Systems and methods to integrate cyber threat intelligence for detection and response of cyber threats

Abstract

Endpoint system comprising an endpoint agent configured for deployment on a computing machine, a backend server adapted to curate and update intelligence fingerprints, a communication module within said agent enabling it to request and receive the latest intelligence fingerprints from said backend server, and a mechanism within said agent to directly analyse network packet details. The system may comprise logless technology and operate independently of threat intelligence platforms (TIPs) and Security Information and Event Management (SIEM) systems. The system may identify adversary inndicators such as unusual agent strings, uncommon IP addresses, or patterns inconsistent with command-and-control servers. The system may also comprise an automated response system.