Leveraging user-behavior analytics for improved security event classification

A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by one or more processing resources of a cloud-based security platform protecting a private network, causes the one or more processing resources to perform a method comprising:

• maintaining, by a User Entity Behavior Analytics (UEBA)-based security event classification service of the cloud-based security platform, information regarding historical user behavior of a plurality of users of a private network;
• receiving, from an endpoint protection platform running on an endpoint device associated with the private network, an initial classification of an event associated with a process of the endpoint device and contextual information regarding the process and the event;
• responsive to receipt of the initial classification and the contextual information, performing a reclassification of the event based on the contextual information, multiple data feeds internal or external to the cloud-based security platform and the UEBA-based security event classification service external data feeds and the UEBA-based security service;
• and
• causing the endpoint protection platform to allow the process to proceed by providing a resulting security event classification of the reclassification to the endpoint protection platform.