Extrahop Networks, Inc.

Dropzone.ai, Inc.

Xue Jun Wu

Michael Kerber Krause Montague

Bhushan Prasad Khanal

Benjamin Thomas Higgins

Jeff James Costlow

Nicholas Jordan Braun

Joel Benjamin Deaguero

Jesse Abraham Rothstein

Eric Joseph Hammerle

Songqian Chen

Eric Jacob Ball

Arindum Mukerji

Edmund Hope Driggs

Robert Rowland Foley

Olga Kazakova

Po-Shen Lee

Changhwan Oh

Katherine Megan Porterfield

Jade Alexi Tabony

Swagat Dasgupta

John Gemignani, Jr

Eric James Rongo

Matthew Alexander Schurr

J Braund

Kevin Michael Seguin

Jonathan Jacob Scott

Kenneth Perrault

Amanda Jewitt

Colin James Phillips

Todd Kemmerling

Marc Adam Winners

Karan Rajesh Thakker

Michael Francis Buono

Michael Ryan Corder

Michael Christopher Kelly

Casey Alvin Marks

Sen Xiang

Embodiments perform automated threat hunting in computing environments. A threat hunt plan is obtained to guide collection of candidate evidence items from evidence sources. Portions of candidate evidence items are discarded based on relevance scores, and evidence items are determined from non-discarded portions. Threat indicators associated with the evidence items are identified based on criteria in the threat hunt plan. Threat profiles are obtained based on the evidence items and threat indicators such that threat profiles include threat assessment metrics and are included in a report. Collection agents may interface with system logs, network traffic captures, endpoints, databases, email services, or user activity records to gather evidence items based on time ranges, filtering criteria, or sampling rates.

Automated threat hunting

Embodiments manage context repositories in computing environments to enhance automated security analysis. Embodiments obtain context records containing supplemental information associated with security events and integrates them into prompts for large language models (LLMs) to generate severity scores for event classification. Embodiments apply criteria to invalidate outdated or unreliable context records based on age, source reliability, and usage frequency, then modifies prompts and repositories accordingly. Enhanced prompts incorporate context record summaries and entity relationship mappings to improve subsequent event analysis. Embodiments dynamically evaluates context records through quality filters, consolidates duplicates, and maintains audit trails with provenance tracking. User interfaces are dynamically transformed based on telemetry metrics and user feedback to optimize analyst workflows. Embodiments enable organizations to maintain curated, high-quality context repositories that continuously improve AI-assisted security analysis while reducing false positives and enhancing incident response effectiveness.

Context repository management

Embodiments are directed to monitoring network traffic using network monitoring computers (NMCs). Anomalous events may be classified based on the monitored network traffic and attack models such that the classification determines that targets of the anomalous events may be currently subject to attacks by entities communicating on the networks. A honeypot trap may be provided in the networks based on the classified events such that the honeypot trap mimics characteristics of the targets. The portions of the network traffic associated with the honeypot trap may be monitored. Characteristics of the attacks may be determined based on the monitored portions of network traffic. Reports that include information based on the characteristics of the attacks may be generated.

Automated preemptive polymorphic deception

Embodiments are directed to monitoring network traffic using NMCs that may be arranged to provide scores based on threat assessments associated with anomaly classes such that the anomaly classes may be associated with types of anomalous activity. NMCs may employ the anomaly classes, the scores, characteristics of the anomaly classes, or the like, to determine triage models. The NMCs may modify the scores based on the triage models or archival information associated with the anomaly classes. The NMCs may associate the modified scores with the anomaly classes. In response to detecting anomalous activity, the NMCs may provide other scores based on the anomalous activity and provide a report that includes the other scores to a user.

Modifying triage information based on network monitoring

Embodiments are directed to surveying security environments. A subject index that includes entries may be generated based on a survey of a content system. A question of a client may be compared to entries in the subject index. A prompt associated with the content system may be generated based on the entries, the data sources, or the question. Query models may be employed to obtain data associated with the question from the data sources. Other prompts may be generated based on the data from the data sources to generate candidate answers based on the question and the data from the data sources. An evaluation prompt that includes the candidate answers and the question may be generated to rank the candidate answers for correctness. Answers may be determined based on the ranking of the candidate questions such that top ranked candidate answers are provided to the client.

