Configuring security policies in response to detecting a pivot of an intrusion

One or more non-transitory computer-readable storage media storing instructions which, when executed by one or more hardware processors, cause performance of a method comprising:

• receiving an indication of intrusion activity in first network activity directed to a first internal resource of a first system, the intrusion activity including an indication of success of an intrusion of the first internal resource;
• determining an occurrence of a pivot of the intrusion, wherein the determination of the occurrence of the pivot of the intrusion is based on an indication of a transmission from the first internal resource to a second internal resource within the first system;
• configuring an extrusion detection policy for the second internal resource in response to determining the occurrence of the pivot of the intrusion from the first internal resource to the second internal resource;
• receiving an indication of extrusion activity in second network activity directed from the second internal resource to a second system, the second system external to the first system;
• and
• performing a security process in response to receiving the indication of the extrusion activity.

An apparatus comprising:

• one or more hardware processors;
• and
• memory coupled to the one or more hardware processors, the memory storing instructions which, when executed by the one or more hardware processors, causes the apparatus to:
• receive an indication of intrusion activity in first network activity directed to a first internal resource of a first system, the intrusion activity including an indication of success of an intrusion of the first internal resource;
• determine an occurrence of a pivot of the intrusion, wherein the determination of the occurrence of the pivot of the intrusion is based on an indication of a transmission from the first internal resource to a second internal resource within the first system;
• configure an extrusion detection policy for the second internal resource in response to determining the occurrence of the pivot of the intrusion from the first internal resource to the second internal resource;
• receive an indication of extrusion activity in second network activity directed from the second internal resource to a second system, the second system external to the first system;
• and
• perform a security process in response to receiving the indication of the extrusion activity.