Abstract: A system and method for detecting cybersecurity threats in a cloud computing environment utilizing runtime data is presented. The method includes: receiving runtime data from a runtime sensor deployed on a resource in a cloud computing environment, wherein the runtime sensor is configured to detect runtime events on the resource; generating an event log in an inspection environment based on the received runtime data, each event in the event log generated by extracting data from the runtime data; detecting in the event log a software application identifier of a software application; querying a security database based on the software application identifier; determining, based on a result of querying, that the software application was not previously detected on the resource; and initiating inspection of the resource in response to determining that the software application corresponding to the software application identifier was not previously detected on the resource.

Abstract: A system and method for cybersecurity threat investigation using sensor-based runtime execution data is presented. The method includes receiving aggregated runtime data from a sensor deployed on a resource in a cloud computing environment; generating an event log based on the aggregated runtime data, each event in the event log generated by extracting data from the aggregated runtime data; detecting in the event log a new software application identifier based on an event in the event log; and initiating inspection of the resource to detect a cybersecurity object, the cybersecurity object indicating the new software application.

Abstract: A system and method for cybersecurity threat detection using an activity baseline generated based on sensor-detected runtime execution data is presented. The method includes: receiving aggregated runtime data from a sensor deployed on a resource in a cloud computing environment; generating an event log based on the aggregated runtime data, each event in the event log generated by extracting data from the aggregated runtime data; generating an activity baseline for a process executed on the resource based on the event log; receiving a new event from the sensor; and determining that the new event is anomalous based on the generated activity baseline.

Abstract: A system and method for improved endpoint detection and response (EDR) in a cloud computing environment by decreasing network bandwidth usage are presented. The method includes: configuring a resource in a cloud computing environment to deploy thereon a runtime sensor, the runtime sensor configured to detect runtime data of the resource; configuring the runtime sensor to detect in the runtime data a plurality of events, each event sharing a common value; configuring the runtime sensor to generate an aggregated event record based on the detected plurality of events having a common value; receiving the aggregated event record from the runtime sensor; generating a plurality of unmerged event records based on the aggregated event record; and storing the unmerged event records in a cloud computing storage.

Abstract: A system and method for detecting cybersecurity threats in a cloud computing environment utilizing sensor based runtime execution data is presented. The method includes receiving aggregated runtime execution data from a runtime sensor deployed on a resource in a cloud computing environment, wherein the runtime sensor is configured to aggregate runtime execution data; generating an event log based on the aggregated runtime execution data, each event in the event log generated by extracting data from the aggregated runtime execution data; detecting in the event log a software application identifier; and initiating inspection of the resource in response to determining that a software application corresponding to the software application identifier was not previously detected on the resource.

Abstract: A system and method for deploying a multi-architecture sensor for cybersecurity object detection is presented. The method includes: deploying a monitoring debugger on a hardware abstraction layer of a virtual instance, the virtual instance deployed in a computing environment; deploying a sensor application communicating with the monitoring debugger, the sensor application configured to detect events in the virtual instance; detecting an event based on data detected by the sensor application; determining that the detected event corresponds to a cybersecurity issue; and initiating a remediation action based on the cybersecurity issue.

Abstract: A system and method for cybersecurity threat detection using an activity baseline generated based on sensor-detected runtime execution data is presented. The method includes: receiving aggregated runtime data from a sensor deployed on a resource in a cloud computing environment; generating an event log based on the aggregated runtime data, each event in the event log generated by extracting data from the aggregated runtime data; generating an activity baseline for a process executed on the resource based on the event log; receiving a new event from the sensor; and determining that the new event is anomalous based on the generated activity baseline.

Abstract: A system and method for validating cybersecurity issues utilizing runtime data is disclosed. In an embodiment the method includes: inspecting a workload deployed in a computing environment for a cybersecurity issue; deploying a sensor on the workload, the sensor configured to collect runtime data from the workload; initiating a first mitigation action with a first priority in the computing environment in response to validating the cybersecurity issue from the collected runtime data; initiating a second mitigation action with a second priority, which is lower than the first priority, in response to failing to validate the cybersecurity issue from the collected runtime data.

Abstract: A system and method for validating cybersecurity issues utilizing runtime data is disclosed. In an embodiment the method includes: inspecting a workload deployed in a computing environment for a cybersecurity issue; deploying a sensor on the workload, the sensor configured to collect runtime data from the workload; initiating a first mitigation action with a first priority in the computing environment in response to validating the cybersecurity issue from the collected runtime data; initiating a second mitigation action with a second priority, which is lower than the first priority, in response to failing to validate the cybersecurity issue from the collected runtime data.