System and method for deploying software applications over a unified data set

1 . A method for generating an application layer for a representation graph, in a computing system including processing circuitry communicatively coupled with a graph database, the method comprising:

defining a data entity in a representation graph, the data entity including a plurality of data fields;

generating a node based on the data entity in the representation graph, the node representing a unique entity;

receiving data respective of the unique entity from a plurality of data sources, such that a first data source of the plurality of data sources provides data to a first data field of the plurality of data fields, and a second data source of the plurality of data sources provides data to a second data field of the plurality of data fields, wherein receiving the data comprises, by a mapper, populating the plurality of data fields based on a mapping table that maps source-specific data fields of the plurality of data sources to the plurality of data fields, dynamically adding a data field upon detecting an unmapped source-specific data field, and aggregating the populated data fields from the plurality of data sources into a single node that stores metadata identifying a source of each populated data field;

applying a control to the node based on the received data including at least one conditional rule stored in a rule engine coupled to the graph database, including traversing the representation graph to evaluate the at least one conditional rule; and

initiating an action, in response to the evaluation of the at least one conditional rule, based on applying the control to the received data, the action comprising one or more of generating an alert, updating a cybersecurity event log, or initiating a cybersecurity scan.

2 . The method of claim 1 , further comprising:

periodically accessing the first data resource to receive data respective of the unique entity.

3 . The method of claim 1 , further comprising:

applying the control including a service level agreement (SLA) policy on the node based on the received data.

4 . The method of claim 1 , further comprising:

initiating an action at the second data source, based on data received from the first data source.

5 . The method of claim 4 , wherein the first data source is a first cybersecurity monitoring solution, and the second data source is a second cybersecurity monitoring solution.

6 . The method of claim 1 , wherein the action includes: generating an alert, generating an event in an event log, generating a ticket, generating a ticket group, initiating a scan of a cybersecurity object, generating a report, and any combination thereof.

7 . The method of claim 1 , further comprising:

configuring an application programming interface (API) to extract data from the node in response to receiving a request for data.

8 . The method of claim 7 , further comprising:

extracting data from the node in response to further detecting that the request is an authorized request.

9 . The method of claim 1 , further comprising:

traversing an organization chart to detect a user account, the organization account including a plurality of unique user accounts, each user account associated with a role;

assigning a unique node of the representation graph to a user account, in response to detecting a data value of the user account which matches a data value of the unique node.

10 . A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry in communication with a graph database to execute a process, the process comprising:

defining a data entity in a representation graph, the data entity including a plurality of data fields;

generating a node based on the data entity in the representation graph, the node representing a unique entity;

receiving data respective of the unique entity from a plurality of data sources, such that a first data source of the plurality of data sources provides data to a first data field of the plurality of data fields, and a second data source of the plurality of data sources provides data to a second data field of the plurality of data fields wherein receiving the data comprises, by a mapper, populating the plurality of data fields based on a mapping table that maps source-specific data fields of the plurality of data sources to the plurality of data fields, dynamically adding a data field upon detecting an unmapped source-specific data field, and aggregating the populated data fields from the plurality of data sources into a single node that stores metadata identifying a source of each populated data field;

applying a control including at least one conditional rule stored in a rule engine to the node based on the received data, including traversing the representation graph to evaluate the at least one conditional rule; and

initiating an action, in response to the evaluation of the at least one conditional tule, based on applying the control to the received data, wherein the action comprises generating or updating cybersecurity event data.

11 . A system for generating an application layer for a representation graph, comprising:

a processing circuitry; and

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

define a data entity in a representation graph, the data entity including a plurality of data fields;

generate a node based on the data entity in the representation graph, the node representing a unique entity;

receive data respective of the unique entity from a plurality of data sources, such that a first data source of the plurality of data sources provides data to a first data field of the plurality of data fields, and a second data source of the plurality of data sources provides data to a second data field of the plurality of data fields, wherein receiving the data comprises, by a mapper populating the plurality of data fields based on a mapping table that maps source-specific data fields of the plurality of data sources to the plurality of data fields, dynamically adding a data field upon detecting an unmapped source-specific data field, and aggregating the populated data fields from the plurality of data sources into a single node that stores metadata identifying a source of each populated data field;

apply a control including at least one conditional rule stored in a rule engine coupled to the graph database to the node based on the received data, including traversing the representation graph to evaluate the at least one conditional rule; and

initiate an action, in response to the evaluation of the at least one conditional rule, based on applying the control to the received data, wherein the action comprises generating or updating cybersecurity event data.

12 . The system of claim 11 , wherein the memory includes further instructions which when executed by the processing circuitry further configure the system to:

periodically access the first data resource to receive data respective of the unique entity.

13 . The system of claim 11 , wherein the memory includes further instructions which when executed by the processing circuitry further configure the system to:

apply the control including a service level agreement (SLA) policy on the node based on the received data.

14 . The system of claim 11 , wherein the memory includes further instructions which when executed by the processing circuitry further configure the system to:

initiate an action at the second data source, based on data received from the first data source.

15 . The system of claim 14 , wherein the first data source is a first cybersecurity monitoring solution, and the second data source is a second cybersecurity monitoring solution.

16 . The system of claim 11 , wherein the memory includes further instructions which when executed by the processing circuitry further configure the system to initiate an action including: generating an alert, generating an event in an event log, generating a ticket, generating a ticket group, initiating a scan of a cybersecurity object, generating a report, and any combination thereof.

17 . The system of claim 11 , wherein the memory includes further instructions which when executed by the processing circuitry further configure the system to:

configure an application programming interface (API) to extract data from the node in response to receiving a request for data.

18 . The system of claim 17 , wherein the memory includes further instructions which when executed by the processing circuitry further configure the system to:

extract data from the node in response to further detecting that the request is an authorized request.

19 . The system of claim 11 , wherein the memory includes further instructions which when executed by the processing circuitry further configure the system to:

traverse an organization chart to detect a user account, the organization account including a plurality of unique user accounts, each user account associated with a role;

assign a unique node of the representation graph to a user account, in response to detecting a data value of the user account which matches a data value of the unique node.

20 . The system of claim 11 , wherein the processing circuitry further comprises a hardware accelerator comprising one of a field programmable gate array (FPGA), application-specific integrated circuits (ASIC), or graphics processing unit (GPUs) and a scratch-pad memory, the hardware accelerator configured to offload neighbor-expansion operations for traversal of the representation graph by performing parallel evaluation of adjacency lists for a plurality of nodes.