# US 12,519,840 B1 · Directive migration with ephemeral triggers > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,519,840 B1 - Document ID: US12519840B1 - Status: Granted - Kind: B1 - Application number: 19/097,466 - Filed: 2025-04-01 - Granted: 2026-01-06 - Earliest claimed: 2024-10-24 - Assignees: Hackseal Corporation - Applicants: Hackseal Corporation - Inventors: David D. Abotchie - Web page: https://patentgrep.com/patent/US12519840B1 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/108: {when the policy decisions are valid for a limited amount of time} - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04L 2463/082: applying multi-factor authentication - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A directive management system may receive a source directive from a source cloud-native application protection platform (CNAPP). The source directive defines an ephemeral condition in applying the source directive. The system may create a common intermediate representation (CIR) that includes the ephemeral condition normalized as a parameter in the CIR. The system may translate the CIR into a default machine-executable directive that is executable by a target CNAPP. The system may receive an event trigger that matches the ephemeral condition stored in the CIR. The system may create, responsive to receiving the event trigger that matches the ephemeral condition, an ephemeral machine-executable directive from the CIR. The ephemeral machine-executable directive is used to supersede the default machine-executable directive at least temporarily. The system may transmit the ephemeral machine-executable directive to the target CNAPP. ## Claims ### Claim 1 A computer-implemented method comprising: receiving a source directive from a source cloud-native application protection platform (CNAPP), the source directive defining an ephemeral condition in applying the source directive; creating a common intermediate representation (CIR) that includes the ephemeral condition normalized as a parameter in the CIR; translating the CIR into a default machine-executable directive that is executable by a target CNAPP, wherein the default machine-executable directive is executable by the target CNAPP to enforce a default directive that controls one or more cloud resources of a domain; receiving an event trigger that matches the ephemeral condition stored in the CIR; creating, responsive to receiving the event trigger that matches the ephemeral condition, an ephemeral machine-executable directive from the CIR, wherein the ephemeral machine-executable directive is used to supersede the default machine-executable directive at least temporarily; and transmitting the ephemeral machine-executable directive to the target CNAPP as a response to the event trigger, wherein the ephemeral machine-executable directive is executable by the target CNAPP to enforce an ephemeral replacement directive that at least temporarily replaces the default directive to control the one or more cloud resources of the domain. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein creating the CIR comprises: parsing the source directive to extract the ephemeral condition; mapping the ephemeral condition to a platform-agnostic schema; and converting the source directive into a normalized form according to the platform-agnostic schema. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein translating the CIR into the default machine-executable directive comprises: analyzing platform-agnostic conditions and actions stored in the CIR; mapping the platform-agnostic conditions and actions to target-specific syntax; and generating error-handling scripts to address translation conflicts. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, further comprising validating the default machine-executable directive, wherein validating the default machine-executable directive comprises: validating the default machine-executable directive against simulated operational scenarios within the target CNAPP; and monitoring execution outcomes to detect any deviations from expected compliance. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein creating the ephemeral machine-executable directive comprises: retrieving stored CIR parameters associated with the event trigger; generating platform-specific configurations to address the ephemeral condition; and assigning a priority tag to signify that the ephemeral directive temporarily supersedes the default directive. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein creating the ephemeral machine-executable directive comprises: interpreting free-text policy descriptions using natural language processing to determine contextual conditions in the free-text policy descriptions; and generating the machine-executable directive based on the contextual conditions. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, wherein the CIR comprises contextual data to dynamically adjust directive parameters for compatibility with operational needs. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, wherein the ephemeral machine-executable directive corresponds to a governance directive, the governance directive comprising: a rule governing a usage of the one or more cloud resources on devices based on user role, time, or peripheral device presence. ### Claim 9 (depends on 1) The computer-implemented method of claim 1, wherein the ephemeral machine-executable directive enforces a governance constraint by executing an ephemeral rule that denies a usage of the one or more cloud resources based on a user role in a specified range of operational hours. ### Claim 10 (depends on 1) The computer-implemented method of claim 1, wherein the ephemeral machine-executable directive enforces a provisioning policy that triggers an auto-enrollment script to enroll devices into the domain based on the ephemeral condition. ### Claim 11 (depends on 1) The computer-implemented method of claim 1, wherein the ephemeral machine-executable directive enforces a cybersecurity measure that comprises: detecting suspicious activity on a target device; and applying, based on the ephemeral condition, ephemeral blocks on a usage of the one or more cloud resources based on the suspicious activity. ### Claim 12 (depends on 1) The computer-implemented method of claim 1, wherein transmitting the ephemeral machine-executable directive to the target CNAPP comprises triggering a third-party Endpoint Detection and Response (EDR) tool to implement the ephemeral machine-executable directive. ### Claim 13 (depends on 1) The computer-implemented method of claim 1, wherein transmitting the ephemeral machine-executable directive to the target CNAPP comprises triggering the ephemeral machine-executable directive via one or more of the following: an endpoint detection and response (EDR) tool; an API-based trigger; custom hooking scripts or middleware designed to implement the ephemeral machine-executable directive on a target system that does not natively support ephemeral toggles; or an integration with a third party system that is a Security Information and Event Management (SIEM) or a Security Orchestration, Automation, and Response (SOAR) solutions, a firewall controller, a resource orchestration tool. ### Claim 14 (depends on 1) The computer-implemented method of claim 1, wherein creating the ephemeral machine-executable directive comprises: determining that the target CNAPP lacks native support for ephemeral toggles; and generating, responsive to the target CNAPP lacks