Abstract: Systems and methods include monitoring user experience of one or more users accessing any of the Internet, cloud applications, and private applications; determining a user experience score for the one or more users; responsive to detecting a low user experience score for a user, performing one or more analyses on the user experience of the user; and determining a root cause of the low user experience score based on the one or more analyses. The systems and methods can include determining a remedial action for the user based on the root cause.

Abstract: Techniques for processing web probes for monitoring user experience including use of caching to prevent a surge of web probes on destination servers and for detecting web probe traffic. A method implemented by a connector includes intercepting a Hypertext Transfer Protocol Secure (HTTPS) web probe request to a server, identifying a cache hit associated with the request in a cache, generating a synthetic Hypertext Transfer Protocol (HTTP) response based on information from the identified cache hit, wherein the generated synthetic HTTP response includes an extension header containing collected statistics, and sending the synthetic HTTP response. The method can further include simulating a Secure Socket Layer (SSL) handshake to estimate SSL cost.

Abstract: A method performed by a cloud system includes, subsequent to the cloud system connecting to one of a cloud provider and a Software-as-a-Service (SaaS) application, scanning data stored therein for one or more users associated with a tenant of a plurality of tenants of the cloud system; detecting an incident in the data during the scanning; maintaining details of the incident in an in-memory data store; and providing a notification to the tenant of the incident.

Abstract: A method performed by a Cloud Access Security Broker (CASB) service includes scanning data stored in one of a cloud provider and a Software-as-a-Service (SaaS) application, wherein the data is for a user associated with a company of a plurality of companies; detecting an incident in a file or email in the data during the scanning; maintaining details of the incident in an in-memory data store, including a current snapshot of the file or email; and providing a notification to the tenant of the incident. The method can further include, subsequent to the incident and while the file or email is being updated, updating the details of the incident in the in-memory data store.

Abstract: Systems and methods are provided for evaluating the effectiveness of network security tools for mitigating network security risks. According to one implementation, a method includes the step of analyzing a network to measure security parameters associated with the use of one or more network security tools that are configured for mitigating risk with respect to network compromise, data loss, lateral movement, and asset exposure. Based on the measured security parameters, the method further includes the step of quantifying the one or more network security tools to determine an effectiveness score defining an ability of the one or more network security tools, in combination, to counteract the network compromise, data loss, lateral movement, and asset exposure.

Abstract: Techniques for determining the path of User Datagram Protocol (UDP) traceroute probes using Transmission Control Protocol (TCP) and Internet Control Message Protocol (ICMP). Various embodiments include sending a plurality of probes to one or more legs in a network path; obtaining measurements from each of the plurality of probes for each of the one or more legs in the network path; and performing one or more actions based on the measurements from each of the plurality of probes. The steps further include overlapping the measurements to determine latency to a destination and identifying throttling of UDP traffic based on the overlapping of measurements from the plurality of probes.

Abstract: Systems and methods are provided for performing risk assessment activities and preparing attained risk data for display on one or more user interfaces. In one implementation, a method may include the step of detecting one or more cybersecurity risk factors associated with an organization to determine a risk posture of the organization. The method may further include the step of attaining one or more remediation recommendations for enabling a person associated with the organization to select one or more actions for mitigating the one or more cybersecurity risk factors and improving the risk posture of the organization. Then, the method is configured to communicate display information to a user device associated with the organization, the display information including at least the one or more cybersecurity risk factors and the one or more remediation recommendations to be exhibited on a Graphical User Interface (GUI) of the user device.

Abstract: Techniques for using trace with tunnels and cloud-based systems for determining measures of network performance are presented. In an embodiment, a method includes determining a client application is being executed; determining an endpoint associated with the client application, based on any of monitoring application logs associated with the client application and network flows associated with the client application; and causing one or more probes to the determined endpoint and deriving metrics based on the one or more probes for determining performance of the client application.

Abstract: Systems and methods for alerting administrators of a monitored digital user experience include performing inline monitoring of network access between one or more users each with an associated user device executing an agent application, the Internet, and one or more cloud applications and private applications. The systems and methods also include obtaining device, application, and network metrics related to the inline monitoring from a cloud system and a logging and analytics system. The systems and methods further include comparing the metrics to one or more alerts comprising alert rules. The systems and methods yet further include sending a notification to one or more administrators when the metrics include data that satisfies the alert rules of the one or more alerts.

Abstract: The present systems and methods provide a user performance monitoring solution that enables the monitoring of application and device performance from the end user's point of view. The present systems and methods help Information Technology (IT) personnel to ensure the quality of digital experience across the enterprise. The present system is adapted to collect telemetry data from devices relative to the performance of all tiers of Internet Service Providers (ISPs), create a baseline of the performance of the ISPs based on a plurality of metrics and the collected telemetry data, train a Machine Learning (ML) model to assess blackout and brownout prediction accuracy at different performance values for the metrics, and identify a blackout or brownout, wherein a blackout or brownout is identified when real time performance is worse than the performance values identified by the model.

