Patent ID: 11902307
Assignee: CYBERARK SOFTWARE LTD.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 18:
19. A non-transitory computer-readable medium containing operation instructions that, when executed by at least one processor of a system, cause the system to perform operations comprising:
accessing first event data for a first event corresponding to a first entity;
updating at least one first cluster location in a multidimensional array using the first event, the at least one first cluster location corresponding to the first entity and representing a behavior history of the first entity, wherein the multidimensional array includes at least a first axis associated with a first event parameter and a second axis associated with a second event parameter, and wherein the first cluster location is defined relative to the first axis and the second axis;
determining, based on a rule queue and the first event, that the first event requires a first risk assessment;
performing the first risk assessment, the first risk assessment including:
determining a risk score by comparing a first location of the first event in the multidimensional array to the at least one first cluster location; and
determining a confidence score based on a number of events associated with the first entity; and

providing, based at least in part on the risk score and the confidence score, remediation instructions to perform a first remedial action concerning the first entity.