System for automatically discovering, enriching and remediating entities interacting in a computer network

1 . A method for managing a computer environment, the method comprising:

collecting, from a plurality of different data sources, event data for the computer environment;

detecting entities in the computer environment and inferring relationships between the detected entities based on the collected event data;

generating an entity relationship graph by representing the detected entities as nodes and representing the inferred relationships between the detected entities as edges between the nodes; and

managing the computer environment based on the entity relationship graph, the managing comprising:

categorizing the detected entities based on the nodes, properties of the nodes, and relationships between the nodes as indicated in the entity relationship graph using a rules engine configured to execute categorization determination logic and/or a machine learning model trained based on information associated with the entities in the computer environment;

detecting abnormal behavior of one or more entities of the detected entities categorized in a particular category;

performing one or more security actions in response to detecting the abnormal behavior of the one or more entities of the detected entities categorized in the particular category, wherein performing the one or more security actions comprises:

invoking a vulnerability scan to determine known software vulnerabilities that the one or more entities are susceptible to; and/or

invoking a port scan to identify one or more Internet Protocol (IP) ports on which the one or more entities are listening;

rendering a graphical user interface (GUI) on a display of a user device, the graphical user interface comprising a graph generator that generates a query targeting the inferred relationships for a selected entity selected based on input from a user via an input mechanism of the user device, transmits the query for execution against the entity relationship graph, and displays results of the query, the results including graph segments representing entities with which the selected entity has inferred relationships; and

generating, by the graph generator, requested entity type information based on the input from the user, the requested entity type information indicating a selection, via one or more selectable GUI elements representing different edge and node types, of which types of nodes of the entity relationship graph should be targeted for the purpose of the query, wherein the results only indicate entities represented by nodes of the types selected via the one or more selectable GUI elements, and the graph generator displays the results by graphically depicting dependency relationships between the selected entity and entities omitted from the results via the requested entity type information as edges traversing through a hidden node that does not have an entity type that was selected via the one or more selectable GUI elements.

2 . The method of claim 1 , further comprising:

assigning at least one edge in the entity relationship graph a start timestamp attribute indicating when the at least one edge was created and an end timestamp attribute indicating a time until when the at least one edge is valid, wherein:

the end timestamp attribute is determined based on the start timestamp attribute and a validity duration, and

assigning the at least one edge in the entity relationship graph the start timestamp attribute and the end timestamp attribute is based on detection of an event indicating network activity that implies a dependency between at least two of the detected entities and criteria for defining the validity duration based on one or more characteristics of the event indicating network activity.

3 . The method of claim 1 , wherein:

detecting entities in the computer environment comprises detecting a presence in the computer environment of new entities that were previously unknown, changes to properties of entities that were previously identified as being present in the computer environment, and disappearances from the computer environment of entities that were previously identified as being present in the computer environment.

4 . The method of claim 1 , wherein managing the computer environment based on the entity relationship graph comprises receiving queries and time values associated with the queries and executing the queries against the entity relationship graph by omitting from results of the queries one or more of the edges for which validity durations indicate that one or more of the relationships were not valid at a point in time indicated by the associated time values.

5 . The method of claim 1 , further comprising storing snapshots of a current state of the entity relationship graph and then removing one or more of the edges that are expired by more than some configurable amount of time.

6 . The method of claim 1 , further comprising:

generating, by the graph generator, requested dependency type information based on the input from the user, the requested dependency type information indicating a selection, via one or more selectable GUI elements representing different edge and node types, of which types of edges of the entity relationship graph should be considered as representing dependencies for the purpose of the query, wherein the results only indicate dependencies represented by edges of the types selected via the one or more selectable GUI elements.

