Granted Patent B2

US 12,526,297 · App. 17/829,110 · Granted Jan 13, 2026

Inventors: Úlfar Erlingsson (Palo Alto, CA); Yijou Chen (Cupertino, CA)

Assignee: Fortinet, Inc.

H04L63/1425G06F9/455G06F9/545G06F16/9024G06F16/9038G06F16/9535G06F16/9537G06F21/57H04L63/10H04L67/306H04L67/535G06F16/2456

Abstract

Claims (67)

1 . A computer-implemented method comprising:

executing one or more software applications in a first computing environment in a first cloud deployment;

monitoring, with one or more agents, a software development and deployment pipeline including the one or more software applications of the first computing environment in the first cloud deployment;

annotating, with one or more data processing resources of a data platform, a detected change in the one or more software applications in the first computing environment with a description of the detected change in the one or more software applications;

accessing, with the one or more data processing resources of the data platform, the annotations for the detected change in the one or more software applications in the first computing environment of the first cloud deployment in response to detecting an unexpected change including a change in user permissions or a change in a software configuration for the one or more software applications upon receiving a security alert for the unexpected change in a second computing environment of a second cloud deployment that is outside of the first computing environment in the first cloud deployment;

comparing, with the one or more data processing resources of the data platform, annotations of the unexpected change in the second computing environment and the annotations of the detected change in the first computing environment to determine whether the annotations of the unexpected change are identical or similar to the annotations of the detected change; and

approving the unexpected change in the second computing environment of the second cloud deployment based upon the compared annotations of the unexpected change in the second computing environment to the annotations of the detected change in the first computing environment.

2 . The computer-implemented method of claim 1 further comprising:

requesting approval of the detected change in accordance with the annotations; and

approving, based on the approval of the detected change being indicated in the annotations, the unexpected change upon detecting the unexpected change.

3 . The computer-implemented method of claim 1 further comprising:

identifying the unexpected change in the second computing environment that is a different software environment; and

identifying an action responsive to the detected change in the first computing environment.

4 . The computer-implemented method of claim 3 further comprising:

approving the unexpected change in the different second computing environment based upon the compared annotations and the responsive action to the detected change in the first computing environment.

5 . The computer-implemented method of claim 4 further comprising:

suppressing a security alert for the unexpected change in the second computing environment based upon the compared annotations and the responsive action to the detected change in the first computing environment.

6 . The computer-implemented method of claim 3 further comprising:

wherein the unexpected change is a change in permissions,

approving the unexpected change in permissions in the second computing environment based upon the compared annotations and the responsive action to the detected change in the first computing environment.

7 . The computer-implemented method of claim 1 further comprising:

ranking a severity for a security alert for the unexpected change based upon the annotations of the detected change.

8 . A system comprising:

a memory; and

one or more processing devices operatively coupled to the memory, the one or more processing devices comprising at least one hardware processor and configured to:

execute one or more software applications in a first computing environment in a first cloud deployment:

monitor, with one or more agents, a software development and deployment pipeline including the one or more software applications of the first computing environment;

annotate a detected change in the one or more software applications in the first computing environment with a description of the detected change in the one or more software applications;

access the annotations for the detected change in the one or more software applications in the first computing environment of the first cloud deployment in response to detecting an unexpecting change including a change in user permissions or a change in a software configuration for the one or more software applications upon receiving a security alert for an unexpected change in a second computing environment of a second cloud deployment that is outside of the first computing environment in the first cloud deployment; and

compare annotations of the unexpected change in the second computing environment and the annotations of the detected change in the first computing environment to determine whether the annotations of the unexpected change are identical or similar to the annotations of the detected change; and

approve the unexpected change in the second computing environment of the second cloud deployment based upon the compared annotations of the unexpected change in the second computing environment to the annotations of the detected change in the first computing environment.

9 . The system of claim 8 wherein the one or more processing devices is further configured to:

request approval of the detected change in accordance with the annotations; and

approve, based on the approval of the detected change being indicated in the annotations, the unexpected change upon detecting the unexpected change.

10 . The system of claim 8 wherein the one or more processing devices is further configured to:

identify the unexpected change in the second computing environment; and

identify an action responsive to the detected change in the first computing environment.

11 . The system of claim 10 wherein the one or more processing devices is further configured to:

approve the unexpected change in the second computing environment based upon the compared annotations and the responsive action to the detected change in the first computing environment; and

suppress the security alert for the unexpected change in the second computing environment based upon the compared annotations and the responsive action to the detected change in the first computing environment.

12 . The system of claim 10 wherein the one or more processing devices is further configured to:

wherein the unexpected change is a change in permissions,

approve the unexpected change in permissions in the second software environment based upon the compared annotations and the responsive action to the detected change in the first computing environment.

13 . The system of claim 8 wherein the one or more processing devices is further configured to:

rank a severity for the security alert for the unexpected change based upon the annotations of the detected change.

14 . A non-transitory computer readable storage medium storing instructions which, when executed, cause one or more processing devices to:

execute one or more software applications in a first computing environment in a first cloud deployment;

monitor, with one or more agents, the first computing environment that includes the one or more software applications in the first cloud deployment;

annotate a detected change in the one or more software applications with a description of the detected change in the one or more software applications;

access the annotations for the detected change in the one or more software applications in the first computing environment of the first cloud deployment in response to an unexpected change including a change in user permissions or a change in a software configuration for the one or more software applications upon receiving a security alert for the unexpected change, wherein the unexpected change is detected in a second computing environment of a second cloud deployment that is outside of the first computing environment in the first cloud deployment;

compare, with the one or more processing devices of a data platform, annotations of the unexpected change in the second computing environment and the annotations of the detected change in the first computing environment to determine whether the annotations of the unexpected change are identical or similar to the annotations of the detected change; and

approve the unexpected change in the second computing environment of the second cloud deployment based upon the compared annotations of the unexpected change in the second computing environment to the annotations of the detected change in the first computing environment.

15 . The non-transitory computer readable storage medium of claim 14 wherein the instructions, when executed, further cause the one or more processing devices to:

request approval of the detected change in accordance with the annotations; and

approve, based on the approval of the detected change being indicated in the annotations, the unexpected change upon detecting the unexpected change.

16 . The non-transitory computer readable storage medium of claim 14 wherein the instructions, when executed, further cause the one or more processing devices to:

identify the unexpected change in the second computing environment; and

identify an action responsive to the unexpected change in the second computing environment.

17 . The non-transitory computer readable storage medium of claim 15 wherein the instructions, when executed, further cause the one or more processing devices to:

approve the unexpected change in the second computing environment based upon the compared annotations and the responsive action to the detected change in the first computing environment.

18 . The non-transitory computer readable storage medium of claim 15 wherein the instructions, when executed, further cause the one or more processing devices to:

suppress the security alert for the unexpected change in the second computing environment based upon the compared annotations and the responsive action to the detected change in the first computing environment.

19 . The non-transitory computer readable storage medium of claim 15 wherein the instructions, when executed, further cause the one or more processing devices to:

wherein the unexpected change is a change in permissions,

approve the unexpected change in permissions in the second computing environment based upon the compared annotations and the responsive action to the detected change in the first computing environment.

20 . The non-transitory computer readable storage medium of claim 14 wherein the instructions, when executed, further cause the one or more processing devices to:

rank a severity for the security alert for the unexpected change based upon the annotations of the detected change.

Assignments (2)

Continuity (7)

References Cited (400)