When an endpoint flags a suspicious process, the hard question isn't usually "did something happen" — it's "how sure are we, and what should happen next." A single detector's verdict carries a single detector's blind spots. The instinct to gather more opinions before acting is sound; the engineering problem is doing it fast enough to matter and consistently enough to automate.

The grant US11930022B2, "Cloud-based orchestration of incident response using multi-feed security event classifications" (assigned to Fortinet), is structured around that question. It splits classification across an endpoint and the cloud, gathers verdicts from many independent feeds, and fuses them into a single decision that drives an automated response.

"Systems and methods for performing multi-feed classification of security events to facilitate automated IR orchestration are provided."— U.S. Patent No. 11,930,022 source

The flow begins at the edge. According to the independent claim, an endpoint protection platform running on an endpoint device performs "an initial classification of an event" and transmits that classification — along with context for the event — to a cloud-based security service protecting the private network. The endpoint makes the first call locally, where it's fast and cheap, but it doesn't make the final call. The cloud service "access[es] a plurality of data feeds, wherein each data feed... independently classify a given security event and produce a classification result," collects a result from each feed, and "generat[es] a final classification result based at least in part on the initial classification and the plurality of classification results." Many independent opinions, one fused verdict.

The patent is specific about what those feeds are. A dependent claim lists them: "a file threat-feed, an Internet Protocol (IP)/uniform resource locator (URL) threat feed, an Indicators of Compromise (IoC) threat feed, a file reputation service, an IP/URL reputation service, a vulnerability discovery service, a Tactics Techniques and Procedures (TTPs) feed, a classification of a security event by a third-party network or another endpoint device and Endpoint Detection and Response (EDR) data." This is a deliberately diverse panel — file-centric, network-centric, reputation-based, behavior-based — so the feeds' blind spots don't overlap. A process that looks clean to a file-reputation service might light up an IoC feed or a TTP feed, and the fusion step is where those disagreements get resolved.

The fusion itself can be learned. One claim specifies that generating the final classification "includes applying... a machine-learning classifier to the initial classification and the plurality of classification results," and adds a practical wrinkle: "the classification results obtained from the plurality of data feeds need not be normalized prior to being input to the machine-learning classifier." Letting the classifier consume heterogeneous, un-normalized feed outputs directly removes a brittle integration step — every feed speaks its own dialect and the model learns to weigh them as they are. The claims also fix a shared vocabulary for the verdicts: events are classified as "a malicious event, a suspicious event, a potentially unwanted program (PUP) event, an inconclusive event, a likely safe event or a safe event." Notably, "inconclusive" is a first-class outcome — the system is allowed to say it doesn't know, which is exactly the honest answer a multi-opinion design should be able to give.

The context the endpoint sends along is what makes the verdict actionable. A dependent claim describes it as including "command line information associated with execution of the process, an execution chain associated with the process, and a memory dump associated with the process." That is the forensic substrate — how the process was launched, what spawned what, and a snapshot of memory — that lets the feeds and the classifier reason about the event rather than just a hash. The system can also "assign[] a criticality score based on the initial classification," giving downstream orchestration a sense of urgency, not just a label.

Then comes the orchestration the patent is named for. Based on the final classification, the cloud service "caus[es]... the endpoint protection platform to perform an automated incident response, by providing an output of an automated response engine." That output "comprises a set of automated incident responses based on a set of automated incident response playbooks and the final classification," and the concrete actions are enumerated: "notifying an end user of the endpoint device, opening a ticket relating to the event, isolating the endpoint device, quarantining a file associated with the event, and remediating the endpoint device." The decision is made in the cloud where the feeds and the classifier live; the action is executed back on the endpoint where the threat actually is.

The defensive logic is the separation of concerns. The endpoint is the right place for fast initial triage and for carrying out response, because it's where the process runs. The cloud is the right place for fusion, because that's where you can afford to consult a dozen feeds and run a classifier over their combined output without slowing the endpoint down. Playbooks turn the fused verdict into a consistent, repeatable response, so the same kind of event gets the same kind of handling every time instead of depending on which analyst is awake.

The honest limit is shared with any ensemble: the system's judgment is only as good as its feeds and the classifier that weighs them. Correlated blind spots across feeds, a poisoned reputation source, or a miscalibrated fusion model would all degrade the final verdict — and because the verdict can trigger automated isolation or quarantine, a confident wrong answer has teeth. That is the cost of automating response. The contribution is a structure that makes the automation defensible: many independent opinions, an explicit "inconclusive" escape hatch, a criticality score, and playbook-bounded actions, all orchestrated from the cloud and carried out at the edge.