native support for ephemeral toggles, custom hooking scripts as part of the ephemeral machine-executable directive. ### Claim 15 (depends on 1) The computer-implemented method of claim 1, wherein the ephemeral machine-executable directive temporarily supersedes default machine-executable directive by enforcing adaptive constraints during operational anomalies. ### Claim 16 (depends on 1) The computer-implemented method of claim 1, further comprising: integrating a platform capability database that stores platform-specific settings; and querying the platform capability database during translating the CIR into the default machine-executable directive to map the ephemeral condition into the default machine-executable directive. ### Claim 17 (depends on 1) The computer-implemented method of claim 1, further comprising: detecting a new cloud resource of the domain; and automatically applying the ephemeral machine-executable directive to the new cloud resource. ### Claim 18 (depends on 1) The computer-implemented method of claim 1, further comprising: transmitting the ephemeral machine-executable directive to the target CNAPP for an administrator of the domain as a human-in-the-loop for a review the ephemeral machine-executable directive prior to enforcement. ### Claim 19 (depends on 1) The computer-implemented method of claim 1, further comprising: causing to display, at a graphical user interface, analytics related to an enforcement of the ephemeral replacement directive. ### Claim 20 (depends on 1) The computer-implemented method of claim 1, further comprising: determining that the ephemeral machine-executable directive is in conflict with another directive implemented in the target CNAPP; and resolving conflicts between the ephemeral machine-executable directive and the other directive. ### Claim 21 (depends on 1) The computer-implemented method of claim 1, further comprising: applying a machine learning model to analyze historical directive enforcement outcomes; and creating the ephemeral machine-executable directive at least based on an output of the machine learning model. ### Claim 22 (depends on 1) The computer-implemented method of claim 1, further comprising: receiving external threat intelligence data from an external source; and adjusting one or more parameters of the ephemeral machine-executable directive based on the external threat intelligence data. ### Claim 23 (depends on 1) The computer-implemented method of claim 1, where receiving the event trigger that matches the ephemeral condition stored in the CIR comprises: analyzing time-series data representing directive enforcement events; and determining the event trigger is met responsive to a frequency of an event type in the time-series data reaching a threshold. ### Claim 24 (depends on 1) The computer-implemented method of claim 1, further comprising: receiving a type of cloud resources in the domain; and tailoring the ephemeral machine-executable directive based on the type of cloud resources. ### Claim 25 A directive management system, comprising: one or more processors; and memory configured to store computer code comprising instructions, wherein the instructions, when executed by the one or more processors, cause the one or more processors to: receive a source directive from a source cloud-native application protection platform (CNAPP), the source directive defining an ephemeral condition in applying the source directive; create a common intermediate representation (CIR) that includes the ephemeral condition normalized as a parameter in the CIR; translate the CIR into a default machine-executable directive that is executable by a target CNAPP, wherein the default machine-executable directive is executable by the target CNAPP to enforce a default directive that controls one or more cloud resources of a domain; receive an event trigger that matches the ephemeral condition stored in the CIR; create, responsive to receiving the event trigger that matches the ephemeral condition, an ephemeral machine-executable directive from the CIR, wherein the ephemeral machine-executable directive is used to supersede the default machine-executable directive at least temporarily; and transmit the ephemeral machine-executable directive to the target CNAPP as a response to the event trigger, wherein the ephemeral machine-executable directive is executable by the target CNAPP to enforce an ephemeral replacement directive that at least temporarily replaces the default directive to control the one or more cloud resources of the domain. ### Claim 26 (depends on 25) The directive management system of claim 25, wherein the instruction to create the CIR comprises instructions to: parse the source directive to extract the ephemeral condition; map the ephemeral condition to a platform-agnostic schema; and convert the source directive into a normalized form according to the platform-agnostic schema. ### Claim 27 (depends on 25) The directive management system of claim 25, wherein the instruction to translate the CIR into the default machine-executable directive comprises instructions to: analyze platform-agnostic conditions and actions stored in the CIR; map the platform-agnostic conditions and actions to target-specific syntax; and generate error-handling scripts to address translation conflicts. ### Claim 28 (depends on 25) The directive management system of claim 25, wherein the instructions, when executed, further cause the one or more processors to validate the default machine-executable directive, wherein the instruction to validate the default machine-executable directive comprises instructions to: validate the default machine-executable directive against simulated operational scenarios within the target CNAPP; and monitor execution outcomes to detect any deviations from expected compliance. ### Claim 29 (depends on 25) The directive management system of claim 25, wherein the CIR comprises contextual data to dynamically adjust directive parameters for compatibility with operational needs. ### Claim 30 A non-transitory computer-readable medium configured to store computer code comprising instructions, wherein the instructions, when executed by the one or more processors, cause the one or more processors to: receive a source directive from a source cloud-native application protection platform (CNAPP), the source directive defining an ephemeral condition in applying the source directive; create a common intermediate representation (CIR) that includes the ephemeral condition normalized as a parameter in the CIR; translate the CIR into a default machine-executable directive that is executable by a target CNAPP, wherein the default machine-executable directive is executable by the target CNAPP to enforce a default directive that controls one or more cloud resources of a domain; receive an event trigger that matches the ephemeral condition stored in the CIR; create, responsive to receiving the event trigger that matches the ephemeral condition, an ephemeral machine-executable directive from the CIR, wherein the ephemeral machine-executable directive is used to supersede the default machine-executable directive at least temporarily; and transmit the ephemeral machine-executable directive to the target CNAPP as a response to the event trigger, wherein the ephemeral machine-executable directive is executable by the target CNAPP to enforce an ephemeral replacement directive that at least temporarily replaces the default directive to control the one or more cloud resources of the domain.