Wiz, Inc.

Microsoft Israel Research and Development (2002) Ltd

Adallom Technologies, Ltd.

Roy Reznik

Ami Luttwak

Shai Keren

Aviram Cohen

Yinon Costica

Yaniv Shaked

Alon Schindel

Avihai Berkovitz

Liran Moysi

Greg Vishnepolsky

Danny Shemesh

Daniel Hershko Shemesh

Gal Kozoshnik

Udi Reitblat

Mattan Shalev

Elad Gabay

Omri Kornblau

Aviel Fogel

Gregory Vishnepolsky

A system and method for generation of unified graph models for network entities are provided. The method includes collecting, for at least one network entity of a plurality of network entities, at least one network entity data feature, wherein the at least one network entity data feature is a network entity property; genericizing the collected at least one network entity; generating at least a network graph, wherein the generated network graph is a multi-dimensional data structure providing a representation of the plurality of network entities and relations between the network entities of the plurality of network entities; and storing the generated at least a network graph.

System and method for generation of unified graph models for network entities

A system and method for agentless generation of a software bill of materials (SBOM) in a cloud computing environment is disclosed. The method includes: accessing a plurality of workloads in a cloud computing environment; detecting in each workload of the plurality of workloads a software component; generating for each workload an SBOM based on the detected software component; and storing each SBOM in a database.

System and method for agentless application inventory detection

A system and method for improved endpoint detection and response (EDR) in a cloud computing environment configures a resource deployed in a cloud computing environment to deploy thereon a sensor, configured to listen on a data link layer for an event. The method further includes detecting a potential cybersecurity threat on the resource; sending a definition based on the cybersecurity threat to the sensor, wherein the definition includes a logical expression, which when applied to an event produces a binary outcome, and wherein the sensor is further configured to apply the definition to the event; determining that the potential cybersecurity threat is an actual cybersecurity threat in response to the produced binary outcome having a predetermined value; and generating an instruction to perform a mitigation action based on the actual cybersecurity threat.

System and method for cybersecurity threat detection utilizing static and runtime data

A method and system for determining abnormal configuration of network objects deployed in a cloud computing environment are provided. The method includes collecting network object data on a plurality of network objects deployed in the cloud computing environment; constructing a network graph based on the collected network object data, wherein the network graph includes a visual representation of network objects identified in the cloud computing environment; determining relationships between the identified network objects in the network graph, wherein the determined relationships between the identified network objects includes descriptions of connections between the identified network objects; and analyzing the network graph and the determined relationships to generate insights, wherein the generated insights include at least a list of abnormal connections between the identified network objects.

System and method for analyzing network objects in a cloud environment

A system and method detect a malware infection path in a compute environment. The method includes detecting a malware object on a first workload in a computing environment including a plurality of workloads, wherein the first workload is represented by a resource node on a security graph, the security graph including an endpoint node representing a resource which is accessible to a public network; generating a potential infection path between the resource node and the endpoint node including at least a second resource node connected to the resource node; inspecting a second workload of the plurality of workloads represented by the second resource node; determining that the potential infection path is a confirmed infection path, in response to detecting the malware on the second workload; and determining that the potential infection path is not an infection path, in response to detecting that the second workload does not include the malware.

Detecting malware infection path in a cloud computing environment utilizing a security graph

A method and system for cataloging network objects in a cloud environment are presented. The system includes collecting at least network object data on a plurality of network objects operable in a cloud environment, wherein the plurality of network objects are operable at different layers of the cloud environment; identifying the plurality of network objects operable in the cloud environment; constructing at least a network graph based on the identified network objects; determining relationships between the identified network objects in the at least a network graph; generating at least an insight for least one of the identified network objects, wherein the insight is generated in response to the network graph and the determined relationships; and tagging each of the plurality of network objects for which an insight is generated.

A method and system for protecting cloud-based applications executed in a cloud computing platform are presented. The method includes intercepting traffic flows from a plurality of client devices to the cloud computing platform, wherein each of the plurality of client devices is associated with a user attempting to access a cloud-based application; extracting at least one parameter from the intercepted traffic related to at least each client device and a respective user attempting to access the cloud-based application; determining based on, the at least one parameter and at least a set of parameters combining cloud-based application risk factors for a provider of the cloud computing platform, a risk indicator for the user attempting to access the cloud-based application; and performing an action to mitigate a potential risk to the cloud computing platform based on the determined risk indicator.

Method and system for protecting cloud-based applications executed in a cloud computing platform

Techniques for reconstructing application-layer traffic flowing between client devices and a cloud computing platform are provided. In an embodiment, the method allows for non-intrusive reconstructing application-layer traffic including requests and responses even in cases including packet drops, re-transmitted packets, and jittered packets. The method includes saving received packets into a zero-copy queue and analyzing the packets saved in the zero-copy memory to identify their respective sessions. Then, each identified session is reconstructed into a session window having a configurable size. In an embodiment, each reconstructed session includes application-layer requests and responses; The method further includes for, each identified session, matching each application-layer request to a corresponding application-layer response based on a matching identifier and time-interval threshold.

Techniques for traffic capture and reconstruction

This application relates generally to a system operating on network traffic between a network-based software as a service (SaaS) provider and a client. The system can be configured as a managed communications network proxy and take action on the network traffic based on predefined policies and rules. The system can include a suffix proxy configured for captive page processing by processing SaaS server responses so that subsequent requests are handled by the suffix proxy dependent on file type and response type.

Growing community of inventors

Tel Aviv, Israel

Roy Reznik