Bromium, Inc.

Lacework Inc.

Oracle International Corporation

Fortinet, Inc.

Hewlett-packard Development Company, L.p.

Pillar Data Systems, Inc.

Vikram Kapoor

Gaurav Banga

Ian Pratt

Yijou Chen

Harish Kumar Bharat Singh

Kiran Bondalapati

Murat Bog

Amit Ganesh

Vineet Marwah

Samuel Joseph Pullara, Iii

Kam Shergill

Deepak Khajuria

Theron D Tock

Jesse Kamp

Vimalkumar Jeyakumar

Ying Xie

Sanjay Kalra

Roger MacNicol

Weifei Zeng

Nipun Agarwal

Sachin Kulkarni

Prakash Buddhiraja

Rakesh Sachdeva

Sam Idicula

Eric Sedlar

Manosiz Bhattacharyya

Krzysztof Uchronski

Namit Jain

Syam Sundar Pannala

Jacob Gorm Hansen

Simon Crosby

Martin O'Brien

Thomas Baby

Kurt Alan Shoens

Rex Rilen Hamilton

Sergei Vorobiev

Mark Steven Schultz

Ravi Murthy

Xin Li

Chon Hei Lei

Thomas F Keefe

Vikram Reddy Pesati

David Halls

Adrian Taylor

Andrew Southgate

Mohammed Irfan Rafiq

Roger Dermot Macnicol

Trevor A Welsh

Vadim Dmitriev

Jesse Kemp

Vivek Srivastava

Mahesh Pisal

Gianni Tedesco

Anushree Pole

Deepak Khajura

Stephen Rice

Sachin Kulkami

Handling of certificates by intermediate actors, including: receiving, by a proxy and from a client, a client certificate and a first private key; generating, by the proxy and based on the client certificate and the first private key, an intermediate certificate; generating, by the proxy and in response to a request from the client to connect to a destination, an alternate certificate for the destination; and providing, to the client, a certificate chain comprising the alternate certificate, the intermediate certificate, and the client certificate.

Handling of certificates by intermediate actors

Methods, apparatuses, and products for a tiered risk engine with user cohorts, including: detecting one or more alerts associated with a user; determining, based on a corresponding risk for each alert of the one or more alerts, a risk score; and controlling access to one or more resources based on the risk score.

Tiered risk engine with user cohorts

In some embodiments, a data platform receives a first set of connection information collected from a first machine in a cloud environment, receives a second set of connection information collected from a second machine in the cloud environment, identifies, based on the first set of connection information and the second set of connection information, a pod-to-pod communication from a source pod on the first machine to a destination pod on the second machine, and generates a graph that includes a plurality of nodes representing a plurality of pods and a plurality of edges interconnecting the plurality of nodes and representing communications between the plurality of pods, wherein the graph represents the pod-to-pod communication from the source pod on the first machine to the destination pod on the second machine.

Monitoring communications in a containerized environment

A data platform receives data associated with activities in an environment, generates a logical graph using at least a portion of the received data, the logical graph representative of launch behaviors of components in the environment, detects an anomaly based on the logical graph, and generates an alert based on the anomaly. In some embodiments, the data platform may provide data representative of a portion of the logical graph to a computer, the data configured to be processed by the computer to display a visualization of the portion of the logical graph.

Using a logical graph to monitor an environment

Establishing a location profile for a user device, including: gathering information associated with the location of a user device; determining, based on the information associated with the location of a user device, whether the user device is being accessed at a known location; responsive to determining that the user device is being accessed at a known location: determining a characterization of the known location; and determining, based on the characterization of the known location, whether device utilization is anomalous; and responsive to determining that the user device is not being accessed at a known location: determining a characterization of the unknown location; and determining, based on the characterization of the unknown location, whether device utilization is anomalous.

Establishing a location profile for a user device

Using activity monitored by multiple data sources to identify shadow systems, the method comprising: gathering first information describing access to one or more resources by one or more user devices of a user; gathering, from at least a subset of the one or more user devices, second information describing access to the one or more resources; and identifying one or more shadow systems based on a discrepancy between the first information and the second information.

Using activity monitored by multiple data sources to identify shadow systems

Activities within a network environment are monitored (e.g., using agents). At least a portion of the monitored activities are used to generate a logical graph model. The generated logical graph model is used to determine an anomaly. The detected anomaly is recorded and can be used to generate an alert.

Detecting anomalies in a network environment

An illustrative method includes generating, based on log data associated with at least one user session in a network environment associated with a user, a logical graph, wherein the logical graph comprises: (1) a first node corresponding to the user, (2) a plurality of additional nodes, and (3) a set of edges connecting the first node to one or more of the additional nodes, wherein each edge in the set of edges represents a change in behavior of the user; using the logical graph to detect an anomaly, wherein detecting the anomaly includes determining that a change has been made to at least one edge included in the set of edges; and generating, in response to detecting the anomaly, an alert.

Detecting threats against computing resources based on user behavior changes

An illustrative method includes generating a logical graph by performing a clustering operation with respect to log data associated with one or more machines, the clustering operation performed using a first clustering criteria and causing the logical graph to initially include a first set of nodes generated in accordance with relationship requirements of an underlying model and a first set of edges representing communication between nodes included in the first set of nodes; and reclustering, using a second clustering criteria, the logical graph to include, in place of the first set of nodes, a second set of nodes generated while maintaining the relationship requirements of the underlying model and a second set of edges representing communication between nodes included in the second set of nodes.

Graph reclustering based on different clustering criteria

An illustrative method includes determining that a first user login session and a second user login session have a parent-child relationship that indicates that a particular user is associated with both the first and second user login sessions and linking first user login activity performed during the first user login session and second user login activity performed during the second user login session to the user.

Tracking of user login sessions

Detecting anomalous behavior of a device, including: generating, using information describing historical activity associated with a user device, a trained model for detecting normal activity for the user device; gathering information describing current activity associated with the user device; and determining, by using the information describing current activity associated with the user device as input to the trained model, whether the user device has deviated from normal activity.

User-specific data-driven network security

Elastic privileges in a secure access service edge, including: identifying, based on one or more access policies, an application accessible to a user; determining, for the user, an access pattern of the application; and restricting, without modifying the one or more access policies, access to the application by the user based on the access pattern.

Elastic privileges in a secure access service edge

A logical graph is generated using at least a portion of log data received from a set of agents executing on one or more nodes in one or more data centers. The logical graph is augmented using data obtained from one or more agents executing in containerized environments, including by representing communications between pods within the logical graph. The augmented logical graph is used to detect an anomaly.

Alerting based on pod communication-based logical graph

Generating user-specific polygraphs for network activity, including: gathering information describing network activity associated with a user and generating, based on the information, a user-specific polygraph that includes one or more destinations associated with the network activity.

Generating user-specific polygraphs for network activity

Detecting deviations from typical user behavior, including: identifying a geographic location of a device that is associated with a user; determining device activity associated with the user; and detecting, based on a profile associated with the user, that the device activity associated with the user deviates from normal activity for the user.

Detecting deviations from typical user behavior

Growing community of inventors

Cupertino, CA, United States of America

Vikram Kapoor