Dazz, Inc.

Pavel Resnianski

Eshel Yaron

Oren Yona

Eyal Golombek

A system and method for software containers attribution are provided. The method includes de-compiling a configuration file of a container image of a software container; identifying at least one candidate build file in the de-compiled configuration file, wherein the at least one candidate build potentially formed the container image; determining if at least one matching condition is satisfied between each of the at least one candidate build file and the de-compiled configuration file; associating the configuration file with each candidate build file satisfying the matching condition; and updating an inventory with the associated configuration file and the respective candidate build, wherein such association provides a direct mapping between the container image and the build files formed the container image.

Cyber attribution of software containers

Systems and methods for alert management. A method includes analyzing alerts with respect to cybersecurity issues indicated in the alerts to identify at least one group of matching alerts. Each group of matching alerts includes alerts generated by multiple cybersecurity detection tools. A software component associations database is queried based on software components indicated in each of the groups of alerts. The software component associations database stores associations between configuration files of software containers and build files used to build the software containers. At least one group of duplicate alerts is identified among the groups of matching alerts based on associations returned by the software component associations database. The software component indicated by a first alert of each group of duplicate alerts is associated with the software component indicated by a second alert of the group of duplicate alerts. The alerts are managed based on the groups of duplicate alerts.

Systems and methods for cybersecurity alert deduplication, grouping, and prioritization

A system and method for software containers attribution are provided. The method includes de-compiling a configuration file of a container image of a software container; identifying at least one candidate build file in the de-complied configuration file, wherein the at least one candidate build potentially formed the container image; determining if at least one matching condition is satisfied between each of the at least one candidate build file and the de-complied configuration file; associating the configuration file with each candidate build file satisfying the matching condition; and updating an inventory with the associated configuration file and the respective candidate build, wherein such association provides a direct mapping between the container image and the build files formed the container image.

Growing community of inventors

Tel Aviv, Israel

Pavel Resnianski