Granted Patent B1

US 12,693,881 · App. 17/804,923 · Granted Jul 28, 2026

Inventors: Yaniv Shaked (Tel Aviv, IL); Ami Luttwak (Binyamina, IL); Roy Reznik (Tel Aviv, IL); Yarin Miran (Rishon Lezion, IL); Moran Cohen (Tel Aviv, IL)

Assignee: Wiz, Inc.

G06F9/45558G06F8/63G06F9/5077G06F21/602G06F2009/4557G06F2009/45595

Abstract

Claims (76)

1 . A method for inspecting different types of cloud workloads for cybersecurity threats, all of the cloud workloads deployed in a cloud computing environment, comprising:

accessing a first disk of a first cloud workload of a plurality of deployed cloud workloads, the first workload being of a first type;

accessing a second disk of a second cloud workload of a plurality of deployed cloud workloads, the second workload being of a second type;

extracting data from each of the first cloud workload and the second cloud workload into a storage layer in storage of a third disk, the storage layer having a data schema, based on a predefined data structure;

inspecting the extracted data to detect a first target object, the target object indicating a cybersecurity threat, wherein extraction for each of the first cloud workload and the second cloud workload is based on the workload type;

representing the first target object as a first node in a security graph stored on a security database;

representing a disk of the first disk and the second disk storing the first target object as a second node connected to the first node in the security graph; and

representing a cloud workload of the first cloud workload and the second cloud workload as a machine node connected to the second node, the cloud workload allocated the disk in the security graph.

2 . The method of claim 1 , wherein the cloud workload is a virtual machine.

3 . The method of claim 2 , further comprising:

generating a snapshot of a disk of the virtual machine;

mounting the snapshot as an inspection disk; and

extracting data from the inspection disk into the storage layer.

4 . The method of claim 3 , further comprising:

generating a re-encrypted snapshot of the disk of the virtual machine, wherein the disk is encrypted with an encryption key which is not accessible.

5 . The method of claim 1 , wherein the cloud workload is a software container.

6 . The method of claim 5 , further comprising:

opening each layer of a plurality of layers of the software container;

extracting data from each layer; and

storing the extracted data from each layer in the storage layer.

7 . The method of claim 5 , further comprising:

accessing a container image repository to extract an image of the software container;

deploying another container based on the extracted image; and

extracting data from the another container.

8 . The method of claim 1 , wherein the cloud workload is a serverless function.

9 . The method of claim 8 , further comprising:

receiving an extractable object associated with the serverless function; and

extracting data from the extractable object.

10 . The method of claim 9 , further comprising:

decompressing the extractable object, when the extractable object is a compressed file.

11 . The method of claim 1 , further comprising:

inspecting the extracted data with a first type of inspector for a first type of cybersecurity threat; and

inspecting the extracted data with a second type of inspector for a second type of cybersecurity threat, which is not the first type of cybersecurity threat.

12 . A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:

accessing a first disk of a first cloud workload of a plurality of deployed cloud workloads, the first workload being of a first type;

accessing a second disk of a second cloud workload of a plurality of deployed cloud workloads, the second workload being of a second;

extracting data from each of the first cloud workload and the second cloud workload into a storage layer in storage of a third disk, the storage layer having a data schema, based on a predefined data structure;

inspecting the extracted data to detect a first target object, the target object indicating a cybersecurity threat, wherein extraction for each of the first cloud workload and the second cloud workload is based on the workload type;

representing the first target object as a first node in a security graph stored on a security database;

representing a disk of the first disk and the second disk storing the first target object as a second node connected to the first node in the security graph; and

representing a cloud workload of the first cloud workload and the second cloud workload as a machine node connected to the second node, the cloud workload allocated the disk in the security graph.

13 . A system for inspecting different types of cloud workloads for cybersecurity threats, all of the cloud workloads deployed in a cloud computing environment, comprising:

a processing circuitry; and

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

access a first disk of a first cloud workload of a plurality of deployed cloud workloads, the first workload being of a first type;

access a second disk of a second cloud workload of a plurality of deployed cloud workloads, the second workload being of a second type;

extract data from each of the first cloud workload and the second cloud workload into a storage layer in storage of a third disk, the storage layer having a data schema, based on a predefined data structure;

inspect the extracted data to detect a first target object, the target object indicating a cybersecurity threat, wherein extraction for each of the first cloud workload and the second cloud workload is based on the workload type;

represent the first target object as a first node in a security graph stored on a security database;

represent a disk of the first disk and the second disk storing the first target object as a second node connected to the first node in the security graph; and

represent a cloud workload of the first cloud workload and the second cloud workload as a machine node connected to the second node, the cloud workload allocated the disk in the security graph.

14 . The system of claim 13 , wherein the cloud workload is a virtual machine.

15 . The system of claim 14 , wherein the memory contains further instructions that, when executed by the processing circuitry, further configure the system to:

generate a snapshot of a disk of the virtual machine;

mount the snapshot as an inspection disk; and

extract data from the inspection disk into the storage layer.

16 . The system of claim 15 , wherein the memory contains further instructions that, when executed by the processing circuitry, further configure the system to:

generate a re-encrypted snapshot of the disk of the virtual machine, wherein the disk is encrypted with an encryption key which is not accessible.

17 . The system of claim 13 , wherein the cloud workload is a software container.

18 . The system of claim 17 , wherein the memory contains further instructions that, when executed by the processing circuitry, further configure the system to:

open each layer of a plurality of layers of the software container;

extract data from each layer; and

store the extracted data from each layer in the storage layer.

19 . The system of claim 17 , wherein the memory contains further instructions that, when executed by the processing circuitry, further configure the system to:

access a container image repository to extract an image of the software container;

deploy another container based on the extracted image; and

extract data from the another container.

20 . The system of claim 13 , wherein the cloud workload is a serverless function.

21 . The system of claim 20 , wherein the memory contains further instructions that, when executed by the processing circuitry, further configure the system to:

receive an extractable object associated with the serverless function; and

extract data from the extractable object.

22 . The system of claim 21 , wherein the memory contains further instructions that, when executed by the processing circuitry, further configure the system to:

decompress the extractable object, when the extractable object is a compressed file.

23 . The system of claim 13 , wherein the memory contains further instructions that, when executed by the processing circuitry, further configure the system to:

inspect the extracted data with a first type of inspector for a first type of cybersecurity threat; and

inspect the extracted data with a second type of inspector for a second type of cybersecurity threat, which is not the first type of cybersecurity threat.

Assignments (1)

Continuity (1)

References Cited (54)