Abstract: Methods, apparatus, and processor-readable storage media for automated detection of user device security risks related to process threads and corresponding activity are provided herein. An example computer-implemented method includes obtaining information pertaining to processes running on a user device; obtaining information pertaining to images loaded into at least one memory associated with at least one of the processes running on the user device; obtaining information pertaining to threads created in connection with at least one of the processes running on the user device; automatically identifying at least one of the threads as a security risk by processing the information pertaining to the images and the information pertaining to the threads; and performing at least one automated action based on the identification of at least one of the one or more threads as a security risk.

Abstract: Methods, apparatus, and processor-readable storage media for automated detection of user device security risks related to process threads and corresponding activity are provided herein. An example computer-implemented method includes obtaining information pertaining to processes running on a user device; obtaining information pertaining to images loaded into at least one memory associated with at least one of the processes running on the user device; obtaining information pertaining to threads created in connection with at least one of the processes running on the user device; automatically identifying at least one of the threads as a security risk by processing the information pertaining to the images and the information pertaining to the threads; and performing at least one automated action based on the identification of at least one of the one or more threads as a security risk.

Abstract: Methods, apparatus, and processor-readable storage media for generating unique virtual process identifiers are provided herein. An example computer-implemented method includes generating a virtual process identifier for a process within a given network, wherein the virtual process identifier is based at least in part on multiple items of process-related information; associating the virtual process identifier with one or more types of events to be carried out within the given network in connection with the process; filtering repetitive events from a set of processed events carried out in connection with the process, wherein filtering the repetitive events comprises identifying multiple instances of the virtual process identifier associated with multiple instances of the same type of event; and reporting, to at least one server, the processed events remaining subsequent to the filtering step.

Abstract: Methods, apparatus, and processor-readable storage media for generating unique virtual process identifiers are provided herein. An example computer-implemented method includes generating a virtual process identifier for a process within a given network, wherein the virtual process identifier is based at least in part on multiple items of process-related information; associating the virtual process identifier with one or more types of events to be carried out within the given network in connection with the process; filtering repetitive events from a set of processed events carried out in connection with the process, wherein filtering the repetitive events comprises identifying multiple instances of the virtual process identifier associated with multiple instances of the same type of event; and reporting, to at least one server, the processed events remaining subsequent to the filtering step.

Abstract: A method is used in managing data loss prevention policies. A device having data loss prevention (DLP) logic based on policies is provided. An attempt to perform an action that is prohibited by the DLP logic is performed at the device. An override code to allow performance of the action is determined at the device.