Fortinet, Inc.

Lacework Inc.

Ammar G Ekbote

Yijou Chen

Anil K Nanduri

Matti A Vanninen

Alex Ramachandran Nirmala

Prakash Jalan

Theodore M Reed

Sowmya A Karmali

Ross T Bunker

Whitney L Smith

Jacob A Kilby

An illustrative data platform may receive, from an agent configuration deployed in a cloud environment and configured to monitor compute assets in the cloud environment, first data periodically collected by the agent configuration at a first collection frequency and second data periodically collected by the agent configuration at a second collection frequency, identify, based on the first data, an anomaly associated with one or more compute assets included in the compute assets, and direct, based on the identifying the anomaly, the agent configuration to perform an on-demand collection of the second data.

Anomaly-based on-demand collection of data by an agent for a data platform

Example systems and methods monitor a cloud compute environment. An example method includes: opening, by an agent deployed in a cloud environment, a communication channel between the agent and a kernel of an operating system of a node within the cloud environment; determining, by the agent and via the communication channel, an event associated with a namespace of the operating system; determining, by the agent and based on the event, a status of a container associated with the node; and providing, by the agent to a data platform, a message indicative of the status of the container.

Container event monitoring using kernel space communication

An illustrative method includes a scanning driver providing an interface between data included in a data structure located within a compute environment and one or more scan modules included in an unprivileged agentless workload scanning configuration executing within the compute environment, the one or more scan modules configured to concurrently analyze the data in accordance with one or more respective scan use cases; receiving a request to add a new scan module to the unprivileged agentless workload scanning configuration, the new scan module associated with a new scan use case different than the one or more respective scan use cases, and dynamically loading, based on the request and while the one or more scan modules are concurrently analyzing the data, the new scan module into the unprivileged agentless workload scanning configuration.

Modular agentless scanning of cloud workloads

Example systems and methods monitor a cloud compute environment. An example method includes: determining, by an agent deployed in a cloud environment and based on a plurality of data packets transmitted over a plurality of network interfaces of the cloud environment, a set of data packets that are associated with a communication between a first container and a second container; determining, by the agent and based on the set of data packets, communication data associated with the communication; and providing, by the agent, the communication data to a data platform, wherein providing the communication data to the data platform uses less network resources than providing the set of data packets to the data platform.

Deduplication of monitored communications data in a cloud environment

Example systems and methods monitor a cloud compute environment. An example method includes an agent obtaining a data packet from an interface in the cloud compute environment, the data packet including a source address and a non-endpoint destination address; determining, based on the non-endpoint destination address and routing information for the data packet, an endpoint destination address associated with the non-endpoint destination address of the data packet; modifying the data packet by replacing the non-endpoint destination address with the endpoint destination address; and providing, based on the modified data packet, monitoring data to a data platform.

Growing community of inventors

Renton, WA, United States of America

Ammar G Ekbote