Abstract: Identifying anomalous behavior of end users or end user devices, including: detecting that a device associated with a user is located at a known location for the user, wherein the device is associated with a plurality of known locations for the user; determining device activity for the device; and detecting, based on a profile associated with the user, that the device activity associated with the user deviates from normal activity for the user when the user is at the known location.

Abstract: An illustrative method includes determining a severity of an anomaly associated with one or more compute assets within a particular compute environment and associated with a particular customer, accessing a plurality of customer datasets collected from a plurality of compute environments associated with a plurality of customers, each compute environment associated with a different customer included in the plurality of customers, and adjusting, based on the plurality of customer datasets, the severity of the anomaly with respect to the particular compute environment.

Abstract: Providing immediate access to vulnerable resources identified by a deployment monitoring tool, including: identifying, in a deployment monitored by a security framework, a security issue associated with one or more resources in the deployment; identifying, based on ancestry information associated with the one or more resources, a portion of code that enables the security issue; and generating an alert indicating the portion of code that enabled the security issue.

Abstract: Deploying a security framework using temporary authorization credentials, including: receiving a request to deploy a security framework in a cloud environment; requesting, from a user, authorization with a cloud service provider of the cloud environment to modify the cloud environment; receiving temporary authorization credentials allowing modification of the cloud environment; and deploying the security framework in the cloud environment using the temporary authorization credentials.

Abstract: Described herein is a data carrier storing program code for causing one or more processors of a data processing system to perform the following steps, the processor(s) having access to multiple criteria, each criterion being associated with an event having a reporting priority: establish a software entity at the data processing system configured to act as a local monitoring entity for the data processing system; monitor the data processing system using the local monitoring entity; raise an event based on the monitoring of the data processing system in dependence on one or more criteria; and in dependence on the event having been raised, assign a heightened reporting priority to one or more other events, the one or more other events being raised in dependence on one or more other criteria.

Abstract: A data platform monitors a compute environment. For example, the data platform receives, from an agent operating in the environment, process data for a process in the environment, where the process data for the process is collected by the agent in response to the agent detecting an initiation of a network connection in the environment and determining that the process is associated with the network connection. The data platform performs an analysis on a combination of the process data received from the agent and additional data. The performance of the analysis may include generating a polygraph representing activities in the environment and/or detecting an anomaly in the environment.

Abstract: Leveraging generative artificial intelligence (AI) to prevent data exfiltration, including: monitoring network activity of a device; and determining, based on at least one generative artificial intelligence (AI) model, whether the network activity indicates a data exfiltration.

Abstract: Various embodiments provide systems and methods for reordering processed network traffic.

Abstract: A change of a user device from a wireless connection to the enterprise network to a wired connection to the enterprise network (or a cellular network) is detected. In response, a snapshot of network conditions relevant to the user device are detected. A health check on the network conditions can identify specific network issues negatively affecting the user device and the issues are remediated. A remediation model is generated with AI that a different user change will occur based on a later health check revealing similar network conditions to the earlier health check. In response, the issues are automatically remediating the specific network issues based on the earlier stored remediation the earlier.

Abstract: Secure mode is enabled on a secured port of a plurality of ports of the switch automatically provisions new access point in cooperation with a Wi-Fi controller. An access point profile is received from the Wi-Fi controller and forwarded to the new access point. The access point profile assigns VLAN IDs for the one or more VLANs to service set identifiers (SSIDs). Subsequent data traffic received from the new access point is forwarded according to a VLAN ID. A management access points automatically provisions VLAN configurations upstream to the switch and the Wi-Fi controller.

Abstract: Firewall statistics for a specific user are analyzed to determine security risk from browsing history and match a set of pre-defined phishing templates to the security risk determinations. A set of customized phishing templates is generated using AI, using a set of pre-defined phishing templates for individual websites is customized for individual users of the plurality of users. A resulting phishing campaign is deployed with simulations using phishing templates and collect user responses to the phishing campaign.

