Fortinet, Inc.

Lacework Inc.

Úlfar Erlingsson

Yijou Chen

Jay Parikh

Jean-philippe E Martin

Pamela Bhattacharya

Ashwin Jayaprakash

Njall Skarphedinsson

Sai Samrat Karlapudi

Derek G Murray

Gurunatha Karaje

Anastasios Arvanitis

Helgi Sigurbjarnarson

Timothy Chase

Detecting anomalous behavior of nodes in a hierarchical cloud deployment, including: gathering data describing a cloud deployment as a hierarchy of a plurality of nodes; presenting a graph depicting behavior at a particular hierarchical level of at least a subset of the plurality of nodes; and determining whether behavior associated with a particular node deviates from normal behavior based on a hierarchical portion of plurality of nodes including the particular node.

Detecting anomalous behavior of nodes in a hierarchical cloud deployment

Initiating and utilizing pedigree for content, including: gathering information associated with a submission of content; determining, based on the information, a pedigree for the content; and performing one or more actions with respect to the submission of the content based on the pedigree for the content.

Initiating and utilizing pedigree for content

Guided interactions with a natural language interface, including: gathering data describing one or more user interactions with a system configured for monitoring a cloud deployment; generating, based on the data, a prompt comprising one or more natural language inputs for a workflow, wherein each of the one or more natural language inputs corresponds to a query for information related to the cloud deployment; and providing a selected natural language input to a natural language interface of the anomaly detection framework.

Guided interactions with a natural language interface

A data collection system is disclosed to be communicatively coupled to a data platform configured to perform security monitoring of a compute environment. A sub-kernel component of the data collection system may collect sub-kernel data accessible from a sub-kernel space below an operating system of a compute resource in the compute environment. The data collection system may manipulate the collected sub-kernel data to prepare the sub-kernel data to be used by the data platform in performing the security monitoring of the compute environment. The data collection system may then communicate the manipulated sub-kernel data to the data platform. Corresponding methods, systems, and products for compute environment security monitoring using data collected from a sub-kernel space are also disclosed.

Compute environment security monitoring using data collected from a sub-kernel space

Optimizing data warehouse utilization by a data ingestion pipeline, including: gathering information describing usage of a plurality of data warehouses; receiving, from a data ingestion pipeline, a request for a data warehouse to receive data from the data ingestion pipeline; selecting, based on the information, the data warehouse from the plurality of data warehouses; and providing, to the data ingestion pipeline, an indication of the data warehouse.

Optimizing data warehouse utilization by a data ingestion pipeline

Reducing amounts of data ingested into a data warehouse, including: determining a duration associated with a subject described by event data provided to a data ingestion pipeline; determining, based on the duration, an interval for providing next event data; and providing, based on the interval, the next event data.

Reducing amounts of data ingested into a data warehouse

Using user feedback for attack path analysis in an anomaly detection framework, including: performing an attack path analysis for a cloud deployment; receiving, from a user, user feedback for an attack vector of the attack path analysis; and initiating, based on the user feedback, a workflow for modifying one or more parameters for generating the attack path analysis.

Using user feedback for attack path analysis in an anomaly detection framework

Learning from other cloud deployments to combat security threats, including: identifying, for at least a portion of a first cloud deployment, one or more additional cloud deployments to utilize for cross-customer learning; receiving information describing a security threat to one or more of the additional cloud deployments; receiving information describing configuration settings used to combat the security threat; and identifying, based on the information describing configuration settings used to combat the security threat, one or more configurations to adopt for the first cloud deployment.

Enhancing security of a cloud deployment based on learnings from other cloud deployments

Leveraging generative artificial intelligence ('AI') for securing a monitored deployment, including: receiving natural language input associated with the monitored deployment, the monitored deployment monitored by a monitoring tool; and receiving, from a generative AI application, a response to the natural language input, wherein: the generative AI application accesses publicly available information as well as data sources associated with the monitoring tool; and the response is generated based at least in part on information contained in the data sources associated with the monitoring tool.

Leveraging generative artificial intelligence ('AI') for securing a monitored deployment

Identifying encountered and unencountered conditions in software applications, including: collecting, for an executing application, information describing the usage of the application, including: receiving, from one or more tracepoints inserted into the application, a first portion of the information describing a state of the application during execution; identifying, based on the information, one or more unencountered conditions that the application is configured to handle; and presenting information describing the unencountered conditions that the application is configured to handle.

Identifying encountered and unencountered conditions in software applications

An example method includes accessing, by a data platform via a network, data from one or more cloud environments; identifying, by the data platform and in the data, first data associated with a first entity and a first data type and second data associated with a second entity and a second data type; mapping, by the data platform and based on the first entity and the first data type, the first data to a first data stream of a data streaming platform; mapping, by the data platform and based on the second entity and the second data type, the second data to a second data stream of the data streaming platform, the second data stream different from the first data stream of the data streaming platform; and generating, based on the first data stream, a graph representing activity associated with the first entity in the one or more cloud environments.

Universal cloud data ingestion for stream processing

Integrating a natural language interface into an anomaly detection framework, including: detecting, by an anomaly detection framework, an occurrence of an event associated with one or more assets that are being monitored by an anomaly detection framework; generating, based on information associated with the detected event, one or more natural language inputs; and submitting, to a natural language interface, the one or more natural language inputs.

Generating computer code for remediating detected events

A natural language interface for an anomaly detection framework, including: receiving a natural language input associated with a cloud deployment; generating a query corresponding to the natural language input by disambiguating at least a portion of the natural language input based on data describing activity associated with an anomaly detection framework monitoring the cloud deployment; and providing, based on a response to the query, a response to the natural language input.

Natural language interface for an anomaly detection framework

Configuring cloud deployments based on learnings obtained by monitoring other cloud deployments, including: determining normal behavior for one or more components in a first cloud deployment; determining normal behavior for one or more components in one or more other cloud deployments; and recommending, based on the normal behavior for one or more components in one or more other cloud deployments, a change to the first cloud deployment.

Configuring cloud deployments based on learnings obtained by monitoring other cloud deployments

Providing a data lake-enabled security platform, including: storing security data associated with a customer in a data lake comprising a plurality of storage environments implemented in different cloud environments of a plurality of cloud environments; generating, based on a plurality of records in the security data, an abstracted security record describing one or more derived insights of the security data; and providing access to the abstracted security record to one or more users associated with the customer.

Growing community of inventors

Palo Alto, CA, United States of America

Úlfar Erlingsson