Abstract: A system and method for access control in a computerize system comprise generating configuration rules using machine learning. Configuration data of a computerized system is organized into matrices representing entity attributes and entitlements, and is used to train a machine-learning model to generate configuration rules. The model predicts entity entitlement probabilities based on entity attributes. The generated rules include quality metrics and can be used to configure access control for new or existing entities in the system.

Abstract: A system and method for access control in a computerize system comprise generating configuration rules using machine learning. Configuration data of a computerized system is organized into matrices representing entity attributes and entitlements, and is used to train a machine-learning model to generate configuration rules. The model predicts entity entitlement probabilities based on entity attributes. The generated rules include quality metrics and can be used to configure access control for new or existing entities in the system.

Abstract: A method for producing a consistent dataset describing a computing environment, comprising: accessing at least one set of entity description records, each entity description record describing one of a plurality of entities of a computing environment, each entity description record comprising a plurality of attribute values each of one of a plurality of entity attributes; computing a plurality of reliability scores, each reliability score computed for an attribute value of the plurality of attribute values of an entity description record by: identifying at least one conflict between the attribute value and at least one other attribute value of at least one other entity description record; and computing the reliability score according to identifying the at least one conflict; and providing the plurality of reliability scores to at least one management software object for the purpose of performing at least one management operation pertaining to management of the computing environment.

Abstract: There is provided a method for automated permission management, comprising: accessing a graph including nodes denoting different groups having different access permissions levels, each group associated with a set of user identities, the graph including edges between nodes that represent at least a partial subset of one another, each edge associated with a score indicating an accuracy of containment between groups connected by the edge, dynamically adapting a tolerance parameter indicating a threshold for amount of accuracy of containment of user identities between different groups, dynamically adapting the graph by creating or removing edges between nodes according to the score of the respective edges relative to the threshold, automatically merging access permission levels of at least two groups connected by an edge for automatically eliminating redundant access permission levels of the groups, and automatically updating access permission levels of the at least two groups according to the dynamically updated

Abstract: A system and method for maintaining consistent unique identifiers in asset management systems is disclosed. The invention computes a unique identifier for an asset by analyzing digital records associated with digital asset descriptors and received from multiple management domains. A reliability test is applied to determine the most reliable record, and its domain identifier is assigned as the unique identifier for the asset. The system can handle merging of descriptors, conflict resolution, and updates based on new information. The consistent unique identifiers enable efficient execution of various management operations across multiple domains.

Abstract: A method for producing a consistent dataset describing a computing environment, comprising: accessing at least one set of entity description records, each entity description record describing one of a plurality of entities of a computing environment, each entity description record comprising a plurality of attribute values each of one of a plurality of entity attributes; computing a plurality of reliability scores, each reliability score computed for an attribute value of the plurality of attribute values of an entity description record by: identifying at least one conflict between the attribute value and at least one other attribute value of at least one other entity description record; and computing the reliability score according to identifying the at least one conflict; and providing the plurality of reliability scores to at least one management software object for the purpose of performing at least one management operation pertaining to management of the computing environment.

Abstract: A method for managing entities of a computerized system, comprising: generating from descriptors describing entities of a computerized system, updated descriptors, by: identifying in the descriptors records, each record describing an entity and associated with a descriptor describing the entity; and in each of a plurality of iterations, applying to the records a rule of a rule set of a prioritized set of rule sets, in descending order of priority of the prioritized set of rule sets, where in an iteration applying the rule comprises, for a first record describing a first entity and a second record describing a second entity: identifying an equivalence between the first entity and the second entity; identifying a conflict between a first descriptor associated with the first record and a second descriptor associated with the second record; and subject to failing to identify the conflict, merging the first descriptor and the second descriptor.

Abstract: A method for managing assets in a computerized system comprises dynamically recalculating correlations when data changes. The method involves detecting faulty reference values in digital asset-descriptors by computing reliability scores for attribute values used in creating the asset-descriptors. When a reliability score falls below a threshold, the corresponding attribute value is identified as a faulty reference value. The method then selects faulty digital asset-descriptors created based on the faulty reference value, computes new digital asset-descriptors using the faulty ones, and executes management operations using the new asset-descriptors.

Abstract: Disclosed herein are devices, systems and methods for securely accessing data transferred via multiple isolated networks network, comprising adjusting one or more mapping records comprising network mapping and routing settings for a plurality of isolated networks connecting a plurality of clients to a server to expose one of the plurality of isolated networks to one or more processing engines executed by the server while concealing all other isolated networks from the respective processing engine, activating a lock configured to enable each processing engines to execute a single thread, executing the processing engine(s) to fetch data from the exposed isolated network(s), and releasing the lock. Wherein each processing engine is able to access the isolated network exposed to the respective processing engine while unable to access any of the isolated networks concealed from respective processing engine.

Abstract: Optimizing configuration rules in a computerized system comprises accessing a set of configuration rules associated with one or more management domains, computing standardized configuration rules, and iteratively optimizing these rules. The optimization process involves computing a candidate set of optimized rules, comparing the candidate set of optimized rules to the original set using a distance metric, and accepting the optimized set if it meets a proximity threshold. System configuration values are then modified based on the optimized rules. The method enhances efficiency and security in identity management systems by reducing redundancies, updating outdated rules, and simplifying rule expressions.

Abstract: There is provided a computing device for identifying unique software installed on network connected devices, comprising: a processor executing a code for: for each unstructured text for the network connected devices, wherein the unstructured texts are extracted by different code sensors from different applications, wherein each unstructured text indicates an identity of software installed on device(s): dividing the unstructured text into token(s), classifying tokens to software parameter(s) using classification dataset(s), matching subsets of permutations of the software parameters and corresponding tokens to unique software identifiers defined by a common structured format, selecting one unique software identifier according to a set of rules, and generating a text satisfying the common structured format, the text indicating unique software installed on each device.

