Abstract: A method and system for cloud based control plane level containment of cybersecurity threats is presented. The method includes detecting a plurality of resources deployed in a cloud computing environment, each resource associated with a unique identifier; accessing a log of the computing environment, the log including a plurality of events, each event of the plurality of events including a unique identifier of a resource of the plurality of resources; generating for each resource a state based at least on an event from the log; generating for each resource an activity baseline based at least on the state; detecting an anomalous event based at least on a state and an activity baseline of a resource of the plurality of resource; and initiating a control plane level action in the cloud computing environment on the resource.

Abstract: A system and method for mitigating alerts using network path resolution. A method includes generating a graph mapping between computing resources and workloads, wherein the graph includes nodes and edges, wherein the nodes include computing resource nodes representing respective computing resources and workload nodes representing respective workloads, wherein each workload is at least one process; identifying a path including at least one first workload of the workloads by querying the graph based on a first computing resource of the computing resources indicated in an alert; identifying at least one root cause of an alert based on the identified path; and performing at least one mitigation action based on the identified at least one root cause.

Abstract: A method and system for control plane containment of cybersecurity threat is presented. The method includes generating at least a detection rule for application by a sensor configured to detect events; configuring the sensor to deploy on a resource in a cloud computing environment, and deploying the sensor on the resource, wherein the sensor is configured to: apply the at least a detection rule on a detected event; detect an event which triggers the at least a detection rule, the event corresponding to a process running on the resource; and halt execution of the process.

Abstract: A system and method for remediating a cybersecurity threat based on timeline generation utilizing generative artificial intelligence (AI) is presented. The method includes selecting a group of remediation actions from a plurality of remediation actions, each remediation action executable in a computing environment; detecting a cybersecurity threat in the computing environment, the cybersecurity threat associated with at least an identity; generating a timeline based on the at least an identity, wherein the timeline includes a plurality of detected events in the computing environment; generating a context based at least on the generated timeline and the selected group of remediation actions; processing a prompt utilizing a generative AI model including the generated context, wherein the prompt, when processed by the generative AI model, outputs at least a remediation action; and initiating the at least a remediation action in the computing environment.

Abstract: A system and method for detecting a permission escalation event in a computing environment is disclosed. The method includes: generating a cloned disk based on an original disk of a resource deployed in a computing environment; detecting an identifier of a first principal on the cloned disk; detecting a second principal in the computing environment, the first principal authorized to assume the first principal; storing a representation of the computing environment in a security database, including: a first principal node representing the first principal, and a second principal node representing the second principal, further associated with a permission; querying the representation to determine a permission of the first principal; determining that the second principal includes a permission which the first principal does not include based on a result of querying the representation; and generating a permission escalation event.

Abstract: A system and method for providing cybersecurity incident response is presented. The method includes receiving an incident input based on an event in a computing environment; generating an input for a generative artificial intelligence (AI) based on the received incident input; utilizing the generative AI to generate an output based on the generated input; utilizing the generative AI to associate the received incident input with an incident response action of a plurality of incident response actions; generating a query based on the received incident; executing the query on a security database, the security database including a representation of the computing environment; and initiating a mitigation action based on a result of the executed query and the associated incident response action.

Abstract: A system and method for cybersecurity policy enforcement on a service in a computing environment is presented. The method includes detecting a software service in a computing environment, the service including a code object and a resource; generating a representation of the software service in a security database, the security database further including a representation of the computing environment; applying a policy on the representation of the software service, the policy including a conditional rule; and initiating a remediation action, in response to detecting a policy fail when applying the policy on the representation of the software service.

Abstract: A system and method for technology stack discovery by performing active inspection of a cloud computing environment utilizing disk cloning is presented. The method includes generating an inspectable disk based on an original disk of a reachable resource, wherein the reachable resource is deployed in the cloud computing environment, and accessible from a network which is external to the cloud computing environment; detecting a cybersecurity object, indicating an application, on the inspectable disk; selecting a network path to access the reachable resource; executing an access instruction including a network protocol on the network path to send an instruction to the reachable resource, wherein the reachable resource is configured to send a response to the instruction; and determining that the application is deployed on the reachable resource and utilizing the network protocol, based on detecting in the response a predetermined result.

Abstract: A system and method for root cause analysis. A method includes defining tree structures based on metadata of interconnected systems. Each tree structure represents at least a portion of one of the interconnected systems and includes subtrees. Tree structure pairs are identified based on the tree structures. Each tree structure pair includes first and second tree structures. Graph data structures are generated based on the tree structures. Each graph data structure corresponds to one of the tree structures and includes nodes. Each node of each graph data structure represents a respective subtree of the corresponding tree structure. A comparison is performed between graph data structures, where a first graph data structure representing the first tree structure of each tree structure pair is compared to a second graph data structure representing the second tree structure of the tree structure pair in the comparison. Tree structures are matched based on the comparison.

