Platform Structure
The Cyberhaven platform secures your data using the following sensors and connected components to collect telemetry and content to be processed by the SaaS platform.
- Endpoint Sensors
- Cloud Sensors
- Browser Extensions
- Application Plugins
Endpoint Sensors
A Cyberhaven Sensor is a lightweight application that runs on the endpoint device to track all data origins and paths from every user data action. The collected metadata is then transformed into an auditable event to provide contextual history. Cyberhaven delivers attestation of your company's data journey while minimizing endpoint impact and maximizing user productivity.
Sensors capture and analyze granular data activity from user activity to track files across all data silos and processes. The Cyberhaven cloud service analyzes and connects events in a scalable graph database, then uses data science to stitch files and events back together without tagging, modifying documents, or comparing hashes.
Events Captured
Uploading and downloading, opening and creating, modifying and deleting, moving and copying, and emailing of documents and files. Ingress of documents, files, and emails into the enterprise.
Sending emails and attachments to domains inside the enterprise and to external domains.
Copying/cutting/pasting of content snippets between emails, files, documents, and instant messages.
Export of data and reports from databases and applications.
Information Stored
Cyberhaven does not store files or file content, only metadata about the following:
- File size and hash
- File system path and hostname
- Application path, command line, and name
- Browser URL and domain
- User information (logged-in username, group membership, SID list) Software installed on the endpoint
- Hardware connected to the endpoint
- Users connected to the endpoint
Additional telemetry is sent to the Cyberhaven backend from the endpoint which includes the software version and performance measurements of the Sensors.