Abstract: Systems and methods are disclosed for providing network security monitoring in a computer network. In an embodiment, network configuration data may be gathered and processed by a data collector from a plurality of network devices within the computer network. An agent residing on a client device within the computer network may collect network configuration data on the client device and provide the collected network configuration data to the data collector. The network configuration data may be provided to a data analyzer for analysis. A privileged authentication even may then be detected on the client device, and live collection of network metadata related to the detected privileged authentication event may be initiated on the client device upon detecting the privileged authentication event. The network metadata may be provided to the data analyzer for analysis.

Abstract: Systems and methods are disclosed for providing emergency alert and tracking data from a mobile device. A panic mode may be activated on the mobile device. The panic mode may be activated via a button sequence on the mobile device, based on a geofence trigger, based on physical movement of or contact with the mobile device, or via a wearable device connected to the mobile device. Upon activation, other nearby devices may be detected. Each detected device may include at least one identifier. Situational data may also be periodically collected via one or more sensors of the mobile device, and the detected device identifiers and collected situational data may be transmitted to a tracking database. An alert may be sent to one or more parties in a panic group associated with the mobile device in response to activating the panic mode.

Abstract: Systems and methods are disclosed for detecting malicious lateral activity within a computer network. In an embodiment, an agent, implemented on one or more computing devices, subscribes to a plurality of privileged authentication events on a network node within the computer network, provides an alert to a network administrator in response to detection of one of the subscribed privileged authentication events, and initiates live collection of network metadata in response to the detection of the subscribed privileged authentication event. A security monitoring device, implemented on the one or more computing devices, includes an analyzer configured to detect when the network node has connected to the computer network and deploy the agent to the network node in response to the node connecting to the network. The agent may provide the collected network metadata to the analyzer.

Abstract: Systems and methods are disclosed for providing security monitoring in a computer network, in an embodiment, a service accessible via a network port of a network node within the network is identified. The assigned port number for the identified service is changed to a second port number and a trap is configured including one or more criterion. A trap may be configured to capture network traffic that meets the one or more criterion of the trap. A data packet is then received. It is determined whether data packet meets the one or more criterion of the configured trap, and if so, the data packet is redirected to a ghost network. The ghost network may replicate network services, applications, and infrastructure in the computer network. The ghost network may additionally gather activity data based on the redirected data packet.

Abstract: Systems and methods are disclosed for determining locations visited by a mobile device. In an embodiment, a first location point is identified from a plurality of location points associated with the mobile device. The first location point may be combined with one or more of the plurality of location points to construct a time block. A time block may indicate a continuous period of time when the mobile device is in the same location. An aggregate location is calculated for the time block based on the plurality of points in the time block. One or more time blocks may be grouped based on the aggregate location of each time block, and a spatial clustering procedure is applied to transform the aggregate locations of time blocks in the group into one or more locations of interest.