Dynamically updated user interface for threat investigation

A method comprising:

• receiving, at a threat management facility, a scheduled transmittal of events in an event stream pushed from an endpoint on a predetermined schedule;
• detecting an intermediate threat on the endpoint based on the event stream;
• in response to detecting the intermediate threat, automatically requesting a transmittal of supplemental information pulled by the threat management facility from a data recorder on the endpoint to supplement the event stream pushed from the endpoint on the predetermined schedule with event data from a window of time preceding a detection by the threat management facility of the intermediate threat;
• receiving the supplemental information;
• and
• displaying the intermediate threat and the supplemental information in a user interface for user disposition of the intermediate threat.

A system comprising:

• an endpoint executing a data recorder to store an event stream of event data including a plurality of types of changes to a plurality of computing objects detected on the endpoint, the endpoint further executing a local agent configured to process the event stream with a filter into a filtered event stream, the local agent further configured to communicate a scheduled transmittal of the filtered event stream to a remote resource over a data network on a predetermined schedule;
• and
• a threat management facility configured to:
• receive the filtered event stream pushed from the endpoint;
• process the filtered event stream to identify an intermediate threat;
• in response to identifying the intermediate threat, automatically request a transmittal of supplemental information pulled by the threat management facility from the data recorder of the endpoint to supplement the event stream pushed from the endpoint on the predetermined schedule with event data from a window of time preceding a detection by the threat management facility of the intermediate threat;
• and
• display the intermediate threat and the supplemental information in a user interface configured for user disposition of the intermediate threat.