Least recently used (lru)-based event suppression

A system comprising:

• one or more processors;
• and
• a security agent configured to be executed by the one or more processors to:
• observe events that occur on a computing device as observed events, the observed events being associated with processes executing on the computing device;
• insert the observed events into a least recently used (LRU) table that tracks, for a subset of the observed events maintained in the LRU table, a rate-based statistic for multiple event groups in which the subset of the observed events are classified;
• determine that a value of the rate-based statistic for an event group of the multiple event groups satisfies a threshold associated with the LRU table;
• and
• send the observed events that are classified in the event group to a remote security system with suppression by refraining from sending, to the remote security system, at least some of the observed events that are classified in the event group.

One or more non-transitory computer-readable media storing computer-executable instructions for a security agent that, when executed by one or more processors of a computing device, perform operations comprising:

• observing, by the security agent, events that occur on the computing device as observed events, the observed events being associated with processes executing on the computing device;
• inserting the observed events into a least recently used (LRU) table that tracks, for a subset of the observed events maintained in the LRU table, a rate-based statistic for multiple event groups in which the subset of the observed events are classified;
• determining that a value of the rate-based statistic for an event group of the multiple event groups satisfies a threshold associated with the LRU table;
• and
• sending the observed events that are classified in the event group to a remote security system with suppression by refraining from sending, to the remote security system, at least some of the observed events that are classified in the event group.