Abstract: Systems and methods are disclosed for dynamic selection of resource objects in a cloud-based system. The method may comprise defining a scope group from a scope tree, via a dynamic query, wherein the dynamic query comprises executing a query on the scope tree, the query including a name-type rule, a label-type rule, or a combination thereof; and selecting a subtree of the scope tree, to include in the scope group, based on the query. One or more subtrees may be selected as part of a scope group which are then applied by a cloud operating system to control, allow, or prevent access and determine a user's worldview in regards to a networked cloud-based system with all its various components, applications and resources.

Abstract: Systems and methods are disclosed for dynamic selection of resource objects in a cloud-based system. The method may comprise defining a scope group from a scope tree, via a dynamic query, wherein the dynamic query comprises executing a query on the scope tree, the query including a name-type rule, a label-type rule, or a combination thereof; and selecting a subtree of the scope tree, to include in the scope group, based on the query. One or more subtrees may be selected as part of a scope group which are then applied by a cloud operating system to control, allow, or prevent access and determine a user's worldview in regards to a networked cloud-based system with all its various components, applications and resources.

Abstract: A server has a processor and a memory connected to the processor. The memory stores instructions executed by the processor to collect operating signals from machines. The operating signals characterize establishing or closing a network connection associated with a designated application operating within a designated container. The designated container is an isolated process in user space designated by an operating system kernel. A network security policy that permits network connections based upon the operating signals collected is automatically generated.