Rapid7, Inc.

Austin Formosa Lee

Vikram Jiandani

Gerardo Perez

Val Komarov

Chris DeRamus

Miguel Ledezma

James Andrew Green

Trever Allen McKee

Dylan Martin

Techniques for event driven harvesting and analysis of cloud computing resources in a cloud computing environment, comprising: obtaining, from a cloud computing environment, data related to an event that occurred in the cloud computing environment; in response to obtaining the data, requesting, from the cloud computing environment, supplemental data about the event that occurred in the cloud computing environment, the supplemental data including information about the event and/or information about impact of the event on a resource; determining whether a security action is to be taken at least in part by analyzing the data and/or the supplemental data; and when it is determined a security action is to be taken, performing the security action.

Event-driven monitoring of resources in a cloud computing environment

A database system stores a table as a set of column files in a columnar format in a manner that improves the write performance of the table and avoids use of separate metadata repository. In embodiments, each column file groups values into entity chunks indexed by an entity index. Each chunk includes a live value index that determines which rows in chunk has live values. New values are written to the column file by appending an updated copy of the entity chunk. The entity index to refer to the newly written chunk as the latest version. This approach avoids expensive in-place updating of individual column values and allows the update to be performed much more quickly. In embodiments, the database system encodes metadata such as table schema information using file naming and placement conventions in the file store, so that a centralized metadata repository is not required.

File directory structure and naming convention for storing columnar tables

The techniques described herein relate to identifying network attack paths. An example method includes using at least one computer hardware processor to perform obtaining metadata indicating a set of network resources in a plurality of network resources and network connections among network resources in the set of network resources, generating, using the metadata, a relational representation of the set of network resources, generating, using the relational representation, a plurality of network paths between network resources in the set of network resources, and identifying, from among the plurality of network paths and using the relational representation and information indicating one or more of the plurality of network resources that have at least one respective security vulnerability, one or more network attack paths that may be used to exploit one or more security vulnerabilities of network resources in the set of network resources.

Techniques for identifying network attack paths

Columnar storage format for fast table updates

Embodiments of a transactional database system are described to implement transaction processing over database objects stored in a strongly consistent object storage system. When a transaction is initiated, the system makes a private copy of data objects that are used by the transaction. Reads and writes of the transaction will be performed on the private copy. When the transaction is to be committed, the system verifies that the committed state of the data objects has not changed outside the transaction, and updates metadata object(s) in the data storage system to point to the private copy as the currently committed state of the data objects. If the committed state of any data objects has changed during the transaction, the private copy is abandoned and the transaction is rolled back and/or retried.

Transactional database system implemented using strongly consistent object storage

Encoding table schema and storage metadata in a file store

Disclosed herein are methods, systems, and processes to distribute and disperse search loads to optimize security event processing in cybersecurity computing environments. A search request that includes a domain specific language (DSL) query directed to a centralized search cluster by an event processing application is intercepted. The event processing application is inhibited from issuing the search request to the centralized search cluster if a structured or semi-structured document matches the DSL query.

Bifurcating security event processing

A SQL database system is disclosed for reading and writing a non-SQL document store using SQL. The database system includes a SQL query engine configured to use different types of dynamically loadable connectors adapted to communicate with the non-SQL document store via its data access interface. The connectors may include a first connector that treats data within an individual document in the document store as multiple table rows, and a second connector that treats individual documents as individual table rows. In some embodiments, both types of document access modes may be implemented by a single multi-modal connector. In some embodiments, the connector may enable a table to be stored across multiple documents and provide the document identifier of the documents as an attribute of the table. Advantageously, by allowing multiple rows to be stored in individual documents, a table can be stored using less storage space and accessed more efficiently.

Table data storage in non-SQL document store to enable efficient data access by SQL query engine

Methods and systems for managing queues. The disclosed methods involve receiving, at an interface, a request to store a message in a queue, storing the message as a row in a key-value store database, extracting at least one attribute from the message; and selecting the message for processing based on the at least one extracted attribute.

Prioritized queue management

Distributing search loads to optimize security event processing

Methods and systems for managing queues are disclosed. The disclosed methods involve receiving, at an interface, a request to store a message in a queue, storing the message as a row in a key-value data store, extracting at least one attribute from the message; and selecting the message for processing based on the at least one extracted attribute.

Growing community of inventors

Burbank, CA, United States of America

Austin Formosa Lee