Rapid7, Inc.

Ralph McTeggart

Martin Hutchings

Sarah Addis

Niall Cochrane

Daniel Skelton

Ryan Williams

Jeff Myers

Stuart Millar

Luis Ramos Dos Santos Lopes

Darragh Delaney

Erran Carey

Lars-Kristian Svenoy

John Brosnan

Dan-Adrian Moinescu

Andriy Lyubka

Morgan Doyle

Luke Coughlan

Gianpaolo Tedesco

Luis Lopes

Gianni Tedesco

Ashwin Anand

Luke Coughlin

Karin Gemmert

Christopher Dowey

Ceara McCurdy

Jun Qian

Ryan Edwards

Mark McKinless

Matthew Mccarrison

Techniques for verifying correctness of associations between assets related to events detected in at least one computer network and assets in an asset catalog for the at least one computer network. The techniques include obtaining information specifying a first asset and a first set of assets with which the first asset was previously associated; generating a signature of the first asset from the computer network addressing information for the first asset; generating a hashed signature by applying a locality sensitive hashing (LSH) technique to the signature; associating the first asset with a second set of assets in the asset catalog using the hashed signature and at least one hashed signature of the at least one asset in the asset catalog; and when it is determined that the second set of includes the first set, outputting an indication that the first asset was correctly associated with the first set of assets.

Hashing techniques for verifying correctness of associations between assets related to events and addressable computer network assets

Techniques for associating assets related to events detected in at least one computer network with respective assets in an asset catalog for the at least one computer network. The techniques include: while monitoring activity on the at least one computer network, obtaining information about an event related to a first asset, the information specifying computer network addressing information for the first asset; generating a signature of the first asset from the computer network addressing information; generating a hashed signature of the first asset by applying a locality sensitive hashing (LSH) technique to the signature; associating the first asset with at least one asset in the asset catalog using the hashed signature of the first asset and at least one hashed signature of the at least one asset in the asset catalog; and outputting information identifying the at least one asset with which the first asset was associated.

Hashing techniques for associating assets related to events with addressable computer network assets

Various embodiments include systems and methods to implement a security posture recommender system. The security posture recommender system may improve the security posture of a deployment of assets by generating recommendation data indicating how to modify the deployment of assets. A deployment may be described by deployment data. The recommendation data may be based on similarities and/or differences between deployment data for a particular user and deployment data associated with users that are within a cluster of users similar to the particular user.

Security posture recommender system

Techniques for verifying correctness of associations between assets related to events detected in at least one computer network and assets in an asset catalog for the at least one computer network. The techniques include: obtaining information specifying a first asset and a first set of assets with which the first asset was previously associated; generating a signature of the first asset from computer network addressing information for the first asset using at least one trained machine learning model; associating the first asset with a second set of assets using the signature and at least one signature of the at least one asset, wherein the at least one signature was previously determined using the at least one trained machine learning model; and when it is determined that the second set includes the first set, outputting an indication that the first asset was correctly associated with the first set of assets.

Machine learning techniques for verifying correctness of associations between assets related to events and addressable computer network assets

Disclosed herein are methods, systems, and processes for centralized containerized deployment of network traffic sensors to network sensor hosts for deep packet inspection (DPI) that supports various other cybersecurity operations. A network sensor package containing a pre-configured network sensor container is received by a network sensor host from a network sensor deployment server. Installation of the network sensor package on the network sensor host causes execution of the network sensor container that further causes deployment of an on-premise network sensor along with a network sensor management system, a DPI system, and an intrusion detection/prevention (IDS/IPS) system. The configurable on-premise network sensor is deployed on multiple operating system distributions of the network sensor host and generates actionable network metadata using DPI techniques for optimized log search and management and improved intrusion detection and response (IDR) operations.

Managed deployment and configuration of network sensors

Techniques for associating assets related to events detected in at least one computer network with respective assets in an asset catalog for the at least one computer network. The techniques comprising: obtaining information about an event related to a first asset, the information specifying computer network addressing information for the first asset; generating a signature of the first asset from the computer network addressing information using at least one trained machine learning model, wherein the signature comprises a numeric representation of the first asset; associating the first asset with at least one asset in the asset catalog using the signature and at least one signature of the at least one asset in the asset catalog, wherein the at least one signature was previously determined using the at least one trained machine learning model; and outputting information identifying the at least one asset with which the first asset was associated.

