Granted Patent B1

US 12,563,058 · App. 19/224,127 · Granted Feb 24, 2026

Inventors: Ron Konigsberg (Tel Aviv, IL); Itay Harel (Tel Aviv, IL); Dan Becker (Tel Aviv, IL)

Assignee: Wiz, Inc.

H04L63/1416H04L63/1441

Abstract

Claims (55)

1 . A method for cross-entity correlation of software containers in a cloud computing environment, comprising:

detecting in a log an event record related to a software container platform utilized in a cloud computing environment;

extracting from the event record a software container identifier and a principal identifier;

cross-referencing the software container identifier with a unique software container identifier list based at least on the principal identifier;

associating in a security database the event record and the unique software container identifier; and

applying a control based on the event record and the unique software container identifier.

2 . The method of claim 1 , further comprising:

applying the control only on a software container corresponding to the software container identifier.

3 . The method of claim 2 , further comprising:

applying the control to halt execution of a process on the software container.

4 . The method of claim 2 , further comprising:

applying the control to detect a cybersecurity risk associated with the software container.

5 . The method of claim 1 , further comprising:

deploying a runtime sensor in the software container platform, the runtime sensor configured to detect runtime events;

detecting the event record utilizing the runtime sensor.

6 . The method of claim 1 , further comprising:

applying the control to detect a cybersecurity risk.

7 . The method of claim 6 , further comprising:

detecting the cybersecurity risk in response to determining that a plurality of events are each associated with a unique software container corresponding to the unique software.

8 . The method of claim 6 , further comprising:

determining that there is no cybersecurity risk in response to determining that a plurality of events associated with the software container platform are each associated with a different software container of the software container platform.

9 . The method of claim 6 , further comprising:

initiating a remediation action in the software container platform.

10 . A non-transitory computer-readable medium storing a set of instructions for cross-entity correlation of software containers in a cloud computing environment, the set of instructions comprising:

one or more instructions that, when executed by one or more processing circuitries of a device, cause the device to:

detect in a log an event record related to a software container platform utilized in a cloud computing environment;

extract from the event record a software container identifier and a principal identifier;

cross-reference the software container identifier with a unique software container identifier list based at least on the principal identifier;

associate in a security database the event record and the unique software container identifier; and

apply a control based on the event record and the unique software container identifier.

11 . A system for cross-entity correlation of software containers in a cloud computing environment comprising:

a processing circuitry;

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

detect in a log an event record related to a software container platform utilized in a cloud computing environment;

extract from the event record a software container identifier and a principal identifier;

cross-reference the software container identifier with a unique software container identifier list based at least on the principal identifier;

associate in a security database the event record and the unique software container identifier; and

apply a control based on the event record and the unique software container identifier.

12 . The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

apply the control only on a software container corresponding to the software container identifier.

13 . The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

apply the control to halt execution of a process on the software container.

14 . The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

apply the control to detect a cybersecurity risk associated with the software container.

15 . The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

deploy a runtime sensor in the software container platform, the runtime sensor configured to detect runtime events; and

detect the event record utilizing the runtime sensor.

16 . The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

apply the control to detect a cybersecurity risk.

17 . The system of claim 16 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

detect the cybersecurity risk in response to determining that a plurality of events are each associated with a unique software container corresponding to the unique software.

18 . The system of claim 16 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

determine that there is no cybersecurity risk in response to determining that a plurality of events associated with the software container platform are each associated with a different software container of the software container platform.

19 . The system of claim 16 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

initiate a remediation action in the software container platform.

Assignments (1)

References Cited (9)

Cited By (1)

US 12,706,958