Security policy framework for cloud environments
The present disclosure includes systems and methods for a security policy framework. Various embodiments include responsive to receiving a trigger, fetching one or more policies from a policy catalog service; compiling the one or more policies into a query, wherein the one or more policies can be compiled into a plurality of different query languages; executing the query over customer data, the customer data being located in one or more data sources; and persisting results of the query.
1 . A method comprising steps of:
responsive to receiving a trigger, fetching one or more policies from a policy catalog service;
compiling the one or more policies into a query by, for each of the one or more policies, utilizing a policy compiler to parse the policy definition, map policy conditions to corresponding database fields, and translate the mapped conditions into a Structured Query Language (SQL) statement in a dialect compatible with a query engine, wherein the policy compiler includes pluggable compilation dialects to generate SQL for different execution environments, wherein each of the one or more policies are compiled into an associated SQL query for execution;
executing the associated SQL query via the query engine by connecting to one or more heterogeneous customer data sources, joining or aggregating data retrieved from the data sources in accordance with the SQL query, and applying the policy conditions to identify matching records, the query engine being configured to operate across the heterogeneous data sources with out requiring a uniform schema; and
persisting results of the query.
2 . The method of claim 1 , wherein the steps further comprise displaying the results to the customer via a Graphical User Interface (GUI).
3 . The method of claim 1 , wherein the results comprise one or more alerts associated with the customer's cloud environment.
4 . The method of claim 1 , wherein the trigger is received based on any of a schedule or receiving some data about a customer's infrastructure.
5 . The method of claim 1 , wherein the query is executed over customer data located in a plurality of different types of data sources having different schemas.
6 . The method of claim 1 , wherein the one or more policies are associated with posture control of the customer's cloud environment, and wherein the customer data comprises posture control data.
7 . The method of claim 6 , wherein the posture control data comprises any of assets, identities, network flow logs, activities, and code repositories in the customer's cloud environment.
8 . The method of claim 6 , wherein the cloud environment is any of a run-time cloud environment and a build-time cloud environment.
9 . A non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors to perform steps of:
responsive to receiving a trigger, fetching one or more policies from a policy catalog service;
compiling the one or more policies into a query by, for each of the one or more policies, utilizing a policy compiler to parse the policy definition, map policy conditions to corresponding database fields, and translate the mapped conditions into a Structured Query Language (SQL) statement in a dialect compatible with a query engine, wherein the policy compiler includes pluggable compilation dialects to generate SQL for different execution environments, wherein each of the one or more policies are compiled into an associated SQL query for execution;
executing the associated SQL query via the query engine by connecting to one or more heterogeneous customer data sources, joining or aggregating data retrieved from the data sources in accordance with the SQL query, and applying the policy conditions to identify matching records e query engine being configured to cross the heterogeneous data sources without requiring a uniform schema; and
persisting results of the query.
10 . The non-transitory computer-readable medium of claim 9 , wherein the steps further comprise displaying the results to the customer via a Graphical User Interface (GUI).
11 . The non-transitory computer-readable medium of claim 9 , wherein the results comprise one or more alerts associated with the customer's cloud environment.
12 . The non-transitory computer-readable medium of claim 9 , wherein the trigger is received based on any of a schedule or receiving some data about a customer's infrastructure.
13 . The non-transitory computer-readable medium of claim 9 , wherein the query is executed over customer data located in a plurality of different types of data sources having different schemas.
14 . The non-transitory computer-readable medium of claim 9 , wherein the one or more policies are associated with posture control of the customer's cloud environment, and wherein the customer data comprises posture control data.
15 . The non-transitory computer-readable medium of claim 14 , wherein the posture control data comprises any of assets, identities, network flow logs, activities, and code repositories in the customer's cloud environment.
16 . The non-transitory computer-readable medium of claim 14 , wherein the cloud environment is any of a run-time cloud environment and a build-time cloud environment.