Abstract: A cyber security system is adapted to contextualize and visualize cloud architectures featuring ephemeral cloud assets with generation of a cloud asset remediation plan to group alerts for handling based on security team responsibilities.

Abstract: A cyber security system is adapted to generate a cloud architecture assembled from a plurality of cloud resources within a customer cloud environment based on metadata associated with the plurality of cloud resources. The cyber security system features at least a plurality of components. The first component identifies the plurality of cloud resources and collects metadata associated with each of the plurality of cloud resources including a first cloud resource for storage within a storage subsystem. The second component determines how at least the first cloud resource of the plurality of cloud resources is behaving within the customer cloud environment based on analytics conducted on log data and network traffic data associated with the first cloud resource. The third component conducts analytics on information associated with the plurality of cloud resources in order to detect compliance or misconfiguration of the plurality of cloud resources forming the cloud architecture.

Abstract: A cyber security system is adapted to compute enhanced metrics including resource misconfiguration and risk levels associated with a plurality of cloud resources and one or more cloud architectures formed by the plurality of cloud resources within a customer cloud environment.

Abstract: A non-transitory computer readable medium including software that, upon execution by a processor, performs to generate cloud architecture(s) for representation of a customer cloud environment. The software performs operations, including (i) identifying a plurality of cloud resources within a customer cloud environment; (ii) collecting metadata associated with the plurality of cloud resources from a cloud provider of the customer cloud environment; and (ii) augmenting the metadata associated with the plurality of cloud resources based on (a) metadata associated with network traffic data being monitored by sensors deployed within the customer cloud environment, (b) metadata associated with user data, and (c) metadata associated with flow log data. The cloud architecture(s) are provided after augmenting of the metadata.

Abstract: Aspects of the invention relate to a cyber security system that may enable an end user to communicate with a cyber security appliance to identify cyber threats across the client system. The system can include one or more host devices each having a user interface and an endpoint agent for facilitating bi-directional communication between the user and a cyber security appliance. The endpoint agent may include a communication facilitation module including a user interaction module configured to communicate with the user interface and a helper module configured to communicate with the cyber security appliance. The endpoint agent is configured to enable the bi-directional communication between the user interface and the cyber security appliance on receiving a query associated with identified unusual behavior.