Abstract: Guided interactions with a natural language interface, including: gathering data describing one or more user interactions with a system configured for monitoring a cloud deployment; generating, based on the data, a prompt comprising one or more natural language inputs for a workflow, wherein each of the one or more natural language inputs corresponds to a query for information related to the cloud deployment; and providing a selected natural language input to a natural language interface of the anomaly detection framework.

Abstract: A data collection system is disclosed to be communicatively coupled to a data platform configured to perform security monitoring of a compute environment. A sub-kernel component of the data collection system may collect sub-kernel data accessible from a sub-kernel space below an operating system of a compute resource in the compute environment. The data collection system may manipulate the collected sub-kernel data to prepare the sub-kernel data to be used by the data platform in performing the security monitoring of the compute environment. The data collection system may then communicate the manipulated sub-kernel data to the data platform. Corresponding methods, systems, and products for compute environment security monitoring using data collected from a sub-kernel space are also disclosed.

Abstract: Optimizing data warehouse utilization by a data ingestion pipeline, including: gathering information describing usage of a plurality of data warehouses; receiving, from a data ingestion pipeline, a request for a data warehouse to receive data from the data ingestion pipeline; selecting, based on the information, the data warehouse from the plurality of data warehouses; and providing, to the data ingestion pipeline, an indication of the data warehouse.

Abstract: Reducing amounts of data ingested into a data warehouse, including: determining a duration associated with a subject described by event data provided to a data ingestion pipeline; determining, based on the duration, an interval for providing next event data; and providing, based on the interval, the next event data.

Abstract: Using user feedback for attack path analysis in an anomaly detection framework, including: performing an attack path analysis for a cloud deployment; receiving, from a user, user feedback for an attack vector of the attack path analysis; and initiating, based on the user feedback, a workflow for modifying one or more parameters for generating the attack path analysis.

Abstract: Leveraging generative artificial intelligence (‘AI’) for securing a monitored deployment, including: receiving natural language input associated with the monitored deployment, the monitored deployment monitored by a monitoring tool; and receiving, from a generative AI application, a response to the natural language input, wherein: the generative AI application accesses publicly available information as well as data sources associated with the monitoring tool; and the response is generated based at least in part on information contained in the data sources associated with the monitoring tool.

Abstract: Learning from other cloud deployments to combat security threats, including: identifying, for at least a portion of a first cloud deployment, one or more additional cloud deployments to utilize for cross-customer learning; receiving information describing a security threat to one or more of the additional cloud deployments; receiving information describing configuration settings used to combat the security threat; and identifying, based on the information describing configuration settings used to combat the security threat, one or more configurations to adopt for the first cloud deployment.

Abstract: An example method includes accessing, by a data platform via a network, data from one or more cloud environments; identifying, by the data platform and in the data, first data associated with a first entity and a first data type and second data associated with a second entity and a second data type; mapping, by the data platform and based on the first entity and the first data type, the first data to a first data stream of a data streaming platform; mapping, by the data platform and based on the second entity and the second data type, the second data to a second data stream of the data streaming platform, the second data stream different from the first data stream of the data streaming platform; and generating, based on the first data stream, a graph representing activity associated with the first entity in the one or more cloud environments.

Abstract: Identifying encountered and unencountered conditions in software applications, including: collecting, for an executing application, information describing the usage of the application, including: receiving, from one or more tracepoints inserted into the application, a first portion of the information describing a state of the application during execution; identifying, based on the information, one or more unencountered conditions that the application is configured to handle; and presenting information describing the unencountered conditions that the application is configured to handle.

Abstract: Integrating a natural language interface into an anomaly detection framework, including: detecting, by an anomaly detection framework, an occurrence of an event associated with one or more assets that are being monitored by an anomaly detection framework; generating, based on information associated with the detected event, one or more natural language inputs; and submitting, to a natural language interface, the one or more natural language inputs.

Abstract: A natural language interface for an anomaly detection framework, including: receiving a natural language input associated with a cloud deployment; generating a query corresponding to the natural language input by disambiguating at least a portion of the natural language input based on data describing activity associated with an anomaly detection framework monitoring the cloud deployment; and providing, based on a response to the query, a response to the natural language input.

Abstract: Configuring cloud deployments based on learnings obtained by monitoring other cloud deployments, including: determining normal behavior for one or more components in a first cloud deployment; determining normal behavior for one or more components in one or more other cloud deployments; and recommending, based on the normal behavior for one or more components in one or more other cloud deployments, a change to the first cloud deployment.

Abstract: Providing a data lake-enabled security platform, including: storing security data associated with a customer in a data lake comprising a plurality of storage environments implemented in different cloud environments of a plurality of cloud environments; generating, based on a plurality of records in the security data, an abstracted security record describing one or more derived insights of the security data; and providing access to the abstracted security record to one or more users associated with the customer.

Abstract: Learning from similar cloud deployments, including: identifying, for at least a portion of a first cloud deployment, one or more additional cloud deployments to utilize for cross-customer learning; receiving information describing configurations associated with the additional cloud deployments; and identifying, based on the configurations, one or more configurations to adopt for the first cloud deployment.

Abstract: A guided anomaly detection framework, including: gathering data describing activity associated with an anomaly detection framework monitoring a cloud deployment; generating, based on the data, a prompt describing one or more natural language inputs for a security workflow, wherein each of the one or more natural language inputs corresponds to a query for information related to the cloud deployment; and providing a selected natural language input to a natural language interface.

Abstract: Improving developer efficiency and application quality, including: collecting, for an executing application, information describing the usage of the application; identifying one or more unencountered conditions that the application is configured to handle; identifying one or more encountered conditions that the application is not configured to handle; and presenting information describing the unencountered conditions that the application is configured to handle and the encountered conditions that the application is not configured to handle.

Abstract: An illustrative method for monitoring a cloud environment may include identifying, by at least one computing device and based on a scan of a cloud environment, a vulnerable software component in the cloud environment, determining, by the at least one computing device, an operational status for the vulnerable software component in the cloud environment, and generating, by the at least one computing device and based on the operational status for the vulnerable software component, an alert for the vulnerable software component.

Abstract: Monitoring a software development pipeline, including: retrieving, from one or more components in the software development pipeline, information associated with a software application; identifying, based on the information associated with the software application, an anomaly associated with the software application; and performing one or more remedial actions based on the anomaly.

Abstract: Annotating changes in software across computing environments, including: monitoring a software development and deployment pipeline; annotating a detected change in software with evidence providing information about one or more aspects of the detected change in software; and referring to the annotations for an unexpected change upon detecting the unexpected change in an environment that is outside of the software development and deployment pipeline.

Abstract: Ingesting event data into a data warehouse, including: receiving first event data comprising a plurality of first records each describing an event of a plurality of events occurring within a computing environment, wherein the event data is encoded in a first storage format; generating, based on the first event data, second event data comprising plurality of second records encoded in a second storage format for storage in a data warehouse; and sending a plurality of files comprising the second event data to the data warehouse.