Cloud access security broker systems and methods for active user identification and load balancing

1. A non-transitory computer-readable storage medium having computer-readable code stored thereon for programming one or more processors associated with a Cloud Access Security Broker (CASB) system to perform steps of:

causing a scan by the CASB system of a plurality of users associated with a tenant in a Software-as-a-Service (SaaS) application where the scan includes any of identifying malware in content in the SaaS application and identifying confidential data in the content in the SaaS application;

during the scan which is covering historical data in the SaaS application, receiving live notifications that certain users are currently modifying certain content via webhooks from the SaaS application, wherein the received live notifications identify a user, content, and an event type associated with the modifying;

including the content being actively modified in the scan with the historical data, wherein the including comprises pushing the content being actively modified into a queue of a plurality of queues for consumption by a plurality of workers associated by the CASB system based on the live notifications,

maintaining tion of the any of the plurality of users, and

causing the content being actively modified in the scan to be processed by a CASB scanner closest to a source of the content based on he geolocation, wherein the processing is performed in compliance with local law and regulations based thereon, and wherein the CASB scanner is one of a plurality of CASB scanners associated with a composite CASB system executed within a distributed cloud-based system.

2. The non-transitory computer-readable storage medium of claim 1 , wherein the steps further include

based on receiving live notifications identifying a user, content, and an event type associated with a live modification, prioritizing the content associated with the live modification in the scan higher than the scan of the historical data, thereby scanning live data modifications in near real-time.

3. The non-transitory computer-readable storage medium of claim 1 , wherein the historical data is scanned via Application Programming Interfaces (APIs) associated with the SaaS application.

4. The non-transitory computer-readable storage medium of claim 1 , wherein the steps further include

causing an action in the SaaS application based on the scan and based on policy and the content.

5. The non-transitory computer-readable storage medium of claim 4 , wherein the action includes any of allowing a file, deleting a file, quarantining a file, and providing a notification.

6. The non-transitory computer-readable storage medium of claim 1 , wherein the steps further include

causing execution of a file of the content in a sandbox for the identifying malware.

7. The non-transitory computer-readable storage medium of claim 1 , wherein the steps further include

causing queueing of the content being actively modified and the historical data.

8. A system associated with a Cloud Access Security Broker (CASB) system, comprising:

one or more processors and memory storing instructions that, when executed, cause the one or more processors to

cause a scan by the CASB system of a plurality of users associated with a tenant in a Software-as-a-Service (SaaS) application where the scan includes any of malware identification in content in the SaaS application and confidential data identification in the content in the SaaS application;

during the scan which is covering historical data in the SaaS application, receive live notifications that certain users are currently modifying certain content via webhooks from the SaaS application, wherein the received live notifications identify a user, content, and an event type associated with the modifying;

include the content being actively modified in the scan with the historical data, wherein the including comprises pushing the content being actively modified into a queue of a plurality of queues for consumption by a plurality of workers associated by the CASB system based on the live notifications;

maintain geolocation of the any of the plurality of users; and

cause the content being actively modified in the scan to be processed by a CASB scanner closest to a source of the content based on the geolocation, wherein the processing is performed in compliance with local law and regulations based thereon, and wherein the CASB scanner is one of a plurality of CASB scanners associated with a composite CASB system executed within a distributed cloud-based system.

9. The system of claim 8 , wherein the instructions that, when executed, further cause the one or more processors to

based on receiving live notifications identifying a user, content, and an event type associated with a live modification, prioritize the content associated with the live modification in the scan higher than the scan of the historical data, thereby scanning live data modifications in near real-time.

10. The system of claim 8 , wherein the historical data is scanned via Application Programming Interfaces (APIs) associated with the SaaS application.

11. The system of claim 8 , wherein the instructions that, when executed, further cause the one or more processors to

cause an action in the SaaS application based on the scan and based on policy and the content.

12. The system of claim 11 , wherein the action includes any of allowing a file, deleting a file, quarantining a file, and providing a notification.

13. The system of claim 8 , wherein the instructions that, when executed, further cause the one or more processors to

cause execution of a file of the content in a sandbox for the malware identification.

14. The system of claim 8 , wherein the instructions that, when executed, further cause the one or more processors to

cause queueing of the content being actively modified and the historical data.

15. A method comprising:

causing a scan by Cloud Access Security Broker (CASB) system of a plurality of users associated with a tenant in a Software-as-a-Service (Saas) application where the scan includes any of identifying malware in content in the SaaS application and identifying confidential data in the content in the SaaS application;

during the scan which is covering historical data in the SaaS application, receiving live notifications that certain users are currently modifying certain content via webhooks from the SaaS application, wherein the received live notifications identify a user, content, and an event type associated with the modifying;

including the content being actively modified in the scan with the historical data, wherein the including comprises pushing the content being actively modified into a queue of a plurality of queues for consumption by a plurality of workers associated by the CASB system based on the live notifications; and

maintaining geolocation of the any of the plurality of users: and

causing the content being actively modified in the scan to be processed by a CASB scanner closest to a source of the content based on the geolocation, wherein the processing is performed in compliance with local law and regulations based thereon, and wherein the CASB scanner is one of a plurality of CASB scanners associated with a composite CASB system executed within a distributed cloud-based system.

16. The method of claim 15 , further comprising

based on receiving live notifications identifying a user, content, and an event type associated with a live modification, prioritizing the content associated with the live modification in the scan higher than the scan of the historical data, thereby scanning live data modifications in near real-time.

17. The method of claim 15 , wherein the historical data is scanned via Application Programming Interfaces (APIs) associated with the SaaS application.