Code 42 Software, Inc.

Rob Juncker

Andrew Moravec

Daniel L Sullivan

Shane Zako

Vijay Ramanathan

Neil Kulevsky

James Sablatura

Chrysa Freeman

Alex Matheson

Kyle Venberg

Danaca Booth

Systems and techniques for security content delivery based on tagged personas are described herein. User data may be obtained for a user of a network file system. Attributes may be extracted from the user data to establish a user persona. Event data may be obtained for a security event experienced by the network file system. The security event may be associated with the user. A set of available remediation content items may be identified using the event data. A content item may be selected from the set of remediation content items using the user persona. A transmission medium may be determined for transmission of the content item to the user using the user persona. The content item may be transmitted to the user via the transmission medium.

Security content delivery based on tagged personas

Disclosed in some examples are methods, systems, and machine readable mediums for applications that detect indicators of data exfiltration through applications such as browser-based interfaces. The disclosed system monitors file system element events related to one or more target applications (such as browsers) through operating system interfaces. Once an event of interest is detected, the system interfaces with the browser to determine a context for the event of interest that may include a URL of a website that the user was visiting corresponding to the file system element event. If the URL is directed towards a prohibited site, a notification may be generated that may be used as a signal to alert an administrator. As used herein, a file system element may include a file, directory, folder, archive, blob, raw storage, metadata, or the like File system element events may include copying, deleting, modifying, or moving a file system element. A file system element event may be detected by monitoring Input/Output requests of a computing device to write to a file; move a file; delete a file; or the like.

Application-based file exfiltration detection

A system for detecting anomalous user interactions with a computing resource a processor and a memory communicatively coupled to the processor and configured with instructions, which cause the processor to perform operations including receiving a request to monitor interactions of a user with the computing resource, obtaining first event data first event data that includes information that is indicative of first interactions of the user with the computing resource prior to receiving the request and obtaining second event data that includes information that is indicative of second interactions of the user with the computing resource after receiving the request. The operations further include determining, based on the first event data and the second event data, whether a deviation between the first interactions and the second interactions satisfies an indicated criteria. The operations additionally include generating a security alert based on the determination.

Process for automated investigation of flagged users based upon previously collected data and automated observation on a go-forward basis

Growing community of inventors

Lakeville, MN, United States of America

Rob Juncker