Abstract: Systems and methods are disclosed for agentless monitoring of third-party applications in a software as a service (SaaS) environment. A monitoring agentless application (MAA) initiates a service instance in a cloud-based computing environment of a SaaS provider and populates the service instance with simulated resources and simulated data that emulate an authentic SaaS environment while excluding sensitive information. Access credentials are provided to a third-party application, enabling the third-party application to operate within the service instance under realistic conditions. The MAA monitors actions performed by the third-party application with respect to the simulated resources to extract behavior data, such as resource access patterns, data collection frequency, configuration changes, or network communications.

Abstract: A method for agentless monitoring of third-party applications is disclosed. The method includes: initiating by a monitoring agentless application (MAA) executing on a computer a service instance in a cloud-based computing environment of a software as a service (SaaS); providing, to a third-party application by the MAA, application access credentials for use in accessing the service instance; and extracting, by the MAA, behavior data from the service instance based on at least an action performed by the third-party application in the service instance.

Abstract: A method for generating a threat indicator for a third-party application. The method includes: obtaining, by a monitoring agentless application (MAA) executing on a computer, a predetermined set of attributes of a third-party application that operates on top of a software as a service (SaaS) instance, wherein the third party-application is a SaaS add-on; obtaining, by the MAA, behavior data from the SaaS instance based on at least an action performed by the third-party application in the SaaS instance; and generating a threat indicator for the third-party application based on the predetermined set of attributes and the behavior data.

Abstract: The disclosed system and methods are used for collecting information of third-party applications. A search is performed for detecting uniform resource locator (URL) that is associated with a web page allowing to download at least one third-party application. The search is based on URL patterns that are previously and uniquely determined for each digital data source. An identifier, e.g., client ID, of a third-party application is extracted from each URL of a web page which allows to download a third-party application. Then, the system initiates a software as a service (SaaS) instance in a cloud-based computing environment. The system provides to the third-party application access credentials to access the SaaS instance and extract attributes and behavior data of the third-party application based on at least the actions performed by the third-party application in the SaaS instance.

Abstract: A method for agentless monitoring of third-party applications is disclosed. The method includes: initiating by a monitoring agentless application (MAA) executing on a computer a service instance in a cloud-based computing environment of a software as a service (SaaS); providing, to a third-party application by the MAA, application access credentials for use in accessing the service instance; and extracting, by the MAA, behavior data from the service instance based on at least an action performed by the third-party application in the service instance.

Abstract: A method for generating a threat indicator for a third-party application. The method includes: obtaining, by a monitoring agentless application (MAA) executing on a computer, a predetermined set of attributes of a third-party application that operates on top of a software as a service (SaaS) instance, wherein the third party-application is a SaaS add-on; obtaining, by the MAA, behavior data from the SaaS instance based on at least an action performed by the third-party application in the SaaS instance; and generating a threat indicator for the third-party application based on the predetermined set of attributes and the behavior data.