Fortinet, Inc.

Lacework Inc.

Paraccel LLC

Actian Corporation

Actian Sub Iii, Inc.

Yijou Chen

Vikram Kapoor

Harish Kumar Bharat Singh

Úlfar Erlingsson

Murat Bog

Theodore M Reed

Sowmya A Karmali

Jay Parikh

Richard Lee Cole

Eugene Szedenits, Jr

Theron D Tock

Vimalkumar Jeyakumar

Ying Xie

Sanjay Kalra

Weifei Zeng

William Joseph McKenna

Sergei Perfilov

Aman Sinha

Samuel Joseph Pullara, Iii

Xiaofei Guo

Matti A Vanninen

Anil K Nanduri

Pamela Bhattacharya

Jean-philippe E Martin

Njall Skarphedinsson

Prakash Jalan

Ammar G Ekbote

Alex Ramachandran Nirmala

Isha Singhal

Ashwin Jayaprakash

Vikram R Varakantam

Nolan K Karpinski

Maximilien P Fechner

Joseph M Wilder

Kenneth Beasley

Rushikesh P Patil

Joshua L Vertes

Andrew D Twigg

Ting-Fang Yen

Patrice Godefroid

David Nellinger Adamson

John Payyappillil John

Adin Aoki

Helgi K Sigurbjarnarson

Mary L Singh

Derek G Murray

Peter W O'hearn

Christopher E Pedigo

Robert Schoening

Ross T Bunker

Trevor A Welsh

Bao Nguyen

Japneet Singh

Gurunatha Karaje

Sai Samrat Karlapudi

Brandon Maister

Christien R Rioux

Curtis Condra

Ravi Kiran Kumar

Christopher Golden

Carsten Varming

Oliver M Williams

Prashant Billore

Julien Sobrier

Venkata Rama Rajesh Gudivada

Daniel B Graves

Chitra P Kumar

Matthew J Armstrong

Divyang J Soni

Kinjal Gandhi

Richard Yang

Adam Larson

Whitney L Smith

Jacob A Kilby

George B Spofford

Mandar Pimpale

David M Hazekamp

Bharath Kolar Venkat

Christiaan De Wet

Naga Venkata Koundinya Muppalla

Helgi Sigurbjarnarson

Ankita Bhargava

Nicholas W Mcnutt

Christopher Hall

Sathish Kumar Subramanian

Nandish Nanjappa

Chirag P Pandya

Amit Bapat

Connor A Brooks

Srivenkatesh Kumar Vaithianathan

Shawn J Marriott

Antons Rebguns

Ryan W Nicholson

Anastasios Arvanitis

Timothy Chase

David McAleer

Declan Wilson

Ellie Goggin

Ian C Richardson

Leveraging information gathered using static analysis for remediating detected issues in a monitored deployment, including: inspecting, using static code analysis, a non-executable representation of an application to identify one or more vulnerabilities in the application; detecting one more conditions in the monitored deployment; and initiating, based on information describing the one or more vulnerabilities in the application that were identified using static code analysis, a remediation workflow.

Leveraging information gathered using static analysis for remediating detected issues in a monitored deployment

An example method includes: receiving, by a data platform configured to collect data from a plurality of service endpoints of a cloud environment, a request to onboard an additional service endpoint for data collection by the data platform; collecting, by the data platform operating in a preview mode of operation based on the request, first data from the plurality of service endpoints and second data from the additional service endpoint; monitoring, by the data platform operating in the preview mode of operation based on the request, for errors associated with the collecting of the first data and the second data; disabling, by the data platform when the monitoring detects an error within a defined period, data collection from the additional service endpoint; and integrating, by the data platform when the monitoring does not detect an error within the defined period, the additional service endpoint into normal data collection.

Expanding data collection from a monitored cloud environment

Data platforms described herein are configured to monitor a compute environment and facilitate interactive analysis of multifaceted security threats within the compute environment. Such a data platform may determine that one or more assets within the compute environment are possibly being targeted by a multifaceted security threat and present an interactive user interface. The user interface may be configured to display an identifier indicative of the multifaceted security threat, a set of selectable evidence items each associated with a different facet of the multifaceted security threat and assessed based on the monitoring of the compute environment, and a presentation pane for displaying information. As such, the data platform may detect a selection of a particular evidence item from the set of selectable evidence items and, in response to the selection, populate the presentation pane with information related to the particular evidence item. Corresponding methods, systems, and products are also disclosed.

Interactive analysis of multifaceted security threats within a compute environment

An illustrative method for querying multiple datasets may include generating, based on models each associated with and defining attributes of a different datasets stored in a plurality of data stores, a semantic layer defining relationships between the models and that provides a centralized application programming interface (API) for exposing the datasets by way of a common query language, receiving, by way of the centralized API, a query request for information that depends on data included in multiple datasets included in the plurality of datasets, querying, based on the query request and the relationships between the models defined by the semantic layer, the multiple datasets, and presenting, based on the querying, a query result representative of the information that depends on the data included in the multiple datasets.

