Abstract: A method includes: accessing objects, generated by a set of sources, representing attributes of assets, affiliated with a computer network, including a set of endpoint devices and a first application; partitioning the objects into object groups including a first object group representing the first application; aggregating objects in the first object group into a first user container representing the first application during the first time interval; and, in response to selection of the first application at an operator portal: generating a visualization representing a subset of endpoint devices, in the set of endpoint devices, on which the first application is installed during the first time interval based on a set of attributes, exhibited by the first application during the first time interval, contained in the first application container; and rendering the visualization at the operator interface.

Abstract: A method includes: accessing objects, generated by a set of sources, representing attributes of assets, affiliated with a computer network, including a set of endpoint devices and a first application; partitioning the objects into object groups including a first object group representing the first application; aggregating objects in the first object group into a first user container representing the first application during the first time interval; and, in response to selection of the first application at an operator portal: generating a visualization representing a subset of endpoint devices, in the set of endpoint devices, on which the first application is installed during the first time interval based on a set of attributes, exhibited by the first application during the first time interval, contained in the first application container; and rendering the visualization at the operator interface.

Abstract: A method includes: generating a manifest of assets during the target time interval; labeling each asset in the manifest of assets with a set of attributes exhibited by the asset during the target time interval; defining a first attribute category exhibiting a first combination of attributes; assigning a first action to the first attribute category; identifying a subset of assets in the manifest of assets matching the first attribute category, each asset in the subset of assets exhibiting a set of attributes including the first combination of attributes; and executing the first action on the first subset of assets.

Abstract: A method includes: generating a manifest of assets during the target time interval; labeling each asset in the manifest of assets with a set of attributes exhibited by the asset during the target time interval; defining a first attribute category exhibiting a first combination of attributes; assigning a first action to the first attribute category; identifying a subset of assets in the manifest of assets matching the first attribute category, each asset in the subset of assets exhibiting a set of attributes including the first combination of attributes; and executing the first action on the first subset of assets.

Abstract: A method includes: accessing objects, generated by a set of sources, representing attributes of assets, affiliated with a computer network, including a set of endpoint devices and a first application; partitioning the objects into object groups including a first object group representing the first application; aggregating objects in the first object group into a first user container representing the first application during the first time interval; and, in response to selection of the first application at an operator portal: generating a visualization representing a subset of endpoint devices, in the set of endpoint devices, on which the first application is installed during the first time interval based on a set of attributes, exhibited by the first application during the first time interval, contained in the first application container; and rendering the visualization at the operator interface.

Abstract: A method includes: accessing objects, generated by a set of sources, representing attributes of users affiliated with a computer network; partitioning the objects into object groups, each object group representing a particular user; for each object group, aggregating objects in the object group into a user container, in a set of user containers, representing a user during the first time interval; generating a manifest of users affiliated with the computer network during the first time interval based on the set of user containers; and, in response to selection of a first user in the manifest of users at an operator portal: generating a visualization representing a set of attributes exhibited by the first user during the first time interval.

Abstract: A method includes: generating a manifest of assets during the target time interval; labeling each asset in the manifest of assets with a set of attributes exhibited by the asset during the target time interval; defining a first attribute category exhibiting a first combination of attributes; assigning a first action to the first attribute category; identifying a subset of assets in the manifest of assets matching the first attribute category, each asset in the subset of assets exhibiting a set of attributes including the first combination of attributes; and executing the first action on the first subset of assets.

Abstract: A security client can be configured to operate on the one or more computing systems and record all events occurring on the one or more computing systems. The security client can operate as a “security camera” for the computing systems by identifying and retaining data and information that describes and details different events that occur on the computing systems. The security client can be configured to generate event records for the events that are uniquely associated with the process that requested or performed event. Likewise, the security client can be configured to uniquely associate the event records with the specific computing system associated with the event.

Abstract: A security client can be configured to operate on the one or more computing systems and record all events occurring on the one or more computing systems. The security client can operate as a “security camera” for the computing systems by identifying and retaining data and information that describes and details different events that occur on the computing systems. The security client can be configured to generate event records for the events that are uniquely associated with the process that requested or performed event. Likewise, the security client can be configured to uniquely associate the event records with the specific computing system associated with the event.

Abstract: A security client can be configured to operate on the one or more computing systems and record all events occurring on the one or more computing systems. The security client can operate as a “security camera” for the computing systems by identifying and retaining data and information that describes and details different events that occur on the computing systems. The security client can be configured to generate event records for the events that are uniquely associated with the process that requested or performed event. Likewise, the security client can be configured to uniquely associate the event records with the specific computing system associated with the event.