7 . A method for managing a computer environment, the method comprising:

detecting entities in the computer environment and inferring relationships between the detected entities based on event data;

generating an entity relationship graph by representing the detected entities in the computer environment as nodes and representing relationships between the entities as edges between the nodes representing the entities; and

managing the computer environment based on the entity relationship graph, the managing comprising:

categorizing the detected entities based on the nodes, properties of the nodes, and relationships between the nodes as indicated in the entity relationship graph using a rules engine configured to execute categorization determination logic and/or a machine learning model trained based on information associated with the entities in the computer environment, and recording the categorization of the detected entities;

detecting abnormal behavior of one or more entities of the detected entities categorized in a particular category;

performing one or more security actions in response to detecting the abnormal behavior of the one or more entities of the detected entities categorized in the particular category, wherein performing the one or more security actions comprises:

invoking a vulnerability scan to determine known software vulnerabilities that the one or more entities are susceptible to; and/or

invoking a port scan to identify one or more Internet Protocol (IP) ports on which the one or more entities are listening;

rendering a graphical user interface (GUI) on a display of a user device, the graphical user interface comprising a graph generator that generates a query targeting the inferred relationships for a selected entity selected based on input from a user via an input mechanism of the user device, transmits the query for execution against the entity relationship graph, and displays results of the query, the results including graph segments representing entities with which the selected entity has inferred relationships; and

generating, by the graph generator, requested entity type information based on the input from the user, the requested entity type information indicating a selection, via one or more selectable GUI elements representing different edge and node types, of which types of nodes of the entity relationship graph should be targeted for the purpose of the query, wherein the results only indicate entities represented by nodes of the types selected via the one or more selectable GUI elements, and the graph generator displays the results by graphically depicting dependency relationships between the selected entity and entities omitted from the results via the requested entity type information as edges traversing through a hidden node that does not have an entity type that was selected via the one or more selectable GUI elements.

8 . The method of claim 7 , wherein categorizing the detected entities comprises rendering the GUI comprising a categorization tool that generates, based on the input from the user via the input mechanism of the user device, configuration information for rules indicating a selection of which nodes representing the entities in the entity relationship graph should be assessed for a particular categorization analysis and logic for implementing the particular categorization analysis, and sends configuration information for the rules to a rules engine, which monitors the entity relationship graph for selected conditions and automatically invokes the particular categorization analysis according to the particular categorization analysis and logic in response to detecting the selected conditions.

9 . The method of claim 7 , wherein categorizing the detected entities comprises rendering the GUI comprising a categorization tool that generates, based on the input from the user via the input mechanism of the user device, configuration information for rules indicating a selection of which nodes representing the entities in the entity relationship graph should be assessed for a particular categorization analysis and which machine learning model(s) to be used to perform the particular categorization analysis, and sends the configuration information for the rules to a machine learning engine, which monitors the entity relationship graph for selected conditions and automatically invokes the particular categorization analysis using the machine learning model(s) in response to detected the selected conditions.

10 . A system for managing a computer environment, the system comprising:

a workstation system, including a processor coupled to memory, for executing one or more entity event collectors for collecting, from a plurality of different data sources, event data for the computer environment;

a server system, including a processor coupled to memory, for executing a database system, configured to:

detect entities in the computer environment and infer relationships between the detected entities based on the collected event data;

generate an entity relationship graph by representing the detected entities as nodes and representing the inferred relationships between the detected entities as edges between the nodes; and

manage the computer environment based on the entity relationship graph, wherein managing the computer environment comprises:

categorizing the detected entities based on the nodes, properties of the nodes, and relationships between the nodes as indicated in the entity relationship graph using a rules engine configured to execute categorization determination logic and/or a machine learning model trained based on information associated with the entities in the computer environment;

detecting abnormal behavior of one or more entities of the detected entities categorized in a particular category; and

performing one or more security actions in response to detecting the abnormal behavior of the one or more entities of the detected entities categorized in the particular category, wherein performing the one or more security actions comprises:

invoking a vulnerability scan to determine known software vulnerabilities that the one or more entities are susceptible to; and/or

invoking a port scan to identify one or more Internet Protocol (IP) ports on which the one or more entities are listening; and

a user device comprising a display, wherein the user device executes a graph query and display app for rendering a graphical user interface (GUI) on the display, wherein the graph query and display app comprises a graph generator configured to:

generate a query targeting the inferred relationships for a selected entity selected based on input from a user via an input mechanism of the user device, transmits the query for execution against the entity relationship graph, and displays results of the query, the results including graph segments representing entities with which the selected entity has inferred relationships; and

generate requested entity type information based on the input from the user, the requested entity type information indicating a selection, via one or more selectable GUI elements representing different edge and node types, of which types of nodes of the entity relationship graph should be targeted for the purpose of the query, wherein the results only indicate entities represented by nodes of the types selected via the one or more selectable GUI elements, and the graph generator displays the results by graphically depicting dependency relationships between the selected entity and entities omitted from the results via the requested entity type information as edges traversing through a hidden node that does not have an entity type that was selected via the one or more selectable GUI elements.

