Abstract: An information handling system may include a processor, a basic input/output system (BIOS) communicatively coupled to the processor, and a security agent comprising a program of instructions embodied in non-transitory computer-readable media and configured to, when read and executed by the processor: retrieve a BIOS policy, retrieve BIOS configuration information, based on the BIOS policy and the BIOS configuration information, determine a deviation of one or more BIOS attributes of the BIOS configuration information, and perform remediation of the one or more BIOS attributes based on the deviation.

Abstract: An information handling system may include a processor, a basic input/output system (BIOS) communicatively coupled to the processor, and a security agent comprising a program of instructions embodied in non-transitory computer-readable media and configured to, when read and executed by the processor: retrieve a BIOS policy, retrieve BIOS configuration information, based on the BIOS policy and the BIOS configuration information, determine a deviation of one or more BIOS attributes of the BIOS configuration information, and perform remediation of the one or more BIOS attributes based on the deviation.

Abstract: An information handling system includes a basic input/output system (BIOS), a memory, and a processor. The processor scans a current state of each BIOS attribute in the BIOS, and stores one or more changed attributes in a secure event log in the memory. The processor converts each changed attribute into a different threat event including a first changed attribute into a first threat event. The processor provides a list of threat events to multiple threat chains, each of which determine whether the threat events match threat criteria in a threat chain policy. In response to the threat event matching a threat criterion in the threat chain policy, the threat chain provides a threat state change to the processor, which in turn provides new threat state changes to a threat state change consumer.

Abstract: An information handling system includes a basic input/output system (BIOS), a memory, and a processor. The processor scans a current state of each BIOS attribute in the BIOS, and stores one or more changed attributes in a secure event log in the memory. The processor converts each changed attribute into a different threat event including a first changed attribute into a first threat event. The processor provides a list of threat events to multiple threat chains, each of which determine whether the threat events match threat criteria in a threat chain policy. In response to the threat event matching a threat criterion in the threat chain policy, the threat chain provides a threat state change to the processor, which in turn provides new threat state changes to a threat state change consumer.

Abstract: An information handling system includes a basic input/output system (BIOS), a memory, and a processor. The processor scans a current state of each BIOS attribute in the BIOS, and stores one or more changed attributes in a secure event log in the memory. The processor converts each changed attribute into a different threat event including a first changed attribute into a first threat event. The processor provides a list of threat events to multiple threat chains, each of which determine whether the threat events match threat criteria in a threat chain policy. In response to the threat event matching a threat criterion in the threat chain policy, the threat chain provides a threat state change to the processor, which in turn provides new threat state changes to a threat state change consumer.