Multi-factor authentication in endpoint detection and response

A system comprising:

• one or more computer readable storage media storing program instructions;
• and
• one or more processors which, in response to executing the program instructions, are configured to perform a method comprising:
• detecting, by an Endpoint Detection and Response (EDR) function in a networked environment comprising a plurality of endpoints, a security incident on a first endpoint of the plurality of endpoints;
• identifying an administrator of the first endpoint;
• initiating a process requiring Multi-Factor Authentication (MFA) associated with the administrator of the first endpoint by:
• transmitting a push notification to a second device associated with the administrator;
• and
• receiving a response to the push notification from the second device;
• and
• characterizing, by the EDR function, a maliciousness of the security incident based on the response.

A computer program product comprising one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media, the program instructions comprising instructions configured to cause one or more processors to perform a method comprising:

• detecting, by an Endpoint Detection and Response (EDR) function in a networked environment comprising a plurality of endpoints, a security incident on a first endpoint of the plurality of endpoints;
• identifying an administrator of the first endpoint;
• initiating a process requiring Multi-Factor Authentication (MFA) associated with the administrator of the first endpoint by:
• transmitting a push notification to a second device associated with the administrator;
• and
• receiving a response to the push notification from the second device;
• and
• characterizing, by the EDR function, a maliciousness of the security incident based on the response.