Abstract: Systems and methods include obtaining log data from a storage cluster associated with a cloud-based security system, wherein the log data includes transaction data associated with a plurality of users of the cloud-based security system, wherein the transaction data is for one or more of cloud security service transactions, application access via a Zero Trust Network Access (ZTNA) service, and user experience metrics, and wherein the cloud-based security system includes a plurality of tenants with the plurality of users each assigned thereto; analyzing the log data to determine a plurality of visualizations of the transaction data for a tenant; providing a User Interface (UI) to a mobile application with the plurality of visualizations; and providing a risk score summarizing an overall risk posture of the tenant in a single metric.

Abstract: Systems, methods and apparatus for handling security messages in a distributed security system. Requests, replies, and/or updates have varying time constraints. Processing node managers and authority node managers determine the best transmission times and/or the ignoring of such data to maximize information value.

Abstract: Systems, methods and apparatus for a distributed security that provides security processing external to a network edge. The system can include many distributed processing nodes and one or more authority nodes that provide security policy data, threat data, and other security data to the processing nodes. The processing nodes detect and stop the distribution of malware, spyware and other undesirable content before such content reaches the destination network and computing systems.

Abstract: Methods, systems, and apparatus, including computer program products, for selective presence notification are provided. In one general aspect, a plurality of presence notification messages are monitored. Each presence notification message may include address information identifying at least one of a recipient or a sender of the presence notification message. Based on the address information a determination is made as to whether a presence notification message is allowable. If it is determined that the presence notification message is allowable, the transmission of the presence notification message is allowed.

Abstract: Systems, methods and apparatus for a distributed security that provides security processing external to a network edge. The system can include many distributed processing nodes and one or more authority nodes that provide security policy data, threat data, and other security data to the processing nodes. The processing nodes detect and stop the distribution of malware, spyware and other undesirable content before such content reaches the destination network and computing systems.

Abstract: Systems, methods and apparatus for a distributed security that provides security processing external to a network edge. The system can include many distributed processing nodes and one or more authority nodes that provide security policy data, threat data, and other security data to the processing nodes. The processing nodes detect and stop the distribution of malware, spyware and other undesirable content before such content reaches the destination network and computing systems.

Abstract: Systems, methods and apparatus monitor networks to identify when the networks are not operating normally, for instance, because of malware. During a sample interval sample data is collected that corresponds to a plurality of system activities, the sample data collected from a plurality of monitored networks and representing normal operations of the plurality of monitored networks. Subsequent to the sample interval, observed data is collected from the plurality of monitored networks, the observed data corresponding to at least some of the system activities. A determination is made whether the observed data represents the normal operation of the monitored networks, and an alert is generated if the observed data does not represent the normal operation of the monitored networks.

Abstract: Systems, methods and apparatus monitor networks to identify when the networks are not operating normally, for instance, because of malware. During a sample interval sample data is collected that corresponds to a plurality of system activities, the sample data collected from a plurality of monitored networks and representing normal operations of the plurality of monitored networks. Subsequent to the sample interval, observed data is collected from the plurality of monitored networks, the observed data corresponding to at least some of the system activities. A determination is made whether the observed data represents the normal operation of the monitored networks, and an alert is generated if the observed data does not represent the normal operation of the monitored networks.

Abstract: Systems, methods and apparatus for a distributed security that provides security processing external to a network edge. The system can include many distributed processing nodes and one or more authority nodes that provide security policy data, threat data, and other security data to the processing nodes. The processing nodes detect and stop the distribution of malware, spyware and other undesirable content before such content reaches the destination network and computing systems.

Abstract: Systems, methods and apparatus for handling security messages in a distributed security system. Requests, replies, and/or updates have varying time constraints. Processing node managers and authority node managers determine the best transmission times and/or the ignoring of such data to maximize information value.