Fortinet, Inc.

Lacework Inc.

Paraccel LLC

Actian Corporation

Actian Sub Iii, Inc.

Yijou Chen

Vikram Kapoor

Harish Kumar Bharat Singh

Úlfar Erlingsson

Murat Bog

Theodore M Reed

Jay Parikh

Richard Lee Cole

Eugene Szedenits, Jr

Theron D Tock

Vimalkumar Jeyakumar

Ying Xie

Sanjay Kalra

Weifei Zeng

William Joseph McKenna

Sergei Perfilov

Aman Sinha

Sowmya A Karmali

Samuel Joseph Pullara, Iii

Xiaofei Guo

Anil K Nanduri

Matti A Vanninen

Pamela Bhattacharya

Njall Skarphedinsson

Alex Ramachandran Nirmala

Prakash Jalan

Ammar G Ekbote

Nolan K Karpinski

Kenneth Beasley

Joshua L Vertes

Vikram R Varakantam

Rushikesh P Patil

Jean-philippe E Martin

Maximilien P Fechner

Joseph M Wilder

Isha Singhal

Ashwin Jayaprakash

John Payyappillil John

Adin Aoki

Trevor A Welsh

Christopher E Pedigo

Derek G Murray

Mary L Singh

Gurunatha Karaje

Ting-Fang Yen

Andrew D Twigg

Sai Samrat Karlapudi

Christien R Rioux

Ravi Kiran Kumar

Brandon Maister

Bao Nguyen

Christopher Golden

Carsten Varming

Oliver M Williams

Patrice Godefroid

David Nellinger Adamson

Prashant Billore

Julien Sobrier

Japneet Singh

Helgi K Sigurbjarnarson

Naga Venkata Koundinya Muppalla

George B Spofford

Ankita Bhargava

Ross T Bunker

Nicholas W Mcnutt

Christopher Hall

Sathish Kumar Subramanian

Nandish Nanjappa

Helgi Sigurbjarnarson

Chirag P Pandya

Amit Bapat

Connor A Brooks

Srivenkatesh Kumar Vaithianathan

David M Hazekamp

Robert Schoening

Peter W O'hearn

Kinjal Gandhi

Shawn J Marriott

Antons Rebguns

Matthew J Armstrong

Timothy Chase

Anastasios Arvanitis

David McAleer

Declan Wilson

Ellie Goggin

Ian C Richardson

Timothy B Frazier, Jr

Daniel B Graves

Chitra P Kumar

Christiaan De Wet

Divyang J Soni

Richard Yang

Adam Larson

Whitney L Smith

Jacob A Kilby

Curtis Condra

Mandar Pimpale

Bharath Kolar Venkat

An illustrative data platform is disclosed that may monitor a compute asset within a compute environment. This monitoring may include receiving registry data collected, by an agent deployed to the compute asset, from a registry space of the compute asset. Based on the registry data collected by the agent, the data platform may determine that a change within the registry space of the compute asset is associated with a security threat to the compute asset. Accordingly, based on the determining that the change within the registry space is associated with the security threat, the data platform may perform an action configured to facilitate remediation of the security threat. Corresponding methods, systems, and products are also disclosed.

Agent-based monitoring of a registry space of a compute asset within a compute environment

Detecting anomalous behavior of nodes in a hierarchical cloud deployment, including: gathering data describing a cloud deployment as a hierarchy of a plurality of nodes; presenting a graph depicting behavior at a particular hierarchical level of at least a subset of the plurality of nodes; and determining whether behavior associated with a particular node deviates from normal behavior based on a hierarchical portion of plurality of nodes including the particular node.

Detecting anomalous behavior of nodes in a hierarchical cloud deployment

An illustrative method includes identifying, based on a scan of a compute environment associated with an entity, a plurality of attack paths from one or more networks to one or more datasets associated with the entity and determining a set of one or more attack paths included in the plurality of attack paths that include a particular risk artifact. Based on one or more characteristics of the set of one or more attack paths, a risk score specific to the particular risk artifact may be determined and a risk mitigation operation associated with the particular risk artifact may be performed.

Compute resource risk mitigation by a data platform

A containerized agent that is deployed to a compute node of a compute environment and that executes in both user space and kernel space of the compute node is disclosed. The containerized agent collects data associated with a first container entity that is deployed to the compute node and that executes only in the user space of the compute node such that the first container entity is isolated from other entities executing in the user space of the compute node. The containerized agent also provides the collected data associated with the first container entity to a data platform that is monitoring the cloud compute environment using the containerized agent. Corresponding methods, systems, and products are also disclosed.

