Abstract: Aspects described herein may relate to cyber threat detection based on threat context and/or threat changes. Cyber threat intelligence (CTI) data may be received from a CTI provider. Endpoint data that indicates evidence that endpoints are cyber threats may be determined based on the CTI data. The endpoint data may be analyzed and/or compared to stored data associated with the endpoint. The analysis and/or comparison may be performed to determine whether evidence that the endpoint is a cyber threat has changed. Based on any changes, dispositions for the endpoint may be determined and sent. The dispositions may change how devices filter network traffic associated with the endpoint. Alternatives to default dispositions may be determined based on a impact of blocking potentially legitimate network traffic to and/or from the endpoints. Machine-learning models may assist in processing and analyzing CTI data, performing threat monitoring, and/or determining feeds that include the dispositions.

Abstract: Aspects described herein may relate to cyber threat detection based on threat context and/or threat changes. Cyber threat intelligence (CTI) data may be received from a CTI provider. Endpoint data that indicates evidence that endpoints are cyber threats may be determined based on the CTI data. The endpoint data may be analyzed and/or compared to stored data associated with the endpoint. The analysis and/or comparison may be performed to determine whether evidence that the endpoint is a cyber threat has changed. Based on any changes, dispositions for the endpoint may be determined and sent. The dispositions may change how devices filter network traffic associated with the endpoint. Alternatives to default dispositions may be determined based on a impact of blocking potentially legitimate network traffic to and/or from the endpoints. Machine-learning models may assist in processing and analyzing CTI data, performing threat monitoring, and/or determining feeds that include the dispositions.

Abstract: Aspects described herein may relate to cyber threat detection based on threat context and/or threat changes. Cyber threat intelligence (CTI) data may be received from a CTI provider. Endpoint data that indicates evidence that endpoints are cyber threats may be determined based on the CTI data. The endpoint data may be analyzed and/or compared to stored data associated with the endpoint. The analysis and/or comparison may be performed to determine whether evidence that the endpoint is a cyber threat has changed. Based on any changes, dispositions for the endpoint may be determined and sent. The dispositions may change how devices filter network traffic associated with the endpoint. Alternatives to default dispositions may be determined based on a impact of blocking potentially legitimate network traffic to and/or from the endpoints. Machine-learning models may assist in processing and analyzing CTI data, performing threat monitoring, and/or determining feeds that include the dispositions.

Abstract: Aspects of the disclosure relate to identity-based DNS-traffic routing and monitoring. A computing platform may establish, using an encrypted DNS process, a secure DNS session by executing an encrypted session handshake with a client device, which may include receiving a security certificate for the encrypted DNS process that identifies a user of the client device. The computing platform may receive an encrypted DNS query request comprising a request for an IP address for a specified domain name. The computing platform may determine, based on the security certificate, an identity of the user. The computing platform may determine, based on the identity of the user, a security policy indicating domain matching criteria and corresponding actions to take on matching domain names. The computing platform may determine a first action corresponding to the domain name, and may send, based on the first action, an encrypted DNS query response.

Abstract: Aspects described herein may relate to cyber threat detection based on threat context and/or threat changes. Cyber threat intelligence (CTI) data may be received from a CTI provider. Endpoint data that indicates evidence that endpoints are cyber threats may be determined based on the CTI data. The endpoint data may be analyzed and/or compared to stored data associated with the endpoint. The analysis and/or comparison may be performed to determine whether evidence that the endpoint is a cyber threat has changed. Based on any changes, dispositions for the endpoint may be determined and sent. The dispositions may change how devices filter network traffic associated with the endpoint. Alternatives to default dispositions may be determined based on a impact of blocking potentially legitimate network traffic to and/or from the endpoints. Machine-learning models may assist in processing and analyzing CTI data, performing threat monitoring, and/or determining feeds that include the dispositions.

Abstract: Aspects described herein may relate to cyber threat detection based on threat context and/or threat changes. Cyber threat intelligence (CTI) data may be received from a CTI provider. Endpoint data that indicates evidence that endpoints are cyber threats may be determined based on the CTI data. The endpoint data may be analyzed and/or compared to stored data associated with the endpoint. The analysis and/or comparison may be performed to determine whether evidence that the endpoint is a cyber threat has changed. Based on any changes, dispositions for the endpoint may be determined and sent. The dispositions may change how devices filter network traffic associated with the endpoint. Alternatives to default dispositions may be determined based on a impact of blocking potentially legitimate network traffic to and/or from the endpoints. Machine-learning models may assist in processing and analyzing CTI data, performing threat monitoring, and/or determining feeds that include the dispositions.

Abstract: Aspects of the disclosure relate to identity-based DNS-traffic routing and monitoring. A computing platform may establish, using an encrypted DNS process, a secure DNS session by executing an encrypted session handshake with a client device, which may include receiving a security certificate for the encrypted DNS process that identifies a user of the client device. The computing platform may receive an encrypted DNS query request comprising a request for an IP address for a specified domain name. The computing platform may determine, based on the security certificate, an identity of the user. The computing platform may determine, based on the identity of the user, a security policy indicating domain matching criteria and corresponding actions to take on matching domain names. The computing platform may determine a first action corresponding to the domain name, and may send, based on the first action, an encrypted DNS query response.

Abstract: Aspects of the disclosure relate to identity-based DNS-traffic routing and monitoring. A computing platform may establish, using an encrypted DNS process, a secure DNS session by executing an encrypted session handshake with a client device, which may include receiving a security certificate for the encrypted DNS process that identifies a user of the client device. The computing platform may receive an encrypted DNS query request comprising a request for an IP address for a specified domain name. The computing platform may determine, based on the security certificate, an identity of the user. The computing platform may determine, based on the identity of the user, a security policy indicating domain matching criteria and corresponding actions to take on matching domain names. The computing platform may determine a first action corresponding to the domain name, and may send, based on the first action, an encrypted DNS query response.