Parametric behavioral pattern definition

A system comprising:

• a processor;
• a communications interface;
• a memory having stored thereon a security agent including a matcher that recognizes a pattern of behavior (PoB), the PoB including an empty field;
• the memory further having a first definition stored in a first definition file thereon, the first definition including a first value corresponding to the empty field;
• and
• wherein the security agent, when executed by the processor, configures the system to perform operations including:
• obtaining, via the communications interface, a second definition file including the first definition and a second definition that includes a second value corresponding to the empty field;
• obtaining behavior information regarding behavior exhibited by a computing device and corresponding to the pattern of behavior;
• accumulating the behavior information into a test pattern based at least in part on detecting that the behavior information corresponds with at least part of the pattern of behavior;
• and
• determining whether the test pattern matches a first union of the PoB with the empty field populated by the first value or a second union of the PoB with the empty field populated by the second value.

A method comprising:

• obtaining, via a communications interface, a test pattern from a security agent operating on a monitored computing device, the test pattern including:
• a value that characterizes a portion of behavior exhibited by the monitored computing device and observed by the security agent;
• making available for selection, via a display device, a plurality of behavior identifiers and a plurality of dispositions for selection;
• obtaining selections corresponding to a behavior identifier and a disposition from among the plurality of behavior identifiers and the plurality of dispositions, an individual behavior identifier of the plurality of behavior identifiers being associated with one or more dispositions;
• based at least in part on obtaining the selections, creating a definition that includes the behavior identifier, the disposition, and the value;
• and
• transmitting, via the communications interface, the definition to the security agent.

A method comprising:

• obtaining event information based on behavior exhibited by a computing device;
• accumulating the event information to create a test pattern;
• determining whether the test pattern matches any one of a plurality of definitions by determining whether the test pattern matches a pattern of behavior (PoB) having one or more empty fields populated by corresponding one or more parameter values of a respective one of the plurality of definitions;
• and
• initiating an action based on a determination that the test pattern matches the PoB with the empty field of the PoB populated by a parameter value of a matched definition and based on a disposition or behavior identifier associated with the matched definition.