and
• responsive to the processing, performing, by the cloud-based security service, one or more security actions on the request, including at least one of blocking the request, allowing the request, bypassing Transport Layer Security (TLS) decryption for the request, and alerting a user of the endpoint via a connector application.