原始名称记载: MICROSOFT TECHNOLOGY LICENSING, LLC

Requests for a write storage operation are stored in a ring buffer. The next available request is retrieved from the ring buffer. When the next available request comprises a write operation that overlaps in a logical address range with a previous request stored in the ring buffer, the next available request is suspended. The next available request and the previous request are merged to generate a single request that includes logical address ranges of the next available request and the previous request.

Disclosed systems and methods identify a data record set and determine whether one or more predetermined conditions exist for triggering analysis of one or more records in the data record set. Disclosed embodiments trigger the analysis only in response to determining that the predetermined conditions have been met. Upon triggering the analysis of the data record set, disclosed embodiments identify a subset of the data record set to undergo the analysis while refraining from performing the analysis on the remaining records in the data record set. Further, embodiments identify an analysis model based on a level of analysis to be performed and apply the analysis model to the subset of the data record set to identify any presence of sensitive data. Lastly, disclosed embodiments selectively perform a security process to the data record set in response to detecting the presence of the sensitive data.

The disclosed techniques automatically identify cyber-security attacks and predict attack next steps. Descriptions of previously observed cyber-attack campaigns are decomposed into attack campaign steps. Real-time security incident signals are generated by cybersecurity software. Attack campaigns are identified by mapping attack campaign steps to security incident signals. Custom-generated telemetry queries are executed to determine if a missing attack campaign step occurred. A machine learning model generates embeddings for attack campaign steps, security incident signals, and telemetry query responses. A security incident signal or a telemetry query response matches an attack campaign step when their embeddings are within a defined distance. A security alert may be raised when most or all of the attack campaign steps of a particular attack campaign are matched. Attack campaign steps that are not matched to security incident signals or telemetry query results are predicted as attack next steps.

Disclosed is a system designed to efficiently process, correlate, and analyze alerts generated by large numbers of computing devices. Alerts are analyzed to identify when an incident is taking place. In some configurations, alerts are correlated based on shared attributes, such as an IP address, username, or session identifier. Correlations may be filtered based on domain knowledge and threat intelligence. The remaining correlations are used to construct a graph that represents an incident. Alerts are represented in the graph as vertices while correlations are represented as edges. The graph is pruned of redundant correlations, resulting in a streamlined representation of the incident. Reducing the number of correlations reduces the time required to identify an incident, improves accuracy, and allows for human experts to refine the process further by analyzing and adjusting key parameters.

Updating user-specific instances of a second application for individual users of a group based on a data file for the second application being shared via a collaboration object that corresponds to the group within a first application. The instances of the second application present each individual user with their own custom user experience that is configured to provide access to specific content based on object permissions data. An application extension is executable, by the first application, to extend content editing functionalities of the second application into the collaboration object. Responsive to specific content being associated with the collaboration object via the application extension, each of the instances of the second application may be automatically updated to provide direct access to the specific content. Thus, each user within the group defined for collaboration object can access the data file via the collaboration object and their own instance of the second application.