Abstract: This disclosure describes techniques for facilitating communications between users associated with a Security Orchestration, Automation and Response (SOAR) system using a communication platform that is not native to the SOAR system. In some cases, a system is configured to receive a communication provided by a user profile to a communication interface of the native communication platform, determine that the communication interface is associated with a plurality of user profiles, determine that the one of the plurality of user profiles is associated with the external communication platform, retrieve a set of cross-platform conversion rules for converting communications originating in the native communication platform into communications posted to the external communication platform, determine converted communication data based on the retrieved cross-platform conversion rule(s) and the received communication, and transmit the converted communication to the external communication platform.

Abstract: Techniques for utilizing a language model to mitigate a network vulnerability are described. A language model is deployed that is configured to respond to inputs from network operators. The language model receives a first input from the network operator indicating a description of a network vulnerability. The language model receives a second input including information associated with a configuration of the network. The language model determines a series of actions to execute to mitigate the network vulnerability. Finally, the language model outputs the series of actions to execute to the network operator.

Abstract: An automated assistant framework can include an orchestrator and assistants managed thereby. The framework enables orchestration of network management tool assistants included in multiple different network management tools. The orchestrator can comprise a trained ML module configured to interact with a user such as a network administrator. The orchestrator can receive a request from the user and can orchestrate a response to the request, wherein orchestrating the response includes formulating network assistant requests for one or more network management tool assistants, using the formulated network assistant requests to engage network management tool assistants, and combining the resulting outputs from the network management tool assistants.

Abstract: Techniques for providing a language model to understand and recommend product configuration changes, corresponding to specific requirements are described. A language model is deployed to a network controller and is configured to respond to inputs from network administrators. The language model receives an input from the network administrator indicating a description of a requirement for a configuration change. The language model determines a series of actions to execute to implement the configuration change. Finally, the language model outputs the series of actions to execute to the network administrator.

Abstract: A method includes: accessing a corpus of messages previously sent from a user account; correlating sequences of words, in the corpus of messages, with behavior signals; aggregating the behavior signals into a behavioral model representing combinations of behavior signals characteristic of behavior in messages sent from the user account; later, accessing a message outbound from the user account to a recipient account, the message including a document associated with a document tag; correlating sequences of words, in the message, with behavior signals; retrieving a data access policy including a threshold at which access to a document associated with the document tag is restricted; and in response to detecting a difference between the behavioral signals from the message and the behavioral model exceeding the threshold, restricting access, by the recipient account, to the document in the message.

Abstract: A method includes: accessing a corpus of messages previously sent from a user account; correlating sequences of words, in the corpus of messages, with behavior signals; aggregating the behavior signals into a behavioral model representing combinations of behavior signals characteristic of behavior in messages sent from the user account; later, accessing a message outbound from the user account to a recipient account, the message including a document associated with a document tag; correlating sequences of words, in the message, with behavior signals; retrieving a data access policy including a threshold at which access to a document associated with the document tag is restricted; and in response to detecting a difference between the behavioral signals from the message and the behavioral model exceeding the threshold, restricting access, by the recipient account, to the document in the message.

Abstract: A method includes: accessing a corpus of emails sent from a email account prior to the initial time period; correlating sequences of words, in the corpus of emails, with language signals; aggregating the language signals into a sender model that represents combinations of language signals characteristic of language in emails sent from the email account; later, accessing a email outbound from the email account and directed to a recipient; scanning the email for the set of language signals; correlating sequences of words in the email with language signals; calculating a similarity score for the email based on the subset of language signals detected in the email and the sender model; and, in response to the similarity score falling below a threshold similarity, flagging the email as suspicious and redirecting the email away from the recipient.

Abstract: A method includes: receiving selection of a document; correlating sequences of words, in the document, with a set of language signals; generating a set of document tags representing the set of language signals; and retrieving a first data access policy: associated with a particular document tag in the set of document tags; and including a set of identities permitted to access a document associated with the particular document tag; receiving selection of a recipient account of the document; and in response to detecting the set of identities excluding the recipient account, restricting access to the document by the recipient account.

Abstract: A computer-implemented method is described to monitor and control enterprise information stored on a cloud computing service (CCS). The method includes using a cross-application monitor to detect a cloud computing service (CCS) application programming interface (API) in use and a function or an activity being performed via the CCS API. The method also includes determining the function or the activity being performed via the CCS API by parsing a data stream based on the CCS API and identifying content being transmitted to the CCS. The method further includes applying a content inspection rule to find strings and interrelated strings in the content that are subject to content control and triggering a security action responsive to finding the strings and interrelated strings subject to content control in the parsed stream.

Abstract: A computer-implemented method is described to monitor and control enterprise information stored on a cloud computing service (CCS). The method includes using a cross-application monitor to detect a cloud computing service (CCS) application programming interface (API) in use and a function or an activity being performed via the CCS API. The method also includes determining the function or the activity being performed via the CCS API by parsing a data stream based on the CCS API and identifying content being transmitted to the CCS. The method further includes applying a content inspection rule to find strings and interrelated strings in the content that are subject to content control and triggering a security action responsive to finding the strings and interrelated strings subject to content control in the parsed stream.

