Abstract: A system for forensic file services is configured to receive data indicative of operations executed on a filesystem element stored on a computing resource associated with a first tenant, to and adjust the data according to an indicated database schema. The system is also configured to store the adjusted data in a record of a partition of a database, where the partition configured to store a history of operations executed on filesystem elements of computing resources associated with the first tenant. The system is further configured to receive a search request to search the database and to execute the search request on a second partition of the database to identify one or more matching records. The system is additionally configured to provide the identified records in response to the search request.

Abstract: A system for forensic file services is configured to receive data indicative of operations executed on a filesystem element stored on a computing resource associated with a first tenant, to and adjust the data according to an indicated database schema. The system is also configured to store the adjusted data in a record of a partition of a database, where the partition configured to store a history of operations executed on filesystem elements of computing resources associated with the first tenant. The system is further configured to receive a search request to search the database and to execute the search request on a second partition of the database to identify one or more matching records. The system is additionally configured to provide the identified records in response to the search request.

Abstract: Disclosed in some examples are systems, methods, and machine readable mediums for identifying insider threats by determining file system element activity models that correlate to undesirable behavior and then utilizing the determined model to detect insider threats. Events involving file system elements of a client computing device (e.g., a network endpoint) may be monitored by a file system element monitoring application on the client computing device. The values of these signals are aggregated across all events of the same type that have occurred within a predetermined time window (e.g., an hour) for a particular client computing device. Each time an aggregated signal has a value over the threshold, an anomaly is recorded. Anomaly counts for each signal are then calculated as the aggregate number of anomalies for a particular signal over a second time period, the span of which is determined by the generation of first anomaly to the close of an alert by the network monitor.

Abstract: A system for detecting anomalous user interactions with a computing resource a processor and a memory communicatively coupled to the processor and configured with instructions, which cause the processor to perform operations including receiving a request to monitor interactions of a user with the computing resource, obtaining first event data first event data that includes information that is indicative of first interactions of the user with the computing resource prior to receiving the request and obtaining second event data that includes information that is indicative of second interactions of the user with the computing resource after receiving the request. The operations further include determining, based on the first event data and the second event data, whether a deviation between the first interactions and the second interactions satisfies an indicated criteria. The operations additionally include generating a security alert based on the determination.

Abstract: A system for detecting anomalous user interactions with a computing resource a processor and a memory communicatively coupled to the processor and configured with instructions, which cause the processor to perform operations including receiving a request to monitor interactions of a user with the computing resource, obtaining first event data first event data that includes information that is indicative of first interactions of the user with the computing resource prior to receiving the request and obtaining second event data that includes information that is indicative of second interactions of the user with the computing resource after receiving the request. The operations further include determining, based on the first event data and the second event data, whether a deviation between the first interactions and the second interactions satisfies an indicated criteria. The operations additionally include generating a security alert based on the determination.

Abstract: A system for forensic file services is configured to receive data indicative of operations executed on a filesystem element stored on a computing resource associated with a first tenant, to and adjust the data according to an indicated database schema. The system is also configured to store the adjusted data in a record of a partition of a database, where the partition configured to store a history of operations executed on filesystem elements of computing resources associated with the first tenant. The system is further configured to receive a search request to search the database and to execute the search request on a second partition of the database to identify one or more matching records. The system is additionally configured to provide the identified records in response to the search request.