Palo Alto Networks, Inc.

Trend Micro Inc.

Wayne Jens Jensen

Chandra Biksheswaran Mouleeswaran

Shaohong Wei

Varun Badhwar

Gaurav Kumar

Angad Abhay Mehata

A security appliance samples data about software defined infrastructures (SDIs) of a cloud computing environment to incrementally build models that map resource attributes indicated in fields to data types. The security appliance uses the model(s) to provide context sensitive help in policy rule constructions.

Security appliance to monitor networked computing environment

A resource database which stores structured data describing resources from a diverse array of origins (e.g., an application or cloud environment) is built and maintained to support querying, policy enforcement, and remediation of resources from any origin. Structured data representing resources are obtained from any origin for insertion and categorized based on their type and/or origin. Resources within a category have a shared set of potential object paths as defined by the hierarchical tree structure of their structured data. Resources may be correlated across categories based on having values at different object paths in common. Queries and rules/policies can thus reference resources of any category and also resources across different categories based on correlations between the resources, thereby extending rule/policy enforcement and incident remediation across multiple different origins of resources.

Domain-independent resource security and management

A security appliance monitors streams of events and detects anomalous behavior by users with respect to software defined infrastructure. The security appliance creates baselines of activities for each user. After generating baselines, the security appliance compares events to the activity baselines of users to detect deviations. If a deviation is detected, then a violation report is generated.

A security appliance is used to evaluate the software defined infrastructure. The security appliance includes a data ingestion and query engine. The data ingestion and query engine is configured to retrieve data associated with a resource in the software defined infrastructure, the data stored in a tree structure, extract selective information for the resource from the retrieved data, and generate a NI model for the resource, with the NI model including a plurality of fields and associated value types. A path document for each of the fields is generated, with the path document including a plurality of attributes related to the resource in the software defined infrastructure. The generated path document for each of the fields of the NI model is stored in a data store of the security appliance.

A security appliance is used to evaluate a software defined infrastructure. The security appliance includes a data ingestion and query engine. The data ingestion and query engine are configured to retrieve configuration and operational information associated with the software defined infrastructure, extract selective information from the retrieved configuration and operational information, and store extracted selective information in a plurality of data store. A policy compliance engine is configured to evaluate selectively stored information for compliance to a policy and generate a report based on the evaluation. The configuration and operational information include information related to asset configuration, audit event indicative of an initiation of an infrastructure related activity for the software defined infrastructure and network communication associated with the software defined infrastructure.

A system and method to evaluate a software defined infrastructure is disclosed. A security appliance is used to evaluate the software defined infrastructure. The security appliance includes a data ingestion and query engine. The data ingestion and query engine is configured to retrieve configuration and operational information associated with the software defined infrastructure, extract selective information from the retrieved configuration and operational information, and store extracted selective information in a plurality of data store. A policy compliance engine is configured to evaluate selectively stored information for compliance to a policy and generate a report based on the evaluation.

A cloud security service is made available to endpoint computers. Network traffic from originating application programs running on endpoint computers are redirected to the cloud security service based on characteristics of the originating application programs. Network traffic from an originating application program may be redirected to the cloud security service by way of a virtual private network (VPN) tunnel or generic routing encapsulation (GRE) tunnel between an endpoint computer and a cloud computing system hosting the cloud security service, for example. Network traffic from an originating application program may also be routed from an endpoint computer to a gateway system, and then redirected from the gateway system to the cloud computing system. The cloud security service may drop or forward network packets of the network traffic depending on a result of scanning the network packets.

Application-based network traffic redirection for cloud security service

A technique for web filtering includes monitoring and recording completed DNS (domain name service) transactions involving a user computer. The user computer may thereafter issue an HTTP (hypertext transport protocol) request to a remote server computer, with the HTTP request including an IP address of the server computer instead of its domain name. The HTTP request may be correlated with the recorded completed DNS transactions to obtain the domain name of the server computer. The domain name of the server computer may be employed to determine the reputation of the domain name for web filtering purposes.

Method and system for web filtering

A network application control system is employed to classify unknown computer network traffic. The system includes a firewall computer with a network filter that filters network traffic generated by endpoint computers running local processes. The system may also include a management computer with an endpoint management server that manages endpoint agents running in the endpoint computers. Unknown network traffic is analyzed to generate a pattern matching signature and a policy recommendation. The policy recommendation may be applied to subsequently received network traffic matching the signature.

Classification of unknown computer network traffic

A client computer may be configured to perform computer security operations in conjunction with a remotely located security server. Upon detection of a computer security event, such as reception of a file, the client computer may generate a query input and determine if the query input has corresponding security information in the security server. When the query input has corresponding security information, the client computer may forward the query input to the security server. In response, the security server may retrieve the security information using the query input and provide the security information to the client computer. As a particular example, the security event may be reception of a file in the client computer and the security information may indicate whether or not the file is infected with a computer virus.

Growing community of inventors

San Jose, CA, United States of America

Wayne Jens Jensen