Abstract: A cloud service is executed on a plurality of nodes, each including at least one processor, and the cloud service is configured to communicate with a plurality of user devices, each user device associated with a user from an organization of a plurality of organizations, and each user device includes a plugin or browser extension installed thereon, provide configuration information to any of the plurality of user devices where the configuration information includes a plurality of domains to be monitored by the plugin or browser extension, wherein the plugin or browser extension is configured to monitor and/or determine real user monitoring (RUM) statistics when a given user device accesses one of the plurality of domains; and receive the RUM statistics from any of the plurality of user devices.

Abstract: Techniques for deep tracing of one or more users via a cloud-based system include receiving a request from an administrator to actively troubleshoot a user; causing a user device associated with the user to create a deep tracing session based on the request; assisting the user device in performing one or more traces of a plurality of traces to a destination; receiving results from any of the plurality of traces and results from metrics collected at the user device; and displaying a network map between the user device and the destination.

Abstract: Techniques for processing web probes for monitoring user experience including use of caching to prevent a surge of web probes on destination servers and for detecting web probe traffic. A method implemented by a connector includes intercepting a Hypertext Transfer Protocol Secure (HTTPS) web probe request to a server, identifying a cache hit associated with the request in a cache, generating a synthetic Hypertext Transfer Protocol (HTTP) response based on information from the identified cache hit, wherein the generated synthetic HTTP response includes an extension header containing collected statistics, and sending the synthetic HTTP response. The method can further include simulating a Secure Socket Layer (SSL) handshake to estimate SSL cost.

Abstract: Techniques for determining the path of User Datagram Protocol (UDP) traceroute probes using Transmission Control Protocol (TCP) and Internet Control Message Protocol (ICMP). Various embodiments include sending a plurality of probes to one or more legs in a network path; obtaining measurements from each of the plurality of probes for each of the one or more legs in the network path; and performing one or more actions based on the measurements from each of the plurality of probes. The steps further include overlapping the measurements to determine latency to a destination and identifying throttling of UDP traffic based on the overlapping of measurements from the plurality of probes.

Abstract: A method performed by a Cloud Access Security Broker (CASB) service includes scanning data stored in one of a cloud provider and a Software-as-a-Service (SaaS) application, wherein the data is for a user associated with a company of a plurality of companies; detecting an incident in a file or email in the data during the scanning; maintaining details of the incident in an in-memory data store, including a current snapshot of the file or email; and providing a notification to the tenant of the incident. The method can further include, subsequent to the incident and while the file or email is being updated, updating the details of the incident in the in-memory data store.

Abstract: Systems and methods include obtaining statistics based on monitoring in a cloud-based system for a given time period; and, responsive to determining an arrangement of counters for N counters, storing each of M counters for the given time period as a plurality of records with each record including a record type, a possible offset to a next record in terms of a counter identifier (ID), and a counter value, wherein N and M are integers and M<<N, and wherein the arrangement is determined such that most frequently used counters occupy lower counter IDs. The systems and methods can further include updating the arrangement of the counters for the N counters, to perform an optimization such that the most frequently used counters occupy lower counter IDs.

Abstract: Techniques for using traceroute with tunnels and cloud-based systems for determining measures of network performance are presented. Systems and methods include requesting a trace to a destination with a signature inserted into a trace packet; receiving a response to the trace packet; when the response does not include tunnel info, providing details in the response to a service where the details include parameters associated with a service path between the client and the destination; and, when the response includes tunnel info, segmenting the service path into a plurality of legs, causing a trace for each of the plurality of legs, and aggregating details for each of the plurality of legs based on the causing.

Abstract: Systems and methods include receiving a record associated with an incident that was detected by the CASB system in a Software-as-a-Service (SaaS) application; determining a hash based on a plurality of levels for the record; determining if the record exists in a data store based on the hash, and if the record exists, deleting an old record; and inserting the record in the data store based on the hash, wherein the data store is maintained in-memory and includes records at leaf nodes in a multi-level hash based on the plurality of levels.

Abstract: Techniques for using trace with tunnels and cloud-based systems for determining measures of network performance are presented. In an embodiment, a method includes determining a client application is being executed; determining an endpoint associated with the client application, based on any of monitoring application logs associated with the client application and network flows associated with the client application; and causing one or more probes to the determined endpoint and deriving metrics based on the one or more probes for determining performance of the client application.

Abstract: Techniques for using traceroute with tunnels and cloud-based systems for determining measures of network performance are presented. Systems and methods include periodically performing a full trace, at a first interval, to a destination; periodically performing a short trace, at a second interval that is less than the first interval, to a node in a cloud-based system; responsive to detection of issues based on the short trace, performing a full trace to the destination; and providing results of any of the full trace, the short trace, and any associated issues detected based thereon.