Abstract: The present disclosure provides methods for an endpoint ranking system that can take endpoint importance, symptom importance, and symptom timing into account when determining endpoint hygiene scores for endpoints in a network. A list of endpoints that is ranked or sorted according to hygiene score can by dynamically generated and can change over time due to the manner in which symptom timing is taken into account. The list can also evolve as parameters for endpoint importance and system importance are modified. An endpoint-importance weight can be assigned to each endpoint to bias hygiene scores according to endpoint importance. Symptom-importance weights and decay rates can also be assigned to symptom types to further bias hygiene scores.

Abstract: A system and method for detecting potential system vulnerabilities to malicious attacks. A list of routes between computing devices and associated threat levels is maintained as network events occur between computing devices. The routes include bad hygiene endpoints, high value targets which are a variety of server types controlling access to sensitive data, and network connections. A list of routes connecting high value targets and bad hygiene endpoints are sorted by a priority level and used to identify potential routes. When a network event corresponding to a given route is detected, the list is searched to identify potential routes. Potential routes are monitored routes with no network events detected yet between the source and destination.

Abstract: The disclosed computer-implemented method for filtering log files may include (1) identifying, on the endpoint computing device, log files that recorded events performed by processes executing on the endpoint computing device, (2) prior to sending the log files from the endpoint computing device to a security server for analysis, filtering, based on an analysis of the events recorded by the log files, the log files by excluding log files that recorded non-suspicious events, and (3) forwarding the filtered log files from the endpoint computing device to the security server for analysis. Various other methods, systems, and computer-readable media are also disclosed.