US 12,592,942 B2 · Session analysis for identity threat detection and identity security posture management

Abstract

Techniques are presented for detecting and remediating security events. One method includes ingesting signals and telemetry from various tools like Software as a Service (SaaS), Endpoint Detection and Response (EDR), Mobile Device Management (MDM), and Secure Access Service Edge (SASE). Live session graphs are created for users, mapping all application token sessions. The system collects data from multiple sources to construct detailed graphs that represent user sessions, application usage, device employment, and third-party application tokens. This helps identify both legitimate and suspicious sessions, reducing false positives and enhancing effectiveness. Session graphs are analyzed to detect security threats, identify suspicious activities, and determine appropriate responses. Further, remediation tools are provided to address security events manually or automatically through established policies. The policy engine of the system distributes policies across diverse applications, enforcing them on various platforms like SaaS, identity management, and EDR applications, ensuring a comprehensive control point for security measures.

Claims20

Dependent claims

A computer-implemented method comprising:

receiving telemetry data from a plurality of entities;
generating a live session graph based on the telemetry data, the live session graph comprising nodes and edges, wherein the nodes represent a user identity, applications that the user identity accesses, and endpoints that the user identity uses to access the applications, wherein the edges between the nodes represent active sessions that the user identity is engaged in with the applications through the endpoints;
analyzing the live session graph to determine a posture of a first user with respect to applications accessed and open sessions associated with the first user;
identifying a security event based on the analysis of the live session graph;
and
enforcing a remediation policy for the identified security event.

3 more elements

A system comprising:

a memory comprising instructions;
and
one or more computer processors, the instructions, when executed by the one or more computer processors, causing the system to perform operations comprising:
receiving telemetry data from a plurality of entities;
generating a live session graph based on the telemetry data, the live session graph comprising nodes and edges, wherein the nodes represent a user identity, applications that the user identity accesses, and endpoints that the user identity uses to access the applications, wherein the edges between the nodes represent active sessions that the user identity is engaged in with the applications through the endpoints;
analyzing the live session graph to determine a posture of a first user with respect to applications accessed and open sessions associated with the first user;
identifying a security event based on the analysis of the live session graph;
and
enforcing a remediation policy for the identified security event.

6 more elements

Dependencies are inferred from the claim text.

Session analysis for identity threat detection and identity security posture management

Life of this patent

Session analysis for identity threat detection and identity security posture management

Life of this patent

Abstract

Claims20