Machine learning techniques for associating assets related to events with addressable computer network assets

Disclosed herein are methods, systems, and processes for accepting and servicing interface agnostic validated unified platform queries. A request for shared data associated with web applications received from a user interface that is rendered by a client based on a specification is intercepted. The request is forwarded to a unified application programming interface (API) instead of a disparate unique API associated with the web applications. The request from the client is authenticated externally using the unified API and the request for the shared data is authorized to be displayed in the user interface based on the unified API instead of the specification.

Interface agnostic validated unified platform queries

A modification to an applied ruleset intended for consumption by intrusion detection systems (IDSs) is detected. A service event that is configured to push the applied ruleset to a set of test network sensors associated with the IDSs is triggered. A service subscribed to the service event updates the set of test network sensors with the applied ruleset and designates a configuration version to the applied ruleset. A notification is received from the set of test network sensors that the applied ruleset has been tested and is ready for deployment to other network sensors and a request is received to deploy the applied ruleset to a set of network sensors. A determination is made whether the request includes the configuration version designated to the applied ruleset by the service. If the request includes the configuration version designated to the applied ruleset, the request to deploy the applied ruleset to the set of network sensors is authorized. If the request does not include the configuration version designated to the applied ruleset, the request to deploy the applied ruleset to the set of network sensors is denied.

Secure verification of detection rules on test sensors

Secure configuration of a network sensor on a network sensor host

New intrusion detection system (IDS) rules to be deployed on an IDS that generates alerts based on an applied ruleset are accessed. A trial window that includes incorporating the new IDS rules into a candidate list to enable summarization and filtering of the alerts is started and the applied ruleset that includes existing IDS rules is supplemented with the candidate list that includes the new IDS rules. The applied ruleset is transmitted to a network sensor associated with the IDS upon the supplementation and alerts generated based on network events implicated by both the existing IDS rules and the new IDS rules in the applied ruleset are received from the IDS. Upon completion of the trial window, a set of alerts generated only by the new IDS rules in the applied ruleset are designated as suppressed alerts and a set of new IDS rules is eliminated from the applied ruleset upon determining that the set of new IDS rules generate a subset of alerts that exceed an alert threshold. The update and modified applied ruleset is then transmitted to the network sensor associated with the IDS.

Curating actionable intrusion detection system rules

Deployable network sensor for multiple platforms

Disclosed herein are methods, systems, and processes to configure and facilitate selective and granular multi-customer support access in cloud-based cybersecurity computing environments. A request to authorize a multi-customer support account (MCSA) is received. Customer accounts that include an anchor tenant customer account and several secondary tenant customer accounts as well as a set of applications associated with the customer accounts are identified. The MCSA is configured to selectively access customer accounts and granularly access associated applications by being designated with a set of varying access limits for the anchor tenant customer account and another set of varying access limits for the secondary tenant customer accounts, each set of varying access limits being made applicable to various instances of applications associated with each of those customer accounts. The designation further restricts a subsequently modifiable access time of the MCSA at least at a client-level, an application level, and a feature-level. The request to authorize the MCSA is then approved.

Selective and granular multi-customer support access

Disclosed herein are methods, systems, processes, and machine learning models for identifying ephemeral or short lived computing assets in a network. Data indicative of potential ephemeralness associated with the computing assets in the network is received. The received data is processed and provided as input to a logistic machine learning model trainer for classification based on logistic regression. The logistic machine learning model trainer classifies each computing asset as ephemeral or non-ephemeral based on one or more ephemeralness feature characteristics of each of the computing assets that are part of input data. The logistic machine learning model trainer generates a trained logistic machine learning model for identifying new ephemeral computing assets in the network and excluding these new ephemeral computing assets from security operations. The logistic machine learning model is then stored for automatically determining whether a new computing asset in the network is ephemeral.

Identifying ephemeral computing assets using machine learning

Disclosed herein are methods, systems, processes, and machine learning paradigms to implement a password semantic analysis pipeline. A password semantic analysis pipeline model is trained according to one or more machine learning techniques to at least (a) determine, based on given characteristics data of a given network environment, whether each of several tokens that are chunked portions of a data structure input as a password in an application is a known syntax type or a recognized entity, (b) generate, using the password semantic analysis pipeline model, a password strength score that is a combination of a confidence score determined for each of the plurality of tokens and a weight factor assigned to the known syntax type or the recognized entity, (c) apply the password strength score to the data structure input as the password in the application, and (d) provide an output to the application indicating whether the data structure input as the password is acceptable or unacceptable for continued access to the application.

Growing community of inventors

Belfast, United Kingdom

Ralph McTeggart