Abstract: A system and method for generating a software product component catalog for endpoint security is presented. The method includes receiving data on endpoint usage of software product components, wherein the data on endpoint usage includes information on states of software product components; invoking at least one AI agent and external data sources based on the data on endpoint usage, wherein the external data sources are invokable by the at least one AI agent to extract particular types of attributes of the software product components; extracting, by the at least one AI agent using external data sources, attributes of the software product components, wherein attributes are dynamic qualities of a software product component; verifying the extracted attributes of the software product components using at least a language model, heuristics, and a combination thereof; and generating an endpoint security policy based, in part, on the verified attributes.

Abstract: Disclosed herein are systems and methods for providing percentile-based alerts from historical event-occurrence data. An embodiment of a method includes identifying a baseline result of an aggregation operation performed with respect to a detection set of attributes of event records. Each baseline result corresponds to a baseline set of one or more event records from a baseline time period within a baseline time window. The method includes determining a subject result of the aggregation operation performed with respect to the detection set of attributes of a subject set of the event records corresponding to a subject time period. The method includes determining, based on the baseline result and the subject result, whether the subject result indicates an alert condition for the detection set for the subject time period, and if so then outputting one or more alerts.

Abstract: Disclosed herein are systems and methods for providing percentile-based alerts from historical event-occurrence data. An embodiment of a method includes identifying a baseline result of an aggregation operation performed with respect to a detection set of attributes of event records. Each baseline result corresponds to a baseline set of one or more event records from a baseline time period within a baseline time window. The method includes determining a subject result of the aggregation operation performed with respect to the detection set of attributes of a subject set of the event records corresponding to a subject time period. The method includes determining, based on the baseline result and the subject result, whether the subject result indicates an alert condition for the detection set for the subject time period, and if so then outputting one or more alerts.

Abstract: Disclosed herein are systems and methods for providing percentile-based alerts from historical event-occurrence data. An embodiment of a method includes identifying a baseline result of an aggregation operation performed with respect to a detection set of attributes of event records. Each baseline result corresponds to a baseline set of one or more event records from a baseline time period within a baseline time window. The method includes determining a subject result of the aggregation operation performed with respect to the detection set of attributes of a subject set of the event records corresponding to a subject time period. The method includes determining, based on the baseline result and the subject result, whether the subject result indicates an alert condition for the detection set for the subject time period, and if so then outputting one or more alerts.