Containerized agent for monitoring container activity in a compute environment

An illustrative agent deployed in a compute environment monitored by a data platform is disclosed. The agent may access kernel data generated by a kernel of an operating system used within the compute environment. Based on the kernel data, the agent may detect a launch of a new container entity of a set of container entities deployed to the compute environment and managed by a container runtime executing on the operating system. Based on the detecting of the launch of the new container entity, the agent may then provide, to the data platform, agent data that indicates the launch of the new container entity. Corresponding methods, systems, and products are also disclosed.

Kernel-based monitoring of container activity in a compute environment

An illustrative method includes identifying, based on static workload data associated with a compute environment, one or more attack paths from a network to one or more datasets associated with an entity, accessing runtime workload data associated with the compute environment, and performing, based on the runtime workload data, a risk mitigation operation associated with the one or more attack paths.

Attack path risk mitigation by a data platform using static and runtime data

An illustrative method includes receiving, by a data platform configured to monitor the compute environment, runtime workload data collected by an agent deployed to the compute environment, wherein the runtime workload data comprises user space data collected from a user space of the compute environment and kernel space data collected from a kernel space of the compute environment. The method further includes performing, by the data platform, a monitoring operation based on the user space data and the kernel space data of the runtime workload data.

Capturing and using application-level data to monitor a compute environment

Handling of certificates by intermediate actors, including: receiving, by a proxy and from a client, a client certificate and a first private key; generating, by the proxy and based on the client certificate and the first private key, an intermediate certificate; generating, by the proxy and in response to a request from the client to connect to a destination, an alternate certificate for the destination; and providing, to the client, a certificate chain comprising the alternate certificate, the intermediate certificate, and the client certificate.

Handling of certificates by intermediate actors

Risk engine using key performance indicators, including: monitoring network activity associated with a customer to identify one or more infrastructure risks; calculating, based on the identified one or more infrastructure risks, a key performance indicator (KPI); and presenting, via a user interface, a comparison of a risk metric associated with the customer to one or more other risk metrics corresponding to one or more cohorts of the customer selected based on a variable input to a user interface element of the user interface.

Risk engine that utilizes key performance indicators

Methods, apparatuses, and products for a tiered risk engine with user cohorts, including: detecting one or more alerts associated with a user; determining, based on a corresponding risk for each alert of the one or more alerts, a risk score; and controlling access to one or more resources based on the risk score.

Tiered risk engine with user cohorts

Initiating and utilizing pedigree for content, including: gathering information associated with a submission of content; determining, based on the information, a pedigree for the content; and performing one or more actions with respect to the submission of the content based on the pedigree for the content.

Initiating and utilizing pedigree for content

Reducing resource consumption spikes in an anomaly detection framework, including: gathering information describing historical job execution associated with a plurality of customers; assigning, based on the information describing historical job execution, each of the plurality of customers to a particular grouping of a plurality of groupings, wherein each of the plurality of groupings corresponds to a particular time offset within a time interval; and scheduling, for each grouping of the plurality of groupings, at a time offset of a corresponding grouping, execution of one or more jobs associated with one or more customers of the corresponding grouping.

Reducing resource consumption spikes in an anomaly detection framework

An illustrative method includes accessing data representative of a first role associated with a set of permissions with respect to resources within the compute environment and specifying a group of identities assigned to the first role, determining that a first subgroup of one or more identities included the group of identities only uses a first subset of permissions included in the set of permissions to access the resources within the compute environment without using a second subset of permissions, and performing, based on the determining that the first subgroup of one or more identities only uses the first subset of permissions, an operation to reduce permissions usable by the first subgroup of one or more identities.

Role-based permission by a data platform

An illustrative method includes scanning a compute environment associated with an entity and identifying one or more attack paths from a network to one or more datasets associated with the entity. The one or more attack paths each include a series of risk artifacts within the compute environment that can be exploited by an attacker to access the one or more datasets. The method further includes generating one or more attack path risk scores associated with the one or more attack paths and indicative of one or more levels of risk that the one or more attack paths could be exploited to access the one or more datasets. A risk mitigation operation associated with the one or more attack paths is performed based on the one or more attack path risk scores.

Attack path risk mitigation by a data platform

Activity monitoring of a cloud compute environment based on container orchestration data may be performed by a data platform. For example, the data platform may obtain audit log data generated by a container orchestrator within a cloud compute environment, generate a data model based on the audit log data, and use the data model to monitor the activity for a security issue. The data model may be indicative of activity occurring with respect to one or more containerized applications executing within the cloud compute environment and the monitored activity may be activity with respect to the one or more containerized applications. Corresponding methods, systems, and products are also disclosed.

Activity monitoring of a cloud compute environment based on container orchestration data

Growing community of inventors

Cupertino, CA, United States of America

Yijou Chen