Abstract: A method for generating a threat indicator for a third-party application. The method includes: obtaining, by a monitoring agentless application (MAA) executing on a computer, a predetermined set of attributes of a third-party application that operates on top of a software as a service (SaaS) instance, wherein the third party-application is a SaaS add-on; obtaining, by the MAA, behavior data from the SaaS instance based on at least an action performed by the third-party application in the SaaS instance; and generating a threat indicator for the third-party application based on the predetermined set of attributes and the behavior data.

Abstract: A method for agentless monitoring of third-party applications is disclosed. The method includes: initiating by a monitoring agentless application (MAA) executing on a computer a service instance in a cloud-based computing environment of a software as a service (SaaS); providing, to a third-party application by the MAA, application access credentials for use in accessing the service instance; and extracting, by the MAA, behavior data from the service instance based on at least an action performed by the third-party application in the service instance.