Abstract: Exemplary systems and methods are directed to endpoint detection and response (EDR) in which a receiver receives streaming data from plural EDR platforms with vendor-specific data formats for the streaming data. An application programming interface converts the streaming data received from each EDR platform to a common data format. A detection engine analyzes the converted streaming data for attributes of malicious activity and generates an alert when malicious activity is detected. A graphical user interface filters and sorts the generated alerts based on at least one of a priority of addressing the malicious activity and a severity of harm caused by the malicious activity. The graphical user interface further generates an interactive display of the filtered and sorted alerts, where each alert includes an active or activatable link which when selected provides additional information obtained from one of the plural EDR platforms associated with the alert.

Abstract: A data processing system for distributing a package of data from a source to a plurality of data processing machines arranged in a plurality of sites. The data is transmitted from the source to the plurality of data processing machines by means of a multicast. At each site, a local data processing machine is designated as a site master; the other local data processing machines report missing data portions to the site master; and the site master consolidates reports of missing data portions, and requests missing data portions from the source. The source then transmits the missing data portions to the plurality of data processing machines by means of a further multicast. If the site master receives a report of missing data that the site master has stored locally, the site master provides that missing data to the local machines by means of a site multicast.