System, method, and computer program product with vulnerability and intrusion detection components

A system, comprising:

• at least one server including at least one first data storage that stores potential vulnerability information describing a plurality of potential vulnerabilities, the at least one server operable for communicating the potential vulnerability information;
• first code for:
• identifying at least one configuration associated with at least one networked device, and
• communicating configuration information describing the at least one configuration associated with the at least one networked device;
• second code for:
• identifying an occurrence in connection with the at least one networked device, and
• communicating occurrence information describing the occurrence in connection with the at least one networked device;
• a vulnerability component operable for:
• receiving, from the at least one server, the potential vulnerability information describing the potential vulnerabilities,
• receiving, from the first code, the configuration information describing the at least one configuration associated with the at least one networked device,
• determining whether the at least one networked device is actually vulnerable to at least one actual vulnerability based on the configuration information describing the at least one configuration associated with the at least one networked device, and the potential vulnerability information describing the potential vulnerabilities, and storing actual vulnerability information describing the at least one actual vulnerability to which the at least one networked device is actually vulnerable;
• an intrusion prevention component operable for:
• receiving, from the vulnerability component, the actual vulnerability information describing the at least one actual vulnerability to which the at least one networked device is actually vulnerable,
• receiving, from the second code, the occurrence information describing the occurrence in connection with the at least one networked device,
• in response to the occurrence, determining whether the occurrence is capable of taking advantage of the at least one actual vulnerability, based on the actual vulnerability information describing the at least one actual vulnerability to which the at least one networked device is actually vulnerable, and the occurrence information describing the occurrence in connection with the at least one networked device,
• displaying reporting information, via at least one intrusion prevention component user interface and in connection with the occurrence, based on the determination whether the occurrence is capable of taking advantage of the at least one actual vulnerability,
• displaying, via the at least one intrusion prevention component user interface, a plurality of options to cause different actions of different types to be automatically completed in connection with the at least one networked device that is actually vulnerable to the at least one actual vulnerability, for occurrence mitigation, and
• based on user input selecting at least one of the options, causing at least one of the actions to be automatically completed in connection with the at least one networked device that is actually vulnerable to the at least one actual vulnerability, for at least mitigating the occurrence.

A computer program product embodied on a non-transitory computer readable medium, comprising:

• code for communicating with at least one server including at least one first data storage that stores potential vulnerability information on a plurality of potential vulnerabilities, the at least one server operable for communicating the potential vulnerability information;
• code for:
• identifying at least one configuration associated with at least one device, and
• communicating configuration information on the at least one configuration associated with the at least one device;
• code for:
• identifying an occurrence in connection with the at least one device, and
• communicating occurrence information on the occurrence in connection with the at least one device;
• code for:
• receiving the potential vulnerability information on the potential vulnerabilities,
• receiving the configuration information on the at least one configuration associated with the at least one device,
• determining whether the at least one device is actually vulnerable to at least one actual vulnerability based on the configuration information on the at least one configuration associated with the at least one device, and the potential vulnerability information on the potential vulnerabilities, resulting in actual vulnerability information on the at least one actual vulnerability to which the at least one device is actually vulnerable;
• displaying, via at least one intrusion prevention system user interface, at least one option to cause different actions to be completed in connection with the at least one device;
• based on user input, causing at least one of the actions to be automatically completed in connection with the at least one device;
• receiving the occurrence information on the occurrence in connection with the at least one device;
• and
• in response to the occurrence, determining whether the occurrence is capable of taking advantage of at least one particular vulnerability, based on the occurrence information on the occurrence in connection with the at least one device;
• wherein the computer program product is operable such that the occurrence is prevented from taking advantage of the at least one particular vulnerability, regardless of whether there is no update at the at least one device that removes the at least one particular vulnerability from the at least one device.

A computer program product embodied on a non-transitory computer readable medium, comprising:

• code for communicating with at least one server including at least one first data storage that stores potential vulnerability information relating to a plurality of potential vulnerabilities, the at least one server operable for communicating the potential vulnerability information;
• code for:
• identifying at least one configuration associated with at least one device, and
• communicating configuration information relating to the at least one configuration associated with the at least one device;
• code for:
• identifying an occurrence in connection with the at least one device, and
• communicating occurrence information relating to the occurrence in connection with the at least one device;
• code for:
• receiving the potential vulnerability information relating to the potential vulnerabilities,
• receiving the configuration information relating to the at least one configuration associated with the at least one device,
• determining whether the at least one device is actually vulnerable to at least one actual vulnerability based on the configuration information relating to the at least one configuration associated with the at least one device, and the potential vulnerability information relating to the potential vulnerabilities, resulting in actual vulnerability information relating to the at least one actual vulnerability to which the at least one device is actually vulnerable;
• displaying, via at least one intrusion prevention user interface, at least one option to cause different actions of different types to be completed in connection with the at least one device, the different actions of different types including:
• a first action for dropping or blocking packets for occurrence mitigation, and
• a second action for blocking a connection request;
• based on user input, causing at least one of the actions to be completed in connection with the at least one device utilizing at least one communication sent thereto;
• receiving the occurrence information relating to the occurrence in connection with the at least one device;
• and
• in response to the occurrence, determining whether the occurrence is capable of taking advantage of at least one particular vulnerability, based on the occurrence information relating to the occurrence in connection with the at least one device;
• wherein the computer program product is operable such that the occurrence is mitigated utilizing at least one of the first action or the second action based on the user input, regardless of whether there is no update at the at least one device that removes the at least one particular vulnerability from the at least one device.