Forcepoint LLC

David Coffey

Lawrence Bruce Huston, Iii

Andrew David Mortensen

Ofir Arkin

Assaf Almaz

Richard Anthony Ford

Ann Irvine

Kristin Machacek Leary

A system, method, and computer-readable medium are disclosed for performing a security operation. The security operation includes monitoring a plurality of electronically-observable actions of a first entity, the plurality of electronically-observable actions of the first entity corresponding to a respective first plurality of events enacted by the first entity; monitoring a plurality of electronically-observable actions of a second entity, the plurality of electronically-observable actions of the second entity corresponding to a respective second plurality of events enacted by the second entity; determining whether a first event of the respective first plurality of events and a second event of the respective second plurality of events comprise an entity interaction between the first entity and the second entity; generating an entity interaction map, the entity interaction map providing a representation of the entity interaction between the first entity and the second entity; and, using the entity interaction map to perform a forensics analysis.

Using a security analytics map to perform forensic analytics

A system, method, and computer-readable medium are disclosed for performing a security operation. The security operation includes monitoring a plurality of electronically-observable actions of a first entity, the plurality of electronically-observable actions of the first entity corresponding to a respective first plurality of events enacted by the first entity; monitoring a plurality of electronically-observable actions of a second entity, the plurality of electronically-observable actions of the second entity corresponding to a respective second plurality of events enacted by the second entity; determining whether a first event of the respective first plurality of events and a second event of the respective second plurality of events comprise an entity interaction between the first entity and the second entity; generating an entity interaction map, the entity interaction map providing a representation of the entity interaction between the first entity and the second entity; and, using the entity interaction map to trace the entity interaction between the first entity and the second entity.

Using a security analytics map to trace entity interaction

A system, method, and computer-readable medium are disclosed for implementing a cybersecurity system having security policy visualization. At least one embodiment is directed to a computer-implemented method for implementing security policies in a secured network, including: retrieving a set of rules of a security policy; analyzing the set of rules of the security policy using one or more Satisfiability Modulo Theory (SMT) operations to reduce a dimensionality of the security policy; and generating a visual presentation on a user interface using results of the SMT operations, where the visual presentation includes visual indicia representing one or more targeted policy dimensions with respect to one or more fixed policy dimensions. In at least one embodiment, two or more security policies are presented with visual indicia representing differences between the security policies, including representations of one or more targeted policy dimensions with respect to one or more fixed policy dimensions.

Cybersecurity system having security policy visualization

A system, method, and computer-readable medium are disclosed for performing a security operation. The security operation includes: monitoring an entity, the monitoring observing at least one electronically-observable data source; identifying an event of analytic utility; analyzing the event of analytic utility, the analyzing the event of analytic utility identifying an entity behavior associated with the event of analytic utility; and, performing the security operation in response to the analyzing the event of analytic utility, where the monitoring, identifying, analyzing and performing are performed via a distributed security analytics framework.

Distributed framework for security analytics

A system, method, and computer-readable medium are disclosed for performing a security operation. The security operation includes: monitoring a plurality of actions of an entity, the plurality of actions of the entity corresponding to a plurality of events enacted by the entity; maintaining information relating to the monitoring within a user edge component; identifying an event of analytic utility; analyzing the event of analytic utility at the user edge component, the analyzing generating a security risk assessment; and, providing the security risk assessment to a network edge component.

Maintaining user privacy via a distributed framework for security analytics

A system, method, and computer-readable medium are disclosed for performing a security analytics mapping operation. The security analytics mapping operation includes receiving a plurality of electronically-observable actions of a first entity, the plurality of electronically-observable actions of the first entity corresponding to a respective first plurality of events enacted by the first entity; receiving a plurality of electronically-observable actions of a second entity, the plurality of electronically-observable actions of the second entity corresponding to a respective second plurality of events enacted by the second entity; determining, via a distributed security analytics environment, whether a first event of the respective first plurality of events and a second event of the respective second plurality of events comprise an entity interaction between the first entity and the second entity; and, generating, via the distributed security analytics environment, an entity interaction map, the entity interaction map providing a representation of the entity interaction between the first entity and the second entity.

Security analytics mapping operation within a distributed security analytics environment

A system, method, and computer-readable medium are disclosed for performing a security analytics mapping operation. The security analytics mapping operation includes: monitoring a plurality of electronically-observable actions of a first entity, the plurality of electronically-observable actions of the first entity corresponding to a respective first plurality of events enacted by the first entity; monitoring a plurality of electronically-observable actions of a second entity, the plurality of electronically-observable actions of the second entity corresponding to a respective second plurality of events enacted by the second entity; determining whether a first event of the respective first plurality of events and a second event of the respective second plurality of events comprise an entity interaction between the first entity and the second entity; generating an entity interaction map, the entity interaction map providing a representation of the entity interaction between the first entity and the second entity.

Security analytics mapping system

A system, method, and computer-readable medium are disclosed for implementing a cybersecurity system having a digital certificate reputation system. At least one embodiment is directed to a computer-implemented method executing operations including receiving a communication having an internet protocol (IP) address and a digital certificate at a device within the secured network; determining whether the IP address is identified as having a high-security risk level; if the IP address has a high-security risk level, assigning a security risk level to the digital certificate based on the security risk level of the IP address; and using the security risk level for the digital certificate in executing the one or more security policies. Other embodiments include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices.

Cybersecurity system having digital certificate reputation system

A method, system, and computer-usable medium for protecting against contagion-based risk events are disclosed for monitoring behavior of users to construct a contagion network relationship map of connection and influence relationships between different users and then analyzing a received stream of events from the users to identify a critical event performed by a first user having a first risk score so that one or more propagated risk scores can be generated from the first risk score for at least a first connected user based on connection and influence relationships between the first user and the first connected user that are extracted from the contagion network relationship so that an adaptive response may be automatically generated to protect and control against actions by at least the first connected user based on the one or more propagated risk scores.

Growing community of inventors

Austin, TX, United States of America

David Coffey