Lacework Inc.

Fortinet, Inc.

Harish Kumar Bharat Singh

Vikram Kapoor

Yijou Chen

Murat Bog

Theron D Tock

Vimalkumar Jeyakumar

Ying Xie

Weifei Zeng

Samuel Joseph Pullara, Iii

Trevor A Welsh

Handling of certificates by intermediate actors, including: receiving, by a proxy and from a client, a client certificate and a first private key; generating, by the proxy and based on the client certificate and the first private key, an intermediate certificate; generating, by the proxy and in response to a request from the client to connect to a destination, an alternate certificate for the destination; and providing, to the client, a certificate chain comprising the alternate certificate, the intermediate certificate, and the client certificate.

Handling of certificates by intermediate actors

Methods, apparatuses, and products for a tiered risk engine with user cohorts, including: detecting one or more alerts associated with a user; determining, based on a corresponding risk for each alert of the one or more alerts, a risk score; and controlling access to one or more resources based on the risk score.

Tiered risk engine with user cohorts

A data platform receives data associated with activities in an environment, generates a logical graph using at least a portion of the received data, the logical graph representative of launch behaviors of components in the environment, detects an anomaly based on the logical graph, and generates an alert based on the anomaly. In some embodiments, the data platform may provide data representative of a portion of the logical graph to a computer, the data configured to be processed by the computer to display a visualization of the portion of the logical graph.

Using a logical graph to monitor an environment

Establishing a location profile for a user device, including: gathering information associated with the location of a user device; determining, based on the information associated with the location of a user device, whether the user device is being accessed at a known location; responsive to determining that the user device is being accessed at a known location: determining a characterization of the known location; and determining, based on the characterization of the known location, whether device utilization is anomalous; and responsive to determining that the user device is not being accessed at a known location: determining a characterization of the unknown location; and determining, based on the characterization of the unknown location, whether device utilization is anomalous.

Establishing a location profile for a user device

Using activity monitored by multiple data sources to identify shadow systems, the method comprising: gathering first information describing access to one or more resources by one or more user devices of a user; gathering, from at least a subset of the one or more user devices, second information describing access to the one or more resources; and identifying one or more shadow systems based on a discrepancy between the first information and the second information.

Using activity monitored by multiple data sources to identify shadow systems

An illustrative method includes generating, based on log data associated with at least one user session in a network environment associated with a user, a logical graph, wherein the logical graph comprises: (1) a first node corresponding to the user, (2) a plurality of additional nodes, and (3) a set of edges connecting the first node to one or more of the additional nodes, wherein each edge in the set of edges represents a change in behavior of the user; using the logical graph to detect an anomaly, wherein detecting the anomaly includes determining that a change has been made to at least one edge included in the set of edges; and generating, in response to detecting the anomaly, an alert.

Detecting threats against computing resources based on user behavior changes

An illustrative method includes generating a logical graph by performing a clustering operation with respect to log data associated with one or more machines, the clustering operation performed using a first clustering criteria and causing the logical graph to initially include a first set of nodes generated in accordance with relationship requirements of an underlying model and a first set of edges representing communication between nodes included in the first set of nodes; and reclustering, using a second clustering criteria, the logical graph to include, in place of the first set of nodes, a second set of nodes generated while maintaining the relationship requirements of the underlying model and a second set of edges representing communication between nodes included in the second set of nodes.

Graph reclustering based on different clustering criteria

An illustrative method includes determining that a first user login session and a second user login session have a parent-child relationship that indicates that a particular user is associated with both the first and second user login sessions and linking first user login activity performed during the first user login session and second user login activity performed during the second user login session to the user.

Tracking of user login sessions

Detecting anomalous behavior of a device, including: generating, using information describing historical activity associated with a user device, a trained model for detecting normal activity for the user device; gathering information describing current activity associated with the user device; and determining, by using the information describing current activity associated with the user device as input to the trained model, whether the user device has deviated from normal activity.

User-specific data-driven network security

Elastic privileges in a secure access service edge, including: identifying, based on one or more access policies, an application accessible to a user; determining, for the user, an access pattern of the application; and restricting, without modifying the one or more access policies, access to the application by the user based on the access pattern.

Elastic privileges in a secure access service edge

A logical graph is generated using at least a portion of log data received from a set of agents executing on one or more nodes in one or more data centers. The logical graph is augmented using data obtained from one or more agents executing in containerized environments, including by representing communications between pods within the logical graph. The augmented logical graph is used to detect an anomaly.

Alerting based on pod communication-based logical graph

Generating user-specific polygraphs for network activity, including: gathering information describing network activity associated with a user and generating, based on the information, a user-specific polygraph that includes one or more destinations associated with the network activity.

Generating user-specific polygraphs for network activity

Detecting deviations from typical user behavior, including: identifying a geographic location of a device that is associated with a user; determining device activity associated with the user; and detecting, based on a profile associated with the user, that the device activity associated with the user deviates from normal activity for the user.

Detecting deviations from typical user behavior

Detecting anomalous behavior of a device

A data platform receives data associated with activities in an environment, generates a logical graph using at least a portion of the received data, at least in part by clustering multiple nodes into a node of the logical graph based at least in part on behaviors in the network environment, and provides data representing a portion of the logical graph to a computer, the data representing the portion of the logical graph configured to be processed by the computer to display a visualization of the portion of the logical graph. The data platform may provide the data to the computer in response to receiving a query from the computer. The data platform may use the logical graph to detect an anomaly in the environment.

Growing community of inventors

Mountain View, CA, United States of America

Harish Kumar Bharat Singh