Systems and methods for monitoring the virtual partition

摘要

The method of an embodiment comprises receiving the external handler, the event notification about events in the virtual partition. It also includes a step of holding the thread of the process of the virtual partition that caused the event. Processes and other threads, while you are evaluating the event whether or not there is a potential threat security handler, is allowed to resume. , And may be allowed to return to the external handler results based on the task is allowed to execute the task in order to that the auxiliary agent virtual partition, and assembles collect event context in the virtual partition. It can take a policy action on the basis of a result of the auxiliary agent is returned, the policy action, that to end the process that caused the event, to instruct the auxiliary agent may be included. [Selection] Figure Figure 1