Granted Patent B1

US 12,705,355 · App. 19/222,523 · Granted Aug 11, 2026

Inventors: Ami Luttwak (Binyamina, IL); Assaf Segal (Tel Aviv, IL); Amir Lande Blau (Tel Aviv, IL)

Assignee: Wiz, Inc.

G06F21/566G06F11/0793G06F11/3604G06F21/563

Abstract

Claims (72)

1 . A method for automatically implementing runtime cybersecurity rules, comprising:

detecting a code object of a cloud computing environment, the code object utilized to deploy a resource in the cloud computing environment, wherein the cloud computing environment is a production environment;

performing static analysis on the code object;

generating a behavior baseline of the resource based on a result of the static analysis of the code object and data received from a runtime sensor deployed on the resource, wherein the resource is deployed in the cloud computing environment;

generating a runtime rule based on the behavior baseline;

deploying the runtime sensor on the resource in the cloud computing environment;

configuring the runtime sensor to apply the generated runtime rule;

applying the generated runtime rule on an event related to the resource; and

detecting a suspicious activity respective of the resource based on the application of the generated runtime rule on the event.

2 . The method of claim 1 , further comprising:

detecting a software service deployed in the cloud computing environment, the software service including at least the resource; and

generating a service behavior baseline based at least on the behavior baseline of the resource.

3 . The method of claim 2 , further comprising:

detecting the suspicious activity based on the service behavior baseline.

4 . The method of claim 1 , further comprising:

detecting the event by the runtime sensor.

5 . The method of claim 1 , further comprising:

detecting the event in a log of the cloud computing environment.

6 . The method of claim 5 , further comprising:

detecting the event in the log, the event including a data record having an identifier of the resource;

determining that the suspicious activity is a cybersecurity threat; and

initiating a mitigation action based on the cybersecurity threat.

7 . The method of claim 1 , further comprising:

generating a representation in a security database for each of: the code object and the resource.

8 . The method of claim 7 , further comprising:

deploying the runtime sensor including the generated runtime rule on each resource in the cloud computing environment having a representation in the security database which is connected to the representation of the code object.

9 . The method of claim 1 , further comprising:

initiating a remediation action based on the detected suspicious activity.

10 . The method of claim 1 , further comprising:

updating the behavior baseline in response to detecting a plurality of events in an event log, each event of the plurality of events indicating an allowable action initiated by the resource.

11 . A non-transitory computer-readable medium storing a set of instructions for automatically implemented runtime cybersecurity rules, the set of instructions comprising:

one or more instructions that, when executed by one or more processing circuitries of a device, cause the device to:

detect a code object of a cloud computing environment, the code object utilized to deploy a resource in the cloud computing environment, wherein the cloud computing environment is a production environment;

perform static analysis on the code object;

generate a behavior baseline of the resource based on a result of the static analysis of the code object and data received from a runtime sensor deployed on the resource, wherein the resource is deployed in the cloud computing environment;

generate a runtime rule based on the behavior baseline;

deploy the runtime sensor on the resource in the cloud computing environment;

configure the runtime sensor to apply the generated runtime rule;

apply the generated runtime rule on an event related to the resource; and

detect a suspicious activity respective of the resource based on the application of the generated runtime rule on the event.

12 . A system for automatically implementing runtime cybersecurity rules comprising:

a processing circuitry;

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

detect a code object of a cloud computing environment, the code object utilized to deploy a resource in the cloud computing environment, wherein the cloud computing environment is a production environment;

perform static analysis on the code object;

generate a behavior baseline of the resource based on a result of the static analysis of the code object and data received from a runtime sensor deployed on the resource, wherein the resource is deployed in the cloud computing environment;

generate a runtime rule based on the behavior baseline;

deploy the runtime sensor on the resource in the cloud computing environment;

configure the runtime sensor to apply the generated runtime rule;

apply the generated runtime rule on an event related to the resource; and

detect a suspicious activity respective of the resource based on the application of the generated runtime rule on the event.

13 . The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

detect a software service deployed in the cloud computing environment, the software service including at least the resource; and

generate a service behavior baseline based at least on the behavior baseline of the resource.

14 . The system of claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

detect the suspicious activity based on the service behavior baseline.

15 . The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

detect the event by the runtime sensor.

16 . The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

detect the event in a log of the cloud computing environment.

17 . The system of claim 16 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

detect the event in the log, the event including a data record having an identifier of the resource;

determine that the suspicious activity is a cybersecurity threat; and

initiate a mitigation action based on the cybersecurity threat.

18 . The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

generate a representation in a security database for each of: the code object and the resource.

19 . The system of claim 18 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

deploy the runtime sensor including the generated runtime rule on each resource in the cloud computing environment having a representation in the security database which is connected to the representation of the code object.

20 . The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

initiate a remediation action based on the detected suspicious activity.

21 . The system of claim 12 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

update the behavior baseline in response to detecting a plurality of events in an event log, each event of the plurality of events indicating an allowable action initiated by the resource.

Assignments (1)

References Cited (11)