11 . The system of claim 10 , wherein the inferred relationships include direct relationships and data flow relationships.

12 . The system of claim 10 , wherein:

detecting entities in the computer environment comprises detecting a presence in the computer environment of new entities that were previously unknown, changes to properties of entities that were previously identified as being present in the computer environment, and disappearances from the computer environment of entities that were previously identified as being present in the computer environment.

13 . The system of claim 12 , wherein the database system is configured to receive queries and time values associated with the queries and execute the queries against the entity relationship graph by omitting from results of the queries one or more of the edges for which validity durations indicate that one or more of the relationships were not valid at a point in time indicated by the associated time values.

14 . The system of claim 12 , wherein the database system is configured to store snapshots of a current state of the entity relationship graph and then remove one or more of the edges that are expired by more than some configurable amount of time.

15 . A system for managing a computer environment, the system comprising:

a server system, including a processor coupled to memory, for executing a database system, and configured to detect entities in the computer environment and infer relationships between the detected entities based on event data, wherein the database system is configured to:

generate an entity relationship graph by representing entities in the computer environment as nodes and representing relationships between the entities as edges between the nodes representing the entities; and

the server system is configured to manage the computer environment based on the entity relationship graph, wherein managing the computer environment comprises:

categorizing the entities based on the nodes, properties of the nodes, and relationships between the nodes as indicated in the entity relationship graph using a rules engine configured to execute categorization determination logic and/or a machine learning model trained based on information associated with the entities in the computer environment;

detecting abnormal behavior of one or more entities of the detected entities categorized in a particular category; and

performing one or more security actions in response to detecting the abnormal behavior of the one or more entities of the detected entities categorized in the particular category, wherein performing the one or more security actions comprises:

invoking a vulnerability scan to determine known software vulnerabilities that the one or more entities are susceptible to; and/or

invoking a port scan to identify one or more Internet Protocol (IP) ports on which the one or more entities are listening; and

a user device comprising a display, wherein the user device executes a graph query and display app for rendering a graphical user interface (GUI) on the display, wherein the graph query and display app comprises a graph generator configured to:

generate a query targeting the inferred relationships for a selected entity selected based on input from a user via an input mechanism of the user device, transmits the query for execution against the entity relationship graph, and displays results of the query, the results including graph segments representing entities with which the selected entity has inferred relationships; and

generate requested entity type information based on the input from the user, the requested entity type information indicating a selection, via one or more selectable GUI elements representing different edge and node types, of which types of nodes of the entity relationship graph should be targeted for the purpose of the query, wherein the results only indicate entities represented by nodes of the types selected via the one or more selectable GUI elements, and the graph generator displays the results by graphically depicting dependency relationships between the selected entity and entities omitted from the results via the requested entity type information as edges traversing through a hidden node that does not have an entity type that was selected via the one or more selectable GUI elements.

16 . The system of claim 15 , wherein the graph query and display app comprises a categorization tool, which generates, based on the input from the user via the input mechanism of the user device, configuration information for rules indicating a selection of which nodes representing the entities in the entity relationship graph should be assessed for a particular categorization analysis and logic for implementing the particular categorization analysis, and sends the configuration information for the rules to the rules engine, which monitors the entity relationship graph for selected conditions and automatically invokes the particular categorization analysis according to the particular categorization analysis and logic in response to detecting the selected conditions.

17 . The system of claim 15 , wherein the graph query and display app comprises a categorization tool, which generates, based on the input from the user via the input mechanism of the user device, configuration information for rules indicating a selection of which nodes representing the entities in the entity relationship graph should be assessed for a particular categorization analysis and which machine learning model(s) to be used to perform the particular categorization analysis, and the user device sends the configuration information for the rules to a machine learning engine, which monitors the entity relationship graph for selected conditions and automatically invokes the particular categorization analysis using the machine learning model(s) in response to detecting the selected conditions.