Abstract: A system and method for tracing suspicious activity to a workload based on a forensic log is presented. The method includes detecting in a cloud log of a cloud computing environment a plurality of events, each event indicating an action in the cloud computing environment; extracting from a first event of the plurality of events an identifier of a cloud entity, wherein the first event includes an action, wherein the action indicates a suspicious event; traversing a security graph to detect a node representing the cloud entity, wherein the security graph further includes a representation of the cloud computing environment; detecting that the node representing the cloud entity is connected to a node representing a cybersecurity vulnerability; and initiating a mitigation action in the cloud computing environment based on the cloud entity and based on the cybersecurity vulnerability.

Abstract: A method and system for identifying and recommending missing system integrations are presented. The method includes obtaining data from one or more integrated systems in a computing environment; identifying one or more references from the data that correspond to an unintegrated system in the computing environment, herein identifying the one or more references includes comparing the one or more references against a list of integrated systems; mapping the one or more references to at least one security finding corresponding to the computing environment; generating at least one suggested connection to the unintegrated system based on the mapping; and establishing a connection to the unintegrated system based on the at least one suggested connection.

Abstract: A system and method for inspecting a resource in an on-premises environment for a cybersecurity threat is presented. The method includes initiating a network communication between an on-premises environment and an inspection environment; scanning the on-premises environment for a workload, the workload including a disk; generating an inspectable disk based on the disk; providing access to an inspector deployed in the inspection environment to inspect the inspectable disk for a cybersecurity object; and releasing a resource allocated to the inspectable disk in response to detecting that inspection of the inspectable disk is complete.

Abstract: A system and method for detecting unintegrated systems in a computing environment is presented. The method includes obtaining data from at least one integrated system in the computing environment; parsing the data to identify one or more references to potential unintegrated systems; comparing each of the one or more references to a predetermined list of integrated systems; flagging each of the one or more references that does not match a known integration as corresponding to an unintegrated system; mapping each of the flagged references to at least one security finding associated with the computing environment; and calculating, for each flagged reference, a value for integrating the unintegrated system based on a frequency with which the unintegrated system is referenced in the obtained data.

Abstract: A method and system for identifying and recommending missing system integrations are presented. The method includes obtaining data from one or more integrated systems in a computing environment; identifying one or more references from the data that correspond to an unintegrated system in the computing environment, herein identifying the one or more references includes comparing the one or more references against a list of integrated systems; mapping the one or more references to at least one security finding corresponding to the computing environment; generating at least one suggested connection to the unintegrated system based on the mapping; and establishing a connection to the unintegrated system based on the at least one suggested connection.

Abstract: A method and system for agentless endpoint detection and response for software appliances deployed in a cloud computing environment is presented. The method includes detecting a software appliance deployed in a cloud computing environment, the software appliance including an application stored on a disk of the software appliance; generating an inspectable disk based on the disk, wherein the disk stores a log of events for the application; inspecting the log of events stored on the inspectable disk to detect a first event indicating a cybersecurity issue; inspecting a network log of the cloud computing environment to detect a second event in the cloud computing environment; determining a cybersecurity threat based on detecting the first event and the second event; and initiating a mitigation action in response to the detection of the cybersecurity threat.

Abstract: A system and method detect a malware infection path in a compute environment. The method includes detecting a malware object on a first workload in a computing environment including a plurality of workloads, wherein the first workload is represented by a resource node on a security graph, the security graph including an endpoint node representing a resource which is accessible to a public network; generating a potential infection path between the resource node and the endpoint node including at least a second resource node connected to the resource node; inspecting a second workload of the plurality of workloads represented by the second resource node; determining that the potential infection path is a confirmed infection path, in response to detecting the malware on the second workload; and determining that the potential infection path is not an infection path, in response to detecting that the second workload does not include the malware.

Abstract: A system and method for securing deployment of computing infrastructure resources.

Abstract: A system and method for noise reduction for cybersecurity alerts in a cloud computing environment is presented. The method includes receiving a plurality of cloud alerts, wherein each cloud alert in the plurality of cloud alerts includes an identifier of a cloud entity; initiating a fuzzy search based on the identifier of the cloud entity and a plurality of code objects stored in a code repository of the cloud computing environment; determining, based on a result of the fuzzy search, a probability that a code object of the plurality of code objects is associated with the cloud alert; removing the cloud alert from the cybersecurity monitoring system in response to determining that the probability exceeds a first predetermined threshold; and initiating a mitigation action in the cloud computing environment based on the cloud alert in response to determining that the probability is below a second predetermined threshold.

Abstract: A method and system for providing textual insights on objects deployed in a cloud environment are provided. The method includes collecting object data on objects deployed in the cloud environment, wherein objects are deployed and operable at different layers of the cloud environment; identifying objects deployed in the cloud environment; constructing a visual representation of the cloud environment, including the identified objects and their relationships; and generating textual insights on the identified objects and their relationships using natural language processing.

Abstract: A system and method for detecting an attack path in a computing environment, is presented.