Agent assisted malicious application blocking in a network environment

At least one non-transitory machine readable storage medium encoded with instructions for blocking malware, wherein the instructions, when executed by a processor cause the processor to:

• receive metadata of a process intercepted by an end host when attempting to access a network, wherein the metadata includes a hash of an application associated with the process and an endpoint reputation score of the application;
• request a threat intelligence reputation score based on the hash of the application;
• determine an action to be taken by the end host based, at least in part, on a policy and at least one of the threat intelligence reputation score and the endpoint reputation score;
• and
• send a response indicating an action to be taken by the end host.

An apparatus for blocking malware, the apparatus comprising:

• a hardware processor;
• a memory element;
• and
• an endpoint intelligence agent configured to run on the processor to:
• receive metadata of a process intercepted by an end host when attempting to access a network, wherein the metadata includes a hash of an application associated with the process and an endpoint reputation score of the application;
• request a threat intelligence reputation score based on the hash of the application;
• determine an action to be taken by the end host based, at least in part, on a policy and at least one of the threat intelligence reputation score and the endpoint reputation score;
• and
• send a response indicating an action to be taken by the end host.

A method for blocking malware, the method comprising:

• receiving metadata of a process intercepted by an end host when attempting to access a network, wherein the metadata includes a hash of an application associated with the process and an endpoint reputation score of the application;
• requesting a threat intelligence reputation score based on the hash of the application;
• determining an action to be taken by the end host based, at least in part, on a policy and at least one of the threat intelligence reputation score and the endpoint reputation score;
• and
• sending a response indicating an action to be taken by the end host.