Abstract: Methods, apparatus, and processor-readable storage media for generating security policies for end-user devices using group rankings and partial policy determinations are provided herein. An example computer-implemented method includes ranking end-user device groups within an enterprise, wherein each of the groups is associated with one or more security-related policy settings; assigning a given end-user device to two or more of the groups based on device parameters attributed to the given end-user device; generating a policy for the given end-user device by performing partial policy determinations across the two or more groups to which the given end-user device is assigned, wherein performing the partial policy determinations comprises defining, in an order based at least in part on the ranking of the groups, security-related settings from the two or more groups, until all security-related settings required by the policy are defined; and outputting the policy to the given end-user device.

Abstract: Methods, apparatus, and processor-readable storage media for generating security policies for end-user devices using group rankings and partial policy determinations are provided herein. An example computer-implemented method includes ranking end-user device groups within an enterprise, wherein each of the groups is associated with one or more security-related policy settings; assigning a given end-user device to two or more of the groups based on device parameters attributed to the given end-user device; generating a policy for the given end-user device by performing partial policy determinations across the two or more groups to which the given end-user device is assigned, wherein performing the partial policy determinations comprises defining, in an order based at least in part on the ranking of the groups, security-related settings from the two or more groups, until all security-related settings required by the policy are defined; and outputting the policy to the given end-user device.

Abstract: An apparatus in one embodiment comprises a first endpoint device having a processor coupled to a memory. The first endpoint device is adapted for communication with other endpoint devices over a network, and implements a key capture agent configured to interface with an operating system of the first endpoint device. The key capture agent is configured to collect key material associated with a session key utilized to encrypt packets sent by the first endpoint device to a second endpoint device over the network as part of a corresponding session. The key material and an identifier of the corresponding session are transmitted for delivery to a decoder that is not part of the first or second endpoint devices, so as to permit the decoder to be configured to decrypt the encrypted packets in intercepted network traffic. For example, the key capture agent may be configured to transmit the key material.

Abstract: Systems and methods for performing customizable analysis of a communication session between two entities includes loading predetermined first parser definitions, stored as at least one binary file, receiving second parser definitions in a form other than a binary file form, after the first parser definitions are already operating, loading and compiling the second parser definitions, and applying the first and second parser definitions to a communication session, wherein the first parser definitions identify standard components of the communication session and the second parser definitions are customizable and identify non-standard components of the communication session.

Abstract: Systems and methods for performing customizable analysis of a communication session between two entities includes loading predetermined first parser definitions, stored as at least one binary file, receiving second parser definitions in a form other than a binary file form, after the first parser definitions are already operating, loading and compiling the second parser definitions, and applying the first and second parser definitions to a communication session, wherein the first parser definitions identify standard components of the communication session and the second parser definitions are customizable and identify non-standard components of the communication session.