Rubrik, Inc.

Matthew Edward Noe

Di Wu

Shanthi Kiran Pendyala

Seungyeop Han

Arohi Kumar

Gurjeet S Arora

Karan Jayesh Bavishi

Daniel Talamas Cano

John Louie

Chetas Joshi

Biswaroop Palit

Oscar Chen

Benjamin Reisner

Pranava Kumar Adduri

Some examples relate generally to managing and storing data, and more specifically to the real-time detection of ransomware, system (or insider) threats, or the misappropriation of credentials by using file system audit events.

Real-time detection of system threats

Methods and systems for managing the automated retrieval, aggregation, and selection of virtual machines, virtual disks, and electronic files using an integrated data management and storage system are described. In some cases, the integrated data management and storage system may acquire a query with search criteria to identify a set of objects accessible via the integrated data management and storage system, determine the set of objects that satisfies the search criteria, determine a first subset of the set of objects less than all of the set of objects to render, render and display a listing of the first subset, determine a selection of a first plurality of the first subset, and initiate concurrent actions on the first plurality using the integrated data management and storage system. The size of the first subset may vary over time and be determined based on prior user feedback.

Adaptive page rendering for a data management system

Described herein is a system that detects ransomware infection in filesystems. The system detects ransomware infection by using backup data of machines. The system detects ransomware infection in two stages. In the first stage, the system analyzes a filesystem's behavior. The filesystem's behavior can be obtained by loading the backup data and crawling the filesystem to create a filesystem metadata including information about file operations during a time interval. The filesystem determines a pattern of the file operations and compares the pattern to a normal patter to analyze the filesystem's behavior. If the filesystem's behavior is abnormal, the system proceeds to the second stage to analyze the content of the files to look for signs of encryption in the filesystem. The system combines the analysis of both stages to determine whether the filesystem is infected by ransomware.

Ransomware infection detection in filesystems

Described herein is a system that processes personal data in databases. The system samples data stored in columns of data tables and analyzes the sampled data to determine whether the sampled data includes personal data. Based on the analysis, the system marks which data tables and which columns of the data tables store personal data. The system receives a request to process personal data for a subject. From data tables that are marked as storing personal data, the system identifies records storing personal data for the subject. The system additionally identifies other data tables marked as storing personal data that reference or are referenced by the data tables including the records referencing the subject. The system processes the data stored in the columns that are marked as storing personal data.

Data discovery of personal data in relational databases

Realtime detection of ransomware

A process for detecting a threat for a file system is described. Audit events in the file system may be accessed, which may include unique file operations and duplicative file operations. The audit events may be de-duplicated to remove the duplicative file operations. Time series data may be generated that includes the unique file operations but not the duplicative file operations, and the time series data may be analyzed to determine whether a subset of the unique file operations includes file-access instructions. An observed pattern of the file-access instructions may be compared to a normal pattern of file-access instructions to determine whether the observed file-access instructions are abnormal. If the observed file-access instructions are abnormal, an alert may be generated.

Real-time detection of misuse of system credentials

Data discovery in relational databases

Various embodiments provide for alert generation based on alert dependency. For some embodiments, the alert dependency checking facilitates alert noise reduction. Various embodiments described herein dynamically find or discover alert dependencies based on one or more alerts currently active, one or more active alerts generated in the past, or some combination of both. Various embodiments described herein provide alert monitoring that adapts based on an alert state of a machine. Various embodiments described herein generate a health score for a machine based on an alert state of the machine. Various embodiments described herein provide a tool for managing definitions of one or more alerts that can be identified as an active alert for a machine.

Alert dependency discovery

A data management and storage (DMS) cluster of peer DMS nodes manages resources of a multi-tenant environment. The DMS cluster provides an authorization framework that provides user access which is scoped to the resources within a tenant organization and the privileges of the user within the organization. To authorize an action on a resource by a user, the DMS cluster determines determine user authorizations associated with the user defining privileges of the user on the resources of the multi-tenant environment, and organization authorizations associated defining resources of the multi-tenant environment that belong to the organization. The DMS cluster authorizes the action when the user authorizations and organizations authorized indicate that the action on the resource is authorized.

Multi-tenant authorization framework in a data management and storage cluster

Adaptive alert monitoring

Alert dependency checking

A data management and storage (DMS) duster of peer DMS nodes manages resources of a multi-tenant environment. The DMS cluster provides an authorization framework that provides user access which is scoped to the resources within a tenant organization and the privileges of the user within the organization. To authorize an action on a resource by a user, the DMS cluster determines determine user authorizations associated with the user defining privileges of the user on the resources of the multi-tenant environment, and organization authorizations associated defining resources of the multi-tenant environment that belong to the organization. The DMS cluster authorizes the action when the user authorizations and organizations authorized indicate that the action on the resource is authorized.

Growing community of inventors

San Francisco, CA, United States of America

Matthew Edward Noe