Cloud access security broker systems and methods with an in-memory data store

1. A non-transitory computer-readable storage medium having computer-readable code stored thereon for programming one or more processors associated with a Cloud Access Security Broker (CASB) system to perform steps of:

receiving a record associated with an incident that was detected by the CASB system in a Software-as-a-Service (SaaS) application;

determining a hash based on a plurality of levels for the record;

determining if the record exists in a data store based on the hash

responsive to the record existing in the data store, deleting an old record and broadcasting a delete request to other nodes in a cluster so that any node having a key based on the hash of each the plurality of levels deletes an old record; and

inserting the record in the data store based on the hash, wherein the data store is maintained in-memory and includes records at leaf nodes in a multi-level hash based on the plurality of levels.

2. The non-transitory computer-readable storage medium of claim 1 , wherein the incident is one of a Data Loss Prevention (DLP) violation and malware, each being detected by a scan by the CASB system of the SaaS application.

3. The non-transitory computer-readable storage medium of claim 1 , wherein the CASB system is a multi-tenant system, and wherein the plurality of levels include a company identifier, an application identifier for the SaaS application, and a tenant name for a user, each being individually hashed.

4. The non-transitory computer-readable storage medium of claim 1 , wherein the steps further include

periodically storing records in the data store in a file for recovery.

5. The non-transitory computer-readable storage medium of claim 1 , wherein the steps further include

receiving a query related to a count based on one or more of the plurality of levels; and

responding to the query based on a count of the one or more of the plurality of levels.

6. The non-transitory computer-readable storage medium of claim 1 , wherein the steps further include

receiving a delete request for a record where a query is running; and

marking the record for deletion such that the record is deleted after the query.

7. A system associated with a Cloud Access Security Broker (CASB) system, comprising:

one or more processors and memory storing instructions that, when executed, cause the one or more processors to

receive a record associated with an incident that was detected by the CASB system in a Software-as-a-Service (SaaS) application;

determine a hash based on a plurality of levels for the record;

determine if the record exists in a data store based on the hash;

responsive to the record existing in the data store, delete an old record and broadcast a delete request to other nodes in a cluster so that any node having a key based on the hash of each the plurality of levels deletes an old record; and

insert the record in the data store based on the hash, wherein the data store is maintained in-memory and includes records at leaf nodes in a multi-level hash based on the plurality of levels.

8. The system of claim 7 , wherein the incident is one of a Data Loss Prevention (DLP) violation and malware, each being detected by a scan by the CASB system of the SaaS application.

9. The system of claim 7 , wherein the CASB system is a multi-tenant system, and wherein the plurality of levels include a company identifier, an application identifier for the SaaS application, and a tenant name for a user, each being individually hashed.

10. The system of claim 7 , wherein the instructions that, when executed, further cause the one or more processors to

periodically store records in the data store in a file for recovery.

11. The system of claim 7 , wherein the instructions that, when executed, further cause the one or more processors to

receive a query related to a count based on one or more of the plurality of levels; and

respond to the query based on a count of the one or more of the plurality of levels.

12. The system of claim 7 , wherein the instructions that, when executed, further cause the one or more processors to

receive a delete request for a record where a query is running; and

mark the record for deletion such that the record is deleted after the query.

13. A method comprising:

receiving a record associated with an incident that was detected by the CASB system in a Software-as-a-Service (SaaS) application;

determining a hash based on a plurality of levels for the record;

determining if the record exists in a data store based on the hash;

responsive to the record existing in the data store, deleting an old record and broadcasting a delete request to other nodes in a cluster so that any node having a key based on the hash of each the plurality of levels deletes an old record; and

inserting the record in the data store based on the hash, wherein the data store is maintained in-memory and includes records at leaf nodes in a multi-level hash based on the plurality of levels.

14. The method of claim 13 , wherein the incident is one of a Data Loss Prevention (DLP) violation and malware, each being detected by a scan by the CASB system of the SaaS application.

15. The method of claim 13 , wherein the CASB system is a multi-tenant system, and wherein the plurality of levels include a company identifier, an application identifier for the SaaS application, and a tenant name for a user, each being individually hashed.

16. The method of claim 13 , further comprising

periodically storing records in the data store in a file for recovery.

17. The method of claim 13 , further comprising

receiving a query related to a count based on one or more of the plurality of levels; and

responding to the query based on a count of the one or more of the plurality of levels.