Threat response using event vectors

A computer program product for assessing and responding to risk in an enterprise network, the computer program product comprising computer executable code embodied in a non-transitory computer-readable medium that, when executing on one or more computing devices, performs the steps of:

• instrumenting a compute instance in the enterprise network with a number of sensors to detect events from a number of computing objects associated with the compute instance;
• storing a first entity model for an entity associated with the compute instance at a local security agent for the compute instance, the entity including at least one of a domain controller, a physical device, a user, an operating system, or an application associated with the compute instance, and the first entity model characterizing a pattern of events expected from the number of sensors in a vector space;
• receiving events from the number of computing objects at the local security agent on the compute instance;
• collecting a plurality of the events into an event vector in the vector space;
• calculating a first risk score with the local security agent based on a first distance between the event vector and the first entity model in the vector space;
• when the first risk score exceeds a first threshold, deploying a first remedial action for the compute instance from the local security agent;
• storing a second entity model for the entity at a threat management facility for the enterprise network, the second entity model characterizing a second pattern of events expected from the number of sensors in the vector space;
• transmitting the event vector to the threat management facility;
• calculating a second risk score with the threat management facility based on a second distance between the event vector and the second entity model;
• and
• when the second risk score exceeds a second threshold, deploying a second remedial action for the compute instance from the threat management facility.