Wiz, Inc.

Dazz, Inc.

Barak Bercovitz

Tomer Schwartz

Eshel Yaron

Bernie Pinkenzon-Howard

Omer Deutscher

A system and method for cybersecurity root cause analysis. A method includes parsing a first string into at least one first structured unit based on predetermined structured unit formats. The first string is indicated in cybersecurity data related to a cybersecurity event. Each predetermined structured unit format is defined with respect to at least one substring each having a respective data type. Each first structured unit is compared to a corresponding second structured unit of at least one second structured unit of a second string. Each second structured unit is a portion of text of the second string identified by parsing the second string based on the predetermined structured unit formats. The first string is correlated to the second string based on the comparison. A resource corresponding to the second string is identified. A root cause of the cybersecurity event is determined based on the identified resource.

Cybersecurity root cause analysis using computing resource name correlation

A system and method for securing deployment of computing infrastructure resources. A method includes identifying a first set of properties in original definitions of computing infrastructure resources, where each original definition is a definition of a respective computing infrastructure resource; mapping the first set of properties to a second set of properties of universal definition templates in order to determine a matching universal definition template for each original definition, where each of the universal definitions corresponds to a respective type of computing infrastructure resource and is defined in a unified format; transforming the original definitions into universal definitions using the universal definition templates, where transforming each original definition further includes inserting at least one of the first set of properties into the matching universal definition template for the original definition; and managing deployment of the computing infrastructure resources based on the universal definitions.

Techniques for securing deployment of infrastructure as code

A system and method for code fingerprinting. A method includes scanning a code repository including software components by executing fingerprinting code on the code repository in order to generate statistics vectors for the software components. The fingerprinting code includes instructions for performing a text search to identify instances of patterns in the code repository and to generate the statistics vectors based on the identified pattern instances. The statistics vectors are clustered with respect to groupings of software components. The statistics vectors are aggregated by combining values of respective statistics in the statistics vectors belonging to the same clusters. An anomaly is detected based on the aggregated statistics vectors. One or more remedial actions are performed with respect to the software components based on the detected anomaly.

Techniques for code fingerprinting

A system and method for remediating cybersecurity events. A method includes creating a semantic concepts dictionary defining semantic concepts representing characteristics of software components. An entity graph is created based on correlations between entities, where the entity graph has nodes representing respective entities and the entities include software components of a software infrastructure as well as event logic components of cybersecurity event logic deployed with respect to the software infrastructure. A knowledge base is built such that the knowledge base includes the semantic concepts dictionary and the entity graph. The knowledge base is queried using a query generated based on one or more semantic concepts and one or more entity-identifying values extracted from cybersecurity event data. The query includes at least one semantic concept and at least one entity-identifying value. One or more remedial actions are performed based on one or more query results from the knowledge base.

Techniques for semantic analysis of cybersecurity event data and remediation of cybersecurity event root causes

Systems and methods for identifying security control steps in software development pipelines. A method includes enumerating a plurality of steps in a software development infrastructure by analyzing software development pipeline data of the software development infrastructure, wherein each step includes a set of computer instructions for performing at least one task; identifying a plurality of step properties for each of the plurality of steps in step data of the step; and classifying at least one of the plurality of steps as a security control step based on the plurality of step properties identified for each of the plurality of steps, wherein each step classified as a security control step includes instructions for at least analyzing code in order to determine whether at least one security requirement is met.

Growing community of inventors

Even-Yehuda, Israel

Barak Bercovitz