Wiz, Inc.

Microsemi Solutions (us), Inc.

Ron Cohen

Rino Micheloni

Ami Luttwak

Alessia Marelli

Alon Schindel

Eran Kirzner

Shir Tamari

A system and method for detecting cloud identity misuse in a cloud computing environment is presented. The method includes: deploying a runtime sensor on a workload in a cloud computing environment; continuously receiving data from the runtime sensor; generating an activity baseline based on the continuously received data, wherein the runtime sensor is configured to detect runtime processes on the workload; detecting an event in a cloud log, the event including an identifier of the workload; associating a runtime process detected by the runtime sensor on the workload with the event detected in the cloud log; and determining that the event is an anomalous event based on the generated activity baseline.

Techniques for detecting cloud identity misuse leveraging runtime context

A system and method for preventing cloud identity misuse in a cloud computing environment is presented. The method includes: deploying a runtime sensor on a workload in a cloud computing environment; detecting an event in a cloud log, the event including an identifier of the workload; associating a runtime process detected by the runtime sensor on the workload with the event detected in the cloud log; generating an enriched event based on: the detected event, and an identifier of the associated runtime process; applying a policy on the enriched event; and initiating a mitigation action in the cloud computing environment based on a result of applying the policy on the enriched event.

Techniques for preventing cloud identity misuse leveraging runtime context

A system and method for associating an event in a cloud computing log to a process running on a workload is presented. The method includes: configuring a workload deployed in a cloud computing environment to deploy thereon a sensor, the sensor configured to detect a runtime process on the workload, the runtime process utilizing an identity; detecting in a log of the cloud computing environment an event based on an identifier of the workload, the log including a plurality of events; inspecting a code object for a cybersecurity object, the code object utilized in deploying the workload in the cloud computing environment; associating the runtime process with the event based on an identifier of the workload and the cybersecurity object, wherein the cybersecurity object indicates the identity; and generating an enriched log including an identifier of the runtime process associated with the event and the cybersecurity object.

Techniques for cybersecurity investigation of cloud entity misuse leveraging runtime context

A system and method for identifying cloud identity misuse based on run-time time data and static analysis is presented. The method includes: detecting a workload in a cloud computing environment; configuring the workload to deploy a sensor configured to detect data respective of a runtime process executed on the workload; detecting an original disk associated with the workload; generating an inspectable disk based on the original disk; inspecting the inspectable disk for a cybersecurity object; detecting in a log of the cloud computing environment an event based on an identifier of the workload; inspecting a code object for an identity object, the code object utilized in deploying the workload in the cloud computing environment; associating the runtime process with the event based on: an identifier of the workload, the identity object, and the cybersecurity object; and generating an enriched log including an identifier of the runtime process.

Growing community of inventors

Tel Aviv, Israel

Ron Cohen