System for surveying security environments

Embodiments are directed to monitoring network traffic using network monitoring computers (NMCs). Metrics may be determined based on monitoring network traffic associated with a plurality of entities each associated with a profile that includes the metrics for each entity. Beaconing metrics associated with beaconing activity may be determined based on the metrics. The profile of each entity may be compared with the beaconing metrics to determine the entities that may be engaged in beaconing activity. The entities may be characterized based on beaconing activity such that the beaconing activity includes communication with endpoints associated with the third parties, employing communication protocols associated with the third-parties, or exchanging payloads consistent with the beaconing activity. Reports that include information associated with the entities and its beaconing activity may be generated.

Identifying network entities based on beaconing activity

Embodiments are directed to surveying security environments. A subject index that includes entries may be generated based on a survey of a content system. A question a client may be matched to entries in the subject index. A prompt associated with the content system may be generated based on the entries, the data sources, or the question. Query models may be employed to obtain data associated with the question from the data sources. Other prompts may be generated based on the data from the data sources to generate candidate answers based on the question and the data from the data sources. An evaluation prompt that includes the candidate answers and the question may be generated to rank the candidate answers for correctness. Answers may be determined based on the ranking of the candidate questions such that top ranked candidate answers are provided to the client.

Embodiments are directed to security analysis agents. Events associated with a computing environment may be provided. Prompt fragments may be determined based on the events. A prompt may be generated for a large language model (LLM) based on a prompt template and the prompt fragments such that the prompt fragments may be included in the prompt and provided to the LLM. Actions for evaluating the events may be determined based on the LLM response. These actions may be executed to evaluate the events. Portions of the response that correspond to the prompt fragments may be determined. A performance score may be determined for each prompt fragment based on its corresponding portion of the response such that the prompt may be modified to exclude a portion of the prompt fragments that have a performance score less than a threshold value.

Security analysis agents

Embodiments are directed monitoring network traffic using network monitoring computers. Activity associated with a document in a network may be determined based on the network traffic. A profile may be generated based on a summarization of the activity associated with the document such that the profile may be stored in a data store that stores other profiles. Similar profiles may be determined based on a classification of each profile in the data store based on similarities between the profile and the other profiles in the data store. In response to determining similar profiles, locations in the network associated with documents that correspond to the similar profiles may be determined. Locations may be classified based on the activity, the similar profiles and access policies. In response to portions of the locations being classified as inconsistent with the access policies may be reported.

Detecting abnormal data access based on data similarity

Embodiments are directed to monitoring network traffic using network monitoring computers (NMCs). NMCs may determine requests provided to a server based on a first portion of network traffic. NMCs may determine suspicious requests based on characteristics of the provided requests. NMCs may employ the characteristics of the suspicious requests to provide correlation information that is associated with the suspicious requests. NMCs may determine dependent actions associated with the server based on a second portion of the network traffic and the correlation information. And, in response to determining anomalous activity associated with the evaluation of the dependent actions, NMCs may provide reports associated with the anomalous activity.

Detecting injection attacks using passive network monitoring

Embodiments are directed to monitoring network traffic using network monitoring computers (NMCs). Two or more network segments coupled by a traffic forwarding device (TFD) may be monitored. External network addresses and internal network addresses may be determined based on encrypted network traffic exchanged between external endpoints and the TFD and internal network traffic exchanged between internal endpoints and the TFD. Metrics associated with the external network addresses or the internal network addresses may be determined based on the monitoring. Correlation scores may be provided for the external network addresses and the internal network addresses based on of a correlation model, the metrics, or the other metrics. If a correlation score associated with an external network address and an internal network address exceeds a threshold value, the external network address and the internal network address may be associated with each other based on the correlation score.

Correlating network traffic that crosses opaque endpoints

Embodiments are directed to monitoring network traffic using network monitoring computers (NMCs). Networks may be configured to protect servers using centralized security protocols. Centralized security protocols may depend on centralized control provided by authentication control servers. If a client intends to access protected servers it may communicate with the authentication control server to obtain keys that enable it to access the requested servers. NMCs may monitor network traffic the centralized security protocol to collect metrics associated with the control servers, clients, or resource servers.

Monitoring encrypted network traffic

Embodiments are directed to monitoring network traffic using a monitoring engine that monitors network traffic in networks to provide metrics. An inference engine may provide activity profiles based on portions of the network traffic where each activity profile includes features associated with the portions of network traffic. The inference engine may determine other activity profiles correlated with the activity profiles based on correlation models such that the determination of the other activity profiles occurs prior to monitoring an occurrence of other portions of the network traffic. The inference engine may modify monitoring actions of the monitoring engine based on the other activity profiles. The inference engine may provide reports based on the portions of the network traffic, the activity profiles, the other portions of the network traffic, or the other activity profiles.

Growing community of inventors

Seattle, WA, United States of America

Xue Jun Wu