Oligo Cloud Application Detection & Response (CADR)

Detects exploitation of unknown vulnerabilities by analyzing runtime behavior rather than matching known attack signatures, protecting against vulnerabilities before CVE publication.

Verifies the integrity of application code, resources, and the execution environment at runtime, detecting repackaging, method hooking, and dynamic instrumentation such as Frida, and triggering a defensive response when tampering is detected.

Performs in-process interception and threat analysis with minimal latency impact, keeping the agent viable in production workloads with overhead varying by product.

Detects and blocks injection at the sink where untrusted input reaches dangerous operations, covering SQL and NoSQL injection, command injection, XXE, path traversal, and SSRF.

Streams runtime attack evidence such as blocked exploit attempts and suspicious invocations to SIEM, SOAR, and APM platforms, commonly via OpenTelemetry.

Operate in monitor-only mode (log and alert), or active blocking mode (terminate request upon detection). Most deployments begin in monitor mode to establish a false positive baseline before enabling blocking.

Instruments runtimes to intercept database queries, command execution, and deserialization across Java, .NET, Python, Node.js, PHP, Ruby, and Go, with coverage depth varying by product.

Blocks exploitation of known vulnerabilities at runtime without source code changes, reducing exposure during the gap before a deployed fix, especially on legacy or hard-to-patch applications.

Detects attacks at the application and API layer at runtime using behavioral signals such as unexpected process behavior, suspicious API calls, unusual service-to-service communication, and exploit activity across cloud apps, containers, and Kubernetes.

Triggers automated response actions (session revocation, account suspension, OAuth grant removal), in SaaS platforms in response to confirmed detections via platform APIs.

Monitors user, admin, and OAuth app activity within SaaS platforms (M365, Google Workspace, Salesforce, GitHub), for anomalies and policy violations using API-based log ingestion.

Detects misuse of OAuth access tokens granted to connected applications, including tokens being used outside expected scope, geographic anomalies, and post-compromise app persistence.

Captures a continuous record of workload events (process, network, file, syscall) for forensic investigation of incidents in running workloads.

Mitigates workload vulnerabilities in runtime through virtual patching, workload isolation and segmentation, and management of running services and processes.

Monitors process execution, network connections, and file system activity in running workloads using a kernel agent, eBPF sensor, or sidecar container to detect behavioral anomalies and known attack patterns.