Abstract: Responsive to enabling the split traffic mode, a software-based switch is configured to split layer-2 data traffic between an aggregation link communicatively coupled to the WAN over the secure tunnel and layer 3 NAT communicatively coupled directly to the WAN. Responsive to a service type classification of data traffic matching at least one of the one or more split service types, the secure tunnel is bypassed for the session with the remote destination by switching to the layer 3 NAT for direct transmission to the WAN. Responsive to the service type classification not matching at least one of the one or more split service types, default mode is continued by switching to the aggregation link for transmission to the WAN through the remote firewall.

Abstract: An MPSK mode is enabled for an SSID assigned WPA3 capability for the Wi-Fi network. During connection, MAC binding to the specific WPA3 station is configured to provide a unique PSK, including adding the MAC address and the PSK to an MPSK table. A station type of the specific WPA3 station is detected and a VLAN of a plurality of VLANs is assigned based the station type. In turn, the VLAN applies a security policy specific to the station type.

Abstract: Correlating distinct events to detect security threats, including: receiving data describing an event; identifying a plurality of correlated events by correlating, in response to receiving the data describing the event, the event with one or more other events, wherein the one or more other events occurred before the event; determining a severity for the event based on the plurality of correlated events.

Abstract: Detecting shadow information technology (IT) using network activity logs, including: gathering, from a client device, first information describing network activity by the client device and second information describing application activity by the client device; identifying, based on the first information and the second information, user-initiated network activity; and identifying, from the user-initiated network activity, shadow information technology (IT) activity comprising access of an unauthorized software-as-a-service (SaaS) application.

Abstract: An illustrative method for monitoring a cloud environment may include determining, based on a scan of a compute environment, a set of vulnerable software components in the compute environment, identifying a subset of the vulnerable software components that satisfy an active vulnerability exception, and performing, based on the set of the vulnerable software components, a remedial operation, wherein the subset of the vulnerable software components is deprioritized for the remedial operation based on the active vulnerability exception.

Abstract: Approaches to explaining relational features utilizing surrogate artificial intelligence (AI) models are described. An input to a machine learning (ML) model is received. The ML model returns a verdict corresponding to a network security evaluation-based graph classification. A surrogate AI model is trained to minimize a loss function while causing a masked output to come as close as possible numerically to the graph classification generated without a mask involved in a mathematical equation of the ML model. The AI model utilizes multiple different kinds of masks. Rating reports are generated based on learned masks from the surrogate AI model to indicate nodes or edges in the ML model most heavily responsible for the verdict returned from the ML model.

Abstract: User interactions are detected for a remote client accessing a specific web application hosted by a web application server on an enterprise network. A Directed Acyclic Graph (DAG) corresponding to the specific web application is identified. A real-time API and/or visited URL sequence of the client interactions with the specific web application is tracked to identify anomalous user interactions.

Abstract: Data platforms described herein are configured to perform security monitoring of cloud compute environments, including agentless compute environments or compute environments that include certain agentless assets. For example, an illustrative data platform may identify a designated file for file integrity monitoring, the designated file stored in the cloud compute environment and managed by a cloud-based filesystem service. The data platform may access log data that is produced by the cloud-based filesystem service and that indicates a change to the designated file. Based on this log data, the data platform may perform a file integrity monitoring operation with respect to the designated file, and may apply a product of that file integrity monitoring operation to the security monitoring of the cloud compute environment that is being performed. Corresponding methods, systems, and products are also disclosed.

Abstract: Automated deployment engines described herein may be configured to automatically deploy cloud infrastructure. Such an engine may detect a single command for deploying infrastructure at one or more cloud computing environments, access, based on the single command, one or more configuration files associated with one or more IaC tools selected from a plurality of IaC tools, and deploy, based on the one or more configuration files, the infrastructure at the one or more cloud computing environments using the one or more IaC tools. The engine may then interface, based on the one or more configuration files, the infrastructure with a data platform configured to monitor the infrastructure.