Fortinet, Inc.

Xiaofei Guo

Yijou Chen

Theodore M Reed

Sowmya A Karmali

Nolan K Karpinski

Matti A Vanninen

John Payyappillil John

Christopher E Pedigo

Carsten Varming

Kenneth Beasley

Mary L Singh

Christien R Rioux

Christopher Hall

Kinjal Gandhi

Richard Yang

Adam Larson

Nicholas W Mcnutt

An illustrative method includes identifying, based on a scan of a compute environment associated with an entity, a plurality of attack paths from one or more networks to one or more datasets associated with the entity and determining a set of one or more attack paths included in the plurality of attack paths that include a particular risk artifact. Based on one or more characteristics of the set of one or more attack paths, a risk score specific to the particular risk artifact may be determined and a risk mitigation operation associated with the particular risk artifact may be performed.

Compute resource risk mitigation by a data platform

An illustrative method includes identifying, based on static workload data associated with a compute environment, one or more attack paths from a network to one or more datasets associated with an entity, accessing runtime workload data associated with the compute environment, and performing, based on the runtime workload data, a risk mitigation operation associated with the one or more attack paths.

Attack path risk mitigation by a data platform using static and runtime data

An illustrative method includes scanning a compute environment associated with an entity and identifying one or more attack paths from a network to one or more datasets associated with the entity. The one or more attack paths each include a series of risk artifacts within the compute environment that can be exploited by an attacker to access the one or more datasets. The method further includes generating one or more attack path risk scores associated with the one or more attack paths and indicative of one or more levels of risk that the one or more attack paths could be exploited to access the one or more datasets. A risk mitigation operation associated with the one or more attack paths is performed based on the one or more attack path risk scores.

Attack path risk mitigation by a data platform

An illustrative method includes accessing, by a data platform configured to monitor a compute environment, permissions data representative of a set of permissions that specify how an entity is entitled to interact with resources within the compute environment; collecting, by the data platform, runtime workload data representative of an actual interaction by the entity with the resources over a period of time; and performing, by the data platform based on the runtime workload data, an operation associated with modifying the set of permissions for the entity.

Runtime workload data-based modification of permissions for an entity

An illustrative method includes tracking, by a data platform configured to monitor a compute environment, a plurality of identity transitions that occur over time with respect to an entity, wherein each of the identity transitions includes a transition by the entity from being associated with one identity to being associated with another identity, the one identity and the another identity having different permission sets with respect to resources within the compute environment; determining, by the data platform while performing the tracking, that an attribute of the plurality of identity transitions satisfies a predetermined criterion; and performing, by the data platform based on the attribute of the plurality of transitions satisfying the predetermined criterion, a remedial action associated with the entity.

Transitive identity usage tracking by a data platform

Using natural language queries to conduct an investigation of a monitored system, the method comprising: receiving a natural language input; generating, by a large language model and based on the natural language input, a first query directed to one or more tables of a plurality of tables; generating, based on the first query, one or more second queries each directed to a different table of the one or more tables; and presenting, via a user interface, a response to each of the one or more second queries.

Using natural language queries to conduct an investigation of a monitored system

An illustrative method for operating an agent configuration may include providing an unprivileged agentless workload scanning configuration to collect non-runtime workload data associated with a workload deployed within a cloud environment, determining one or more properties of the workload based on the non-runtime workload data, and performing an operation with respect to a privileged agent configuration deployed within the cloud environment and configured to collect runtime workload data associated with the workload. Likewise, an illustrative method for operating an agentless configuration may include providing a privileged agent configuration to collect runtime workload data associated with a workload deployed within a cloud environment, determining one or more properties of the workload based on the runtime workload data, and performing an operation with respect to an unprivileged agentless scanning configuration deployed within the cloud environment and configured to collect non-runtime workload data associated with the workload.

Growing community of inventors

Sunnyvale, CA, United States of America

Xiaofei Guo