Abstract: A method for detecting spoofed webpages includes: accessing an email; and scanning the email for links. The method also includes, in response to detecting a link in the email: accessing web content contained in a target webpage at the link; extracting target visual features from the web content; accessing a set of verified webpage templates, each verified webpage template in the set of verified webpage templates containing a set of verified features present in a verified webpage associated with a verified resource locator; identifying a particular verified webpage template, in the set of verified webpage templates, containing a particular set of verified features approximating the target visual features; characterizing a difference between the link and a particular verified resource locator associated with the particular verified webpage template; and, in response to the difference exceeding a threshold difference, flagging the email as malicious.

Abstract: A method includes: accessing a corpus of emails sent from a email account prior to the initial time period; correlating sequences of words, in the corpus of emails, with language signals; aggregating the language signals into a sender model that represents combinations of language signals characteristic of language in emails sent from the email account; later, accessing a email outbound from the email account and directed to a recipient; scanning the email for the set of language signals; correlating sequences of words in the email with language signals; calculating a similarity score for the email based on the subset of language signals detected in the email and the sender model; and, in response to the similarity score falling below a threshold similarity, flagging the email as suspicious and redirecting the email away from the recipient.

Abstract: A method includes: receiving selection of a document; correlating sequences of words, in the document, with a set of language signals; generating a set of document tags representing the set of language signals; and retrieving a first data access policy: associated with a particular document tag in the set of document tags; and including a set of identities permitted to access a document associated with the particular document tag; receiving selection of a recipient account of the document; and in response to detecting the set of identities excluding the recipient account, restricting access to the document by the recipient account.

Abstract: A method includes: accessing a corpus of messages previously sent from a user account; correlating sequences of words, in the corpus of messages, with behavior signals; aggregating the behavior signals into a behavioral model representing combinations of behavior signals characteristic of behavior in messages sent from the user account; later, accessing a message outbound from the user account to a recipient account, the message including a document associated with a document tag; correlating sequences of words, in the message, with behavior signals; retrieving a data access policy including a threshold at which access to a document associated with the document tag is restricted; and in response to detecting a difference between the behavioral signals from the message and the behavioral model exceeding the threshold, restricting access, by the recipient account, to the document in the message.

Abstract: A method includes: accessing a corpus of messages previously sent from a user account; correlating sequences of words, in the corpus of messages, with behavior signals; aggregating the behavior signals into a behavioral model representing combinations of behavior signals characteristic of behavior in messages sent from the user account; later, accessing a message outbound from the user account to a recipient account, the message including a document associated with a document tag; correlating sequences of words, in the message, with behavior signals; retrieving a data access policy including a threshold at which access to a document associated with the document tag is restricted; and in response to detecting a difference between the behavioral signals from the message and the behavioral model exceeding the threshold, restricting access, by the recipient account, to the document in the message.

Abstract: A method includes: accessing a corpus of emails sent from a email account prior to the initial time period; correlating sequences of words, in the corpus of emails, with language signals; aggregating the language signals into a sender model that represents combinations of language signals characteristic of language in emails sent from the email account; later, accessing a email outbound from the email account and directed to a recipient; scanning the email for the set of language signals; correlating sequences of words in the email with language signals; calculating a similarity score for the email based on the subset of language signals detected in the email and the sender model; and, in response to the similarity score falling below a threshold similarity, flagging the email as suspicious and redirecting the email away from the recipient.

Abstract: A method includes: receiving selection of a document; correlating sequences of words, in the document, with a set of language signals; generating a set of document tags representing the set of language signals; and retrieving a first data access policy: associated with a particular document tag in the set of document tags; and including a set of identities permitted to access a document associated with the particular document tag; receiving selection of a recipient account of the document; and in response to detecting the set of identities excluding the recipient account, restricting access to the document by the recipient account.

Abstract: A method for detecting spoofed webpages includes: accessing an email; and scanning the email for links. The method also includes, in response to detecting a link in the email: accessing web content contained in a target webpage at the link; extracting target visual features from the web content; accessing a set of verified webpage templates, each verified webpage template in the set of verified webpage templates containing a set of verified features present in a verified webpage associated with a verified resource locator; identifying a particular verified webpage template, in the set of verified webpage templates, containing a particular set of verified features approximating the target visual features; characterizing a difference between the link and a particular verified resource locator associated with the particular verified webpage template; and, in response to the difference exceeding a threshold difference, flagging the email as malicious.

Abstract: A method for detecting spoofed webpages includes: accessing an email; and scanning the email for links. The method also includes, in response to detecting a link in the email: accessing web content contained in a target webpage at the link; extracting target visual features from the web content; accessing a set of verified webpage templates, each verified webpage template in the set of verified webpage templates containing a set of verified features present in a verified webpage associated with a verified resource locator; identifying a particular verified webpage template, in the set of verified webpage templates, containing a particular set of verified features approximating the target visual features; characterizing a difference between the link and a particular verified resource locator associated with the particular verified webpage template; and, in response to the difference exceeding a threshold difference, flagging the email as malicious.

Abstract: A method includes: receiving selection of a document; correlating sequences of words, in the document, with a set of language signals; generating a set of document tags representing the set of language signals; and retrieving a first data access policy: associated with a particular document tag in the set of document tags; and including a set of identities permitted to access a document associated with the particular document tag; receiving selection of a recipient account of the document; and in response to detecting the set of identities excluding the recipient account, restricting access to the document by the recipient account.