Abstract: According to one embodiment, an Information Handling System (IHS) includes a memory to store a secure event log associated with one or more attributes of the IHS, and computer-executable code to obtain a system time from a system clock of the IHS, obtain a network time from a network time protocol (NTP) server, and compare the system time against the network time. When the obtained system time does not match the obtained network time, set a system clock attack chain vector in the secure event log and generate an Indicator of Attack (IoA) report based at least in part, on the system clock attack chain vector.

Abstract: An information handling system includes a basic input/output system (BIOS), a memory, and a processor. The processor scans a current state of each BIOS attribute in the BIOS, and stores one or more changed attributes in a secure event log in the memory. The processor converts each changed attribute into a different threat event including a first changed attribute into a first threat event. The processor provides a list of threat events to multiple threat chains, each of which determine whether the threat events match threat criteria in a threat chain policy. In response to the threat event matching a threat criterion in the threat chain policy, the threat chain provides a threat state change to the processor, which in turn provides new threat state changes to a threat state change consumer.

Abstract: An information handling system instantiates a system health monitor that detects a change to an attribute of the information handling system from a first state to a second state, compares the change to a policy related to the attribute, and remediates the change in response to determining that the change is critical.

Abstract: According to one embodiment, an Information Handling System (IHS) includes a memory to store a secure event log associated with one or more attributes of the IHS, and computer-executable code to obtain a system time from a system clock of the IHS, obtain a network time from a network time protocol (NTP) server, and compare the system time against the network time. When the obtained system time does not match the obtained network time, set a system clock attack chain vector in the secure event log and generate an Indicator of Attack (IoA) report based at least in part, on the system clock attack chain vector.

Abstract: Systems and methods for generating multi-monitor recommendations. In some embodiments, an Information Handling System (IHS) may include: a processor and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution, cause the IHS to: collect window information during use of the IHS; and create a multi-monitor recommendation based, at least in part, upon the window information.

Abstract: An information handling system includes a basic input/output system (BIOS), a memory, and a processor. The processor scans a current state of each BIOS attribute in the BIOS, and stores one or more changed attributes in a secure event log in the memory. The processor converts each changed attribute into a different threat event including a first changed attribute into a first threat event. The processor provides a list of threat events to multiple threat chains, each of which determine whether the threat events match threat criteria in a threat chain policy. In response to the threat event matching a threat criterion in the threat chain policy, the threat chain provides a threat state change to the processor, which in turn provides new threat state changes to a threat state change consumer.

Abstract: An information handling system includes a basic input/output system (BIOS), a memory, and a processor. The processor scans a current state of each BIOS attribute in the BIOS, and stores one or more changed attributes in a secure event log in the memory. The processor converts each changed attribute into a different threat event including a first changed attribute into a first threat event. The processor provides a list of threat events to multiple threat chains, each of which determine whether the threat events match threat criteria in a threat chain policy. In response to the threat event matching a threat criterion in the threat chain policy, the threat chain provides a threat state change to the processor, which in turn provides new threat state changes to a threat state change consumer.

Abstract: An information handling system includes a basic input/output system (BIOS), a memory, and a processor. The processor scans a current state of each BIOS attribute in the BIOS, and stores one or more changed attributes in a secure event log in the memory. The processor converts each changed attribute into a different threat event including a first changed attribute into a first threat event. The processor provides a list of threat events to multiple threat chains, each of which determine whether the threat events match threat criteria in a threat chain policy. In response to the threat event matching a threat criterion in the threat chain policy, the threat chain provides a threat state change to the processor, which in turn provides new threat state changes to a threat state change consumer.

Abstract: Systems and methods for generating multi-monitor recommendations. In some embodiments, an Information Handling System (IHS) may include: a processor and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution, cause the IHS to: collect window information during use of the IHS; and create a multi-monitor recommendation based, at least in part, upon the window information.