Semantic layer for data platform

Detecting package execution for threat assessments, including: receiving, from an agent on a host of a cloud deployment, data describing one or more active packages installed on the host, wherein each of the one or more active packages are identified by the agent from a plurality of packages in response to detecting a corresponding file open event; and generating a threat assessment for the host describing which of the one or more active packages have any known vulnerabilities.

Detecting package execution for threat assessments

An illustrative data platform is disclosed that may monitor a compute asset within a compute environment. This monitoring may include receiving registry data collected, by an agent deployed to the compute asset, from a registry space of the compute asset. Based on the registry data collected by the agent, the data platform may determine that a change within the registry space of the compute asset is associated with a security threat to the compute asset. Accordingly, based on the determining that the change within the registry space is associated with the security threat, the data platform may perform an action configured to facilitate remediation of the security threat. Corresponding methods, systems, and products are also disclosed.

Agent-based monitoring of a registry space of a compute asset within a compute environment

Detecting anomalous behavior of nodes in a hierarchical cloud deployment, including: gathering data describing a cloud deployment as a hierarchy of a plurality of nodes; presenting a graph depicting behavior at a particular hierarchical level of at least a subset of the plurality of nodes; and determining whether behavior associated with a particular node deviates from normal behavior based on a hierarchical portion of plurality of nodes including the particular node.

Detecting anomalous behavior of nodes in a hierarchical cloud deployment

An illustrative method includes identifying, based on a scan of a compute environment associated with an entity, a plurality of attack paths from one or more networks to one or more datasets associated with the entity and determining a set of one or more attack paths included in the plurality of attack paths that include a particular risk artifact. Based on one or more characteristics of the set of one or more attack paths, a risk score specific to the particular risk artifact may be determined and a risk mitigation operation associated with the particular risk artifact may be performed.

Compute resource risk mitigation by a data platform

A containerized agent that is deployed to a compute node of a compute environment and that executes in both user space and kernel space of the compute node is disclosed. The containerized agent collects data associated with a first container entity that is deployed to the compute node and that executes only in the user space of the compute node such that the first container entity is isolated from other entities executing in the user space of the compute node. The containerized agent also provides the collected data associated with the first container entity to a data platform that is monitoring the cloud compute environment using the containerized agent. Corresponding methods, systems, and products are also disclosed.

Containerized agent for monitoring container activity in a compute environment

An illustrative agent deployed in a compute environment monitored by a data platform is disclosed. The agent may access kernel data generated by a kernel of an operating system used within the compute environment. Based on the kernel data, the agent may detect a launch of a new container entity of a set of container entities deployed to the compute environment and managed by a container runtime executing on the operating system. Based on the detecting of the launch of the new container entity, the agent may then provide, to the data platform, agent data that indicates the launch of the new container entity. Corresponding methods, systems, and products are also disclosed.

Kernel-based monitoring of container activity in a compute environment

An illustrative method includes identifying, based on static workload data associated with a compute environment, one or more attack paths from a network to one or more datasets associated with an entity, accessing runtime workload data associated with the compute environment, and performing, based on the runtime workload data, a risk mitigation operation associated with the one or more attack paths.

Attack path risk mitigation by a data platform using static and runtime data

An illustrative method includes receiving, by a data platform configured to monitor the compute environment, runtime workload data collected by an agent deployed to the compute environment, wherein the runtime workload data comprises user space data collected from a user space of the compute environment and kernel space data collected from a kernel space of the compute environment. The method further includes performing, by the data platform, a monitoring operation based on the user space data and the kernel space data of the runtime workload data.

Capturing and using application-level data to monitor a compute environment

Handling of certificates by intermediate actors, including: receiving, by a proxy and from a client, a client certificate and a first private key; generating, by the proxy and based on the client certificate and the first private key, an intermediate certificate; generating, by the proxy and in response to a request from the client to connect to a destination, an alternate certificate for the destination; and providing, to the client, a certificate chain comprising the alternate certificate, the intermediate certificate, and the client certificate.

Handling of certificates by intermediate actors

Risk engine using key performance indicators, including: monitoring network activity associated with a customer to identify one or more infrastructure risks; calculating, based on the identified one or more infrastructure risks, a key performance indicator (KPI); and presenting, via a user interface, a comparison of a risk metric associated with the customer to one or more other risk metrics corresponding to one or more cohorts of the customer selected based on a variable input to a user interface element of the user interface.

Risk engine that utilizes key performance indicators

Methods, apparatuses, and products for a tiered risk engine with user cohorts, including: detecting one or more alerts associated with a user; determining, based on a corresponding risk for each alert of the one or more alerts, a risk score; and controlling access to one or more resources based on the risk score.

Tiered risk engine with user cohorts

Growing community of inventors

Cupertino, CA, United States of America

Yijou Chen