Abstract: A method for producing a consistent dataset describing a computing environment, comprising: accessing at least one set of entity description records, each entity description record describing one of a plurality of entities of a computing environment, each entity description record comprising a plurality of attribute values each of one of a plurality of entity attributes; computing a plurality of reliability scores, each reliability score computed for an attribute value of the plurality of attribute values of an entity description record by: identifying at least one conflict between the attribute value and at least one other attribute value of at least one other entity description record; and computing the reliability score according to identifying the at least one conflict; and providing the plurality of reliability scores to at least one management software object for the purpose of performing at least one management operation pertaining to management of the computing environment.

Abstract: Disclosed herein are devices, systems and methods for securely accessing data transferred via multiple isolated networks network, comprising adjusting one or more mapping records comprising network mapping and routing settings for a plurality of isolated networks connecting a plurality of clients to a server to expose one of the plurality of isolated networks to one or more processing engines executed by the server while concealing all other isolated networks from the respective processing engine, activating a lock configured to enable each processing engines to execute a single thread, executing the processing engine(s) to fetch data from the exposed isolated network(s), and releasing the lock, Wherein each processing engine is able to access the isolated network exposed to the respective processing engine while unable to access any of the isolated networks concealed from respective processing engine.

Abstract: There is provided a computing device for identifying unique software installed on network connected devices, comprising: a processor executing a code for: for each unstructured text for the network connected devices, wherein the unstructured texts are extracted by different code sensors from different applications, wherein each unstructured text indicates an identity of software installed on device(s): dividing the unstructured text into token(s), classifying tokens to software parameter(s) using classification dataset(s), matching subsets of permutations of the software parameters and corresponding tokens to unique software identifiers defined by a common structured format, selecting one unique software identifier according to a set of rules, and generating a text satisfying the common structured format, the text indicating unique software installed on each device.

Abstract: Disclosed herein are devices, systems and methods for securely accessing data transferred via multiple isolated networks network, comprising adjusting one or more mapping records comprising network mapping and routing settings for a plurality of isolated networks connecting a plurality of clients to a server to expose one of the plurality of isolated networks to one or more processing engines executed by the server while concealing all other isolated networks from the respective processing engine, activating a lock configured to enable each processing engines to execute a single thread, executing the processing engine(s) to fetch data from the exposed isolated network(s), and releasing the lock. Wherein each processing engine is able to access the isolated network exposed to the respective processing engine while unable to access any of the isolated networks concealed from respective processing engine.

Abstract: A system for managing network connected devices, comprising at least one hardware processor adapted to produce a plurality of unique device descriptors, each describing one of a plurality of network connected devices, by: for each of a plurality of device descriptors, each having a plurality of supported actions, and one or more domain device identifiers, each identifier associating the device descriptor with one of a plurality of management domains: for each of the plurality of management domains not associated with the device descriptor: and instructing execution on a network connected device described by the device descriptor a domain identification query according to the descriptor's plurality of supported actions, to determine a new domain device identifier.

Abstract: A system for managing network connected devices, comprising at least one hardware processor adapted to produce a plurality of unique device descriptors, each describing one of a plurality of network connected devices, by: for each of a plurality of device descriptors, each having a plurality of supported actions, and one or more domain device identifiers, each identifier associating the device descriptor with one of a plurality of management domains: for each of the plurality of management domains not associated with the device descriptor: instructing execution on a network connected device described by the device descriptor a domain identification query according to the descriptor's plurality of supported actions, to determine a new domain device identifier; identifying in the plurality of device descriptors a second device descriptor having a domain device identifier equal to the new domain device identifier; and merging the device descriptor with the second device descriptor.

Abstract: Disclosed herein are devices, systems and methods for securely accessing data transferred via multiple isolated networks network, comprising adjusting one or more mapping records comprising network mapping and routing settings for a plurality of isolated networks connecting a plurality of clients to a server to expose one of the plurality of isolated networks to one or more processing engines executed by the server while concealing all other isolated networks from the respective processing engine, activating a lock configured to enable each processing engines to execute a single thread, executing the processing engine(s) to fetch data from the exposed isolated network(s), and releasing the lock. Wherein each processing engine is able to access the isolated network exposed to the respective processing engine while unable to access any of the isolated networks concealed from respective processing engine.

Abstract: A system for managing network connected devices, comprising at least one hardware processor adapted to produce a plurality of unique device descriptors, each describing one of a plurality of network connected devices, by: for each of a plurality of device descriptors, each having a plurality of supported actions, and one or more domain device identifiers, each identifier associating the device descriptor with one of a plurality of management domains: for each of the plurality of management domains not associated with the device descriptor: instructing execution on a network connected device described by the device descriptor a domain identification query according to the descriptor's plurality of supported actions, to determine a new domain device identifier; identifying in the plurality of device descriptors a second device descriptor having a domain device identifier equal to the new domain device identifier; and merging the device descriptor with the second device descriptor.

Abstract: A system for managing network connected devices, comprising at least one hardware processor adapted to produce a plurality of unique device descriptors, each describing one of a plurality of network connected devices, by: for each of a plurality of device descriptors, each having a plurality of supported actions, and one or more domain device identifiers, each identifier associating the device descriptor with one of a plurality of management domains: for each of the plurality of management domains not associated with the device descriptor: instructing execution on a network connected device described by the device descriptor a domain identification query according to the descriptor's plurality of supported actions, to determine a new domain device identifier; identifying in the plurality of device descriptors a second device descriptor having a domain device identifier equal to the new domain device identifier; and merging the device descriptor with the second device descriptor.