Firewall protection with managed detection and response integration

A threat management computer system, comprising:

• one or more processors;
• one or more computer readable storage media;
• and
• computer readable code stored collectively in the one or more computer readable storage media, with the computer readable code including data and instructions to cause the one or more computer processors to perform a method for responding to a threat comprising:
• identifying, by a managed or extended detection and response system of the threat management computer system, a threat associated with a monitored network system of the threat management computer system;
• sending directly or indirectly, by the managed or extended detection and response system, threat information associated with the threat to a firewall of the monitored network system;
• and
• automatically responding, by the firewall of the monitored network system, to the sent threat information.

A computer program product comprising:

• one or more computer readable storage media having computer readable program code collectively stored on the one or more computer readable storage media, the computer readable program code being executed by one or more processors of a threat management computer system to cause the threat management computer system to perform a method for responding to a threat comprising:
• identifying, by a managed or extended detection and response system, a threat associated with a monitored network system;
• sending directly or indirectly, by the managed or extended detection and response system, threat information associated with the threat to a firewall of the monitored network system;
• and
• automatically responding, by the firewall of the monitored network system, to the sent threat information.

A method for responding to a threat comprising:

• identifying, by a managed or extended detection and response system, a threat associated with a monitored network system;
• sending, by the managed or extended detection and response system, threat information associated with the threat to a central threat management facility system;
• receiving, by the central threat management facility system, the threat information associated with the threat from the managed or extended detection and response system;
• pushing, by the central threat management facility system using an application programming interface (API), the threat information associated with the threat to a firewall of the monitored network system;
• determining, by the firewall of the monitored network system, a malicious host associated with an indicator of compromise including automatically performing, by the firewall, a threat lookup with an indicator of compromise database;
• and
• automatically initiating, by the firewall of the monitored network system, an active threat response to automatically isolate the malicious host across the monitored network system.