Anomali Inc.

Mohsen Imani

Yizheng Zhou

Wei T Huang

Peizhou Guo

Wei Huang

A query building tool receives user input of a natural language query by way of a search interface and decomposes the natural language query into sections. The tool prompts a large language model to, for each section, search a portion of a grammar of a query language having a corresponding query type for each section and construct a query language prompt corresponding to the section. The tool aggregates each query language prompt into an aggregated query language prompt, executes a search using the aggregated query language prompt, and outputs for display using the search interface search results for the natural language query.

Automatic query language generation for specialized query language based on natural language search

A method for managing an attack surface is provided. The method comprises obtaining network traffic logs for the domain, correlating the logs to threats, mapping a flow of network traffic between malicious indicators and host identifiers, determining an exposed set of host identifiers, determining host attributes and indicator attributes of hosts identified in the exposed set, providing the exposed set and the attributes as input to a prioritization model, receiving prioritization scores as output from the prioritization model, and generating a prioritized attack surface data structure based on the scores. An interface is configured to modify a display based on the prioritized attack surface data structure.

Efficient management of complex attack surfaces

A system and a method are disclosed for describing a mechanism for tracking malicious activity detected on a network. For example, based on network data collected from a server, the disclosed system may detect malicious activity originating from a client device directed to the server. To detect the malicious activity, network data may be captured by the server and analyzed. When malicious activity is detected, the system may track the malicious activity, using the network data, to an earliest connection date of a client device from where the malicious activity potentially originated. The earliest connection date may indicate a potential start date of the malicious activity.

Growing community of inventors

Redwood City, CA, United States of America

Mohsen Imani