# US 12,182,172 B2 · System and method for agentless detection of sensitive data on managed databases > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,182,172 B2 - Document ID: US12182172B2 - Status: Granted - Kind: B2 - Application number: 18/049,096 - Filed: 2022-10-24 - Published: 2024-03-28 - Granted: 2024-12-31 - Earliest claimed: 2022-09-28 - Assignees: Wiz, Inc. - Applicants: Wiz, Inc. - Inventors: Raaz Herzberg; Avi Tal Lichtenstein; Roy Reznik; Ami Luttwak; Moran Cohen; Yaniv Shaked; Yinon Costica; George Pisha - Web page: https://patentgrep.com/patent/US12182172B2 ## CPC - G06F 16/285: {Clustering or classification} - G06F 16/9024: {Graphs; Linked lists (G06F16/9027 takes precedence)} - G06F 21/44: Program or device authentication - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system and method for agentless detection of sensitive data in a cloud computing environment includes generating a snapshot from a managed database service, the snapshot including a plurality of data files stored in a bucket on a cloud computing environment; detecting a data object in the plurality of data files, the data object including a data schema and a content; classifying the first data object based on the content, wherein the content is classified as sensitive data or non-sensitive data; and generating a node on a security graph stored in a graph database to represent the first data object and the classification thereof, wherein the security graph further includes a representation of the cloud computing environment. ## Claims ### Claim 1 A method for agentless detection of sensitive data in a cloud computing environment and rendering the same for display, comprising: accessing a managed database service; generating a snapshot from the managed database service of a cloud computing environment, the snapshot including a plurality of data files; detecting a first data object in the plurality of data files, the first data object including a data schema and a content; classifying the first data object based on the content, wherein the content is classified as sensitive data or non-sensitive data; generating a node on a security graph stored in a graph database to represent: the first data object and the classification thereof, and the data schema, wherein the security graph further includes a representation of the cloud computing environment; detecting a second data object in the plurality of data files, the second data object sharing the data schema of the first data object; generating in the security graph: a second data object node representing a second data object, and a data schema node representing the data schema; connecting the data schema node to: the second data object node and the generated node in response to detecting the shared data schema; receiving a query to detect a node representing a data object classified as sensitive data; and rendering an output based on the classification and the data schema node in response to receiving a query to detect a node representing a data object classified as sensitive data. ### Claim 2 (depends on 1) The method of claim 1, further comprising: detecting that a workload deployed in the cloud computing environment stores data in the managed database service. ### Claim 3 (depends on 1) The method of claim 1, further comprising: receiving access credentials for the managed database service, the access credentials providing access to the plurality of data files. ### Claim 4 (depends on 1) The method of claim 1, further comprising: inspecting only a portion of the plurality of data files for a data object. ### Claim 5 (depends on 1) The method of claim 1, further comprising: classifying the first data object further based on any one of: the data schema, the content, a metadata, and any combination thereof. ### Claim 6 (depends on 1) The method of claim 1, further comprising: extracting from the first data object a file header, and a plurality of data blocks. ### Claim 7 (depends on 1) The method of claim 1, further comprising: classifying sensitive data further as any one of: personal identifiable information (PII), personal health information (PHI), payment card industry (PCI), and any combination thereof. ### Claim 8 (depends on 1) The method of claim 1, further comprising: initiating a mitigation action in response to determining that the content is classified as sensitive data. ### Claim 9 (depends on 8) The method of claim 8, further comprising: initiating the mitigation action in response to determining that the content is classified as sensitive data deployed on a data object in a cloud computing environment which is unauthorized for storing sensitive data. ### Claim 10 (depends on 8) The method of claim 8, wherein the mitigation action further comprises: configuring a storage service to delete the first data object; and deleting the first data object. ### Claim 11 A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising: accessing a managed database service; generating a snapshot from the managed database service of a cloud computing environment, the snapshot including a plurality of data files; detecting a first data object in the plurality of data files, the first data object including a data schema and a content; classifying the first data object based on the content, wherein the content is classified as sensitive data or non-sensitive data; generating a node on a security graph stored in a graph database to represent the first data object and the classification thereof, wherein the security graph further includes a representation of the cloud computing environment; detect a second data object in the plurality of data files, the second data object sharing the data schema of the first data object; generate in the security graph: a second data object node representing a second data object, and a data schema node representing the data schema; connecting the data schema node: the second data object node and the generated node in response to detecting the shared data schema; receiving a query to detect a node representing a data object classified as sensitive data; and render an output based on the classification and the data schema node in response to receiving a query to detect a node representing a data object classified as sensitive data. ### Claim 12 A system for agentless detection of sensitive data in a cloud computing environment and rendering the same for display, comprising: a processing circuitry; and a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to: access a managed database service; generate a snapshot from the managed database service of a cloud computing environment, the snapshot including a plurality of data files; detect a first data object in the plurality of data files, the first data object including a data schema and a content; classify the first data object based on the content, wherein the content is classified as sensitive data or non-sensitive data; generate a node on a security graph stored in a graph database to represent the first data object and the classification thereof, wherein the security graph further includes a representation of the cloud computing environment; detect a second data object in the plurality of data files, the second data object sharing the data schema of the first data object; generate in the security graph: a second data object node representing a second data object, and a data schema node representing the data schema; connecting the data schema node: the second data object node and the generated node in response to detecting the shared data schema; receiving a query to detect a node representing a data object classified as sensitive data; and render an output based on the classification and the data schema node in response to receiving a query to detect a node representing a data object classified as sensitive data. ### Claim 13 (depends on 12) The system of claim 12, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: detect that a workload deployed in the cloud computing environment stores data in the managed database service. ### Claim 14 (depends on 12) The system of claim 12, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: receive access credentials for the managed database service, the access credentials providing access to the plurality of data files. ### Claim 15 (depends on 12) The system of claim 12, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: inspect only a portion of the plurality of data files for a data object. ### Claim 16 (depends on 12) The system of claim 12, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: classify the first data object further based on any one of: the data schema, the content, a metadata, and any combination thereof. ### Claim 17 (depends on 12) The system of claim 12, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: extract from the first data object a file header, and a plurality of data blocks. ### Claim 18 (depends on 12) The system of claim 12, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: classify sensitive data further as any one of: personal identifiable information (PII), personal health information (PHI), payment card industry (PCI), and any combination thereof. ### Claim 19 (depends on 12) The system of claim 12, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: initiate a mitigation action in response to determining that the content is classified as sensitive data. ### Claim 20 (depends on 19) The system of claim 19, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: initiate the mitigation action in response to determining that the content is classified as sensitive data deployed on a data object in a cloud computing environment which is unauthorized for storing sensitive data. ### Claim 21 (depends on 19) The system of claim 19, wherein the memory contains further instructions which when executed by the processing circuitry to initiate the mitigation action further configure the system to: configure a storage service to delete the first data object; and delete the first data object. ### Claim 22 (depends on 12) The system of claim 12, wherein the plurality of data files is stored in a bucket on a cloud computing environment.