Agent Message Bus

A method for implementation by one or more computing devices comprising:

• monitoring applications and processes executing on an endpoint for behavior indicative of malicious activity, the applications generating a plurality of messages which are queued in a queue;
• selectively routing a first subject of the messages to be transmitted over the Internet to a remote computing device;
• transmitting a second subset of messages from the queue to an aggregation, correlation, and detection core (AC+DC);
• processing, by the AC+DC, the second subset of messages to result in a plurality of modified messages, the plurality of modified messages being smaller than the second subset of messages;
• and
• causing, by the AC+DC, the modified messages to be placed into the queue for subsequently selective routing.

A method for implementation by one or more computing devices comprising:

• monitoring applications and processes executing on an endpoint for behavior indicative of system health;
• generating a first plurality of messages based on the monitoring, the first plurality of messages being placed in a queue for access;
• receiving a second plurality of messages from an external message source indicative of system health of other computing devices within a same computing environment, the second plurality of messages being placed in the queue;
• transmitting a subset of messages from the queue to an aggregation, correlation, and detection core (AC+DC);
• processing, by the AC+DC, the subset of messages to result in a plurality of modified messages, the plurality of modified messages being smaller than the second subset of messages;
• and
• causing, by the AC+DC, the modified messages to be placed into the queue for subsequently selective routing.

A system comprising:

• an endpoint device including one or more processors and memory storing instructions that, when executed by the one or more processors, cause the endpoint device to:
• monitor applications and processes executing on the endpoint device to generate a plurality of messages indicative of system health;
• and
• enqueue the plurality of messages in a queue;
• and
• a router configured by a routing policy to route a first subset of the messages from the queue to a remote monitoring platform and to route a second subset of the messages from the queue to an aggregation, correlation, and detection core (AC+DC);
• wherein the AC+DC is configured to process the second subset of the messages to produce a plurality of modified messages and to place the plurality of modified messages into the queue for subsequent routing according to the routing policy.