Fortinet, Inc.

Veritas Technologies LLC

Abhishek Narula

Pooja Singh

Amit Jain

Satish Mishra

Shravan K Konthalapally

Alok Agarwal

Christopher Carsey

Niranjan Sanjiv Pendharkar

Suhas Ashok Dantkale

Chaitanya Yalamanchili

Nirendra Awasthi

Christopher Uhler

Subhadeep De

Vidyut Kaul

Phani Karthik Maradani

Ketan Mahajan

Joseph Loomis

Tushar Kanade

Fnu Bharathram

Ketan Nilangekar

Bk Bharathram

Puneet Bakshi

Systems and methods for providing selective data-replication among nodes of a distributed multi-tenancy MSSP architecture for performing secure orchestration and automated response (SOAR) are provided. According to one embodiment a master SOAR node of an MSSP receives multiple messages via a secure router coupling a computing environment of the MSSP in communication with respective computing environments of multiple customers of the MSSP. The messages contain information regarding alerts relating to network infrastructure of the customers and the information is controlled by data sharing policies implemented by tenant SOAR nodes within the respective computing environments of the customers. Based on an investigation into an alert relating to a network infrastructure of a particular customer, the master SOAR node causes a workflow to be remotely executed by a tenant SOAR node within the computing environment of the particular customer.

Providing secure data-replication between a master node and tenant nodes of a multi-tenancy architecture

Various approaches are discussed for generation of SOAR playbooks using a variety playbook sources.

Systems and methods for generating soar playbooks

Systems and methods for a machine-learning based approach for dynamically generating incident-specific playbooks for a security orchestration and automated response (SOAR) platform are provided. The SOAR platform captures information regarding execution of a sequence of actions performed by analysts responsive to a first incident of a first type. The captured information is fed into a machine-learning model. When a second incident, observed by the SOAR platform, is similar in nature to the first incident or the first type a recommended sequence of actions is generated based on the machine-learning model for use by an analyst in connection with responding to the second incident. In response to rejection of the recommended sequence by the analyst, revising the recommended sequence based on input provided by the analyst and storing the revised recommendation sequence in a form of a revised playbook for response to subsequent incidents that are similar to the second incident.

Machine-learning based approach for dynamically generating incident-specific playbooks for a security orchestration, automation and response (SOAR) platform

Systems and methods for determining an efficiency score for an automation platform are provided. According to one embodiment, a first weight for each playbook of multiple playbooks of an automation framework and a second weight for each type of error of multiple types of errors that may cause execution of one of the multiple playbooks to fail are maintained. The first weight represents a relative importance of the playbook and the second weight represents an effort required to address the error. An efficiency score is calculated for execution of one or more playbooks of the multiple playbooks during a particular time period based on the first weight for each of the one or more playbooks and the second weight for each type of error observed during the particular time period. An indication of a health of the automation framework is then displayed based on the efficiency score.

Framework for determining metrics of an automation platform

Systems and methods for facilitating secure and reliable communications among nodes of different tiers of a multi-tenant SOAR deployment are provided. According to one embodiment, data flow propagation within a hierarchy of nodes of the SOAR deployment is controlled. Responsive to creation of a record by a node: (i) when there exists a parent node in the hierarchy, setting a PID of the record to a TID of the parent node; otherwise, to a TID of the node; (ii) when there exists a child node in the hierarchy, setting a CID of the record to the TID of the child node; otherwise, to the TID of the node; and (iii) maintaining a set of propagation rules for the node relating to permissibility of propagation of the record within the hierarchy. During propagation of the record by the node, the PID and the CID of the record are updated.

Providing secure data replication among nodes of a hierarchical multitenant security orchestration and automated response (SOAR) architecture

Providing secure data replication among nodes of a hierarchical multitenant  security orchestration and automated response (SOAR) architecture

A method for creating snapshots and backups in a virtual computing environment is provided. The method includes writing application output of an application spanning one or more virtual machines as an application consistency group to a writeback cache, wherein the one or more virtual machines are implemented using one or more compute nodes and wherein the writeback cache is implemented in direct attached storage in the one or more compute nodes. The method includes pausing I/O (input/output) operations of the application and marking the pausing, in the writeback cache. The method includes resuming the I/O operations of the application, after the marking and dumping data, according to the marking, from the writeback cache to a data node, as a snapshot.

System and method for creating snapshots in openflame environment

Growing community of inventors

Pune, India

Abhishek Narula