Abstract: A system detects and handles security incidents in a computerized environment. The system collects metadata respective of one or more user devices communicatively coupled in the computerized environment. Respective of the collected metadata, the system generates expected behavior patterns of the user devices within the computerized environment. The system continuously monitors the actual behavior of the user devices. Upon detection of deviations from the expected behavior patterns, the system sends a terminable agent to the user device in which the deviation was detected. The system then receives from the terminable agent metadata respective of the deviation. Upon determination that the deviation is a security incident respective of the metadata, the system configures the terminable agent to initiate actions respective thereto. The type of actions required is determined respective of the metadata received from the terminable agent. Upon removal of the security incident, the agent may be terminated.

Abstract: A system detects and handles security incidents in a computerized environment. The system collects metadata respective of one or more user devices communicatively coupled in the computerized environment. Respective of the collected metadata, the system generates expected behavior patterns of the user devices within the computerized environment. The system continuously monitors the actual behavior of the user devices. Upon detection of deviations from the expected behavior patterns, the system sends a terminable agent to the user device in which the deviation was detected. The system then receives from the terminable agent metadata respective of the deviation. Upon determination that the deviation is a security incident respective of the metadata, the system configures the terminable agent to initiate actions respective thereto. The type of actions required is determined respective of the metadata received from the terminable agent. Upon removal of the security incident, the agent may be terminated.