Abstract: A method performed by a Cloud Access Security Broker (CASB) service includes scanning data stored in one of a cloud provider and a Software-as-a-Service (SaaS) application, wherein the data is for a user associated with a company of a plurality of companies; detecting an incident in a file or email in the data during the scanning; maintaining details of the incident in an in-memory data store, including a current snapshot of the file or email; and providing a notification to the tenant of the incident. The method can further include, subsequent to the incident and while the file or email is being updated, updating the details of the incident in the in-memory data store.

Abstract: Systems and methods include receiving a record associated with an incident that was detected by the CASB system in a Software-as-a-Service (SaaS) application; determining a hash based on a plurality of levels for the record; determining if the record exists in a data store based on the hash, and if the record exists, deleting an old record; and inserting the record in the data store based on the hash, wherein the data store is maintained in-memory and includes records at leaf nodes in a multi-level hash based on the plurality of levels.

Abstract: Systems and methods include receiving a record associated with an incident that was detected by the CASB system in a Software-as-a-Service (SaaS) application; determining a hash based on a plurality of levels for the record; determining if the record exists in a data store based on the hash, and if the record exists, deleting an old record; and inserting the record in the data store based on the hash, wherein the data store is maintained in-memory and includes records at leaf nodes in a multi-level hash based on the plurality of levels

Abstract: Systems and methods include determining log data for a time period at a plurality of senders, wherein each sender is a node in the cloud-based system, and the log data is associated with one or more cloud services; providing the log data to one or more storage clusters, via one or more distributors, for the time period; responsive to all of the plurality of senders performing the providing, moving to a next time period and repeating the determining and the providing; detecting a given sender is a faulty data source or a slow data source; and moving the given sender to a deferred processing list where the given sender does not hold up the moving to the next time period.

Abstract: A computer-implemented method for querying a data source using an optimized exclusion filter expression created from a full filter expression is described. The method includes receiving one or more queries defined by the full filter expression, wherein the one or more queries are for obtaining an output from the data source; performing a reduction on the full filter expression to determine the optimized exclusion filter expression; applying the optimized exclusion filter expression in the data source to exclude data; and applying the full filter expression to data not excluded by the optimized exclusion filter expression.

Abstract: A computer-implemented method for querying a data source using an optimized exclusion filter expression created from a full filter expression is described. The method includes receiving one or more queries defined by the full filter expression, wherein the one or more queries are for obtaining an output from the data source; performing a reduction on the full filter expression to determine the optimized exclusion filter expression; applying the optimized exclusion filter expression in the data source to exclude data; and applying the full filter expression to data not excluded by the optimized exclusion filter expression.