Systems and methods for cloud discovery and orchestration

1 . A method comprising:

retrieving a plurality of out-of-band inputs related to a cloud environment from one or more external log sources without being inline in the cloud environment;

retrieving a plurality of inline inputs related to the cloud environment from one or more inline network security services;

determining one or more correlations between one or more destinations, sources, and networks associated with the cloud environment based on the out-of-band inputs and the inline inputs, wherein the correlations bridge gaps between the out-of-band inputs and the inline inputs by mapping the out-of-band inputs to threat information or uniform resource locator (URL) category information available from the inline inputs;

determining one or more relationships between the one or more destinations, sources, and networks based on the correlations; and

generating connectivity predictions for the cloud environment, the connectivity predictions including recommendations for future connectivity needs of the cloud environment, wherein the connectivity predictions identify actual connections required and their direction and are based on analyzing access patterns over time using common destination groupings and metadata attributes of source workloads or networks.

2 . The method of claim 1 , wherein the plurality of inline inputs are retrieved from one or more cloud-based security solutions.

3 . The method of claim 1 , wherein the plurality of out-of-band inputs are retrieved from any of AWS Route 53, AWS VPC Flow Logs, Azure DNS Query Logs, Azure VNet Flow Logs, Google Cloud DNS Logs, and Google Cloud Flow Logs.

4 . The method of claim 1 , wherein the steps further comprise:

providing one or more graphical representations depicting one or more relationships based on the one or more correlations.

5 . The method of claim 2 , wherein a graphical representation of the one or more graphical representations includes a depiction of relationships between one or more networks, one or more risk categories, and one or more destinations.

6 . The method of claim 1 , wherein the steps further comprise:

generating a risk score for any of workloads and networks based on the one or more correlations.

7 . A non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors to perform steps of:

retrieving a plurality of out-of-band inputs related to a cloud environment from one or more external log sources without being inline in the cloud environment;

retrieving a plurality of inline inputs related to the cloud environment from one or more inline network security services;

determining one or more correlations between one or more destinations, sources, and networks associated with the cloud environment based on the out-of-band inputs and the inline inputs, wherein the correlations bridge gaps between the out-of-band inputs and the inline inputs by mapping the out-of-band inputs to threat information or uniform resource locator (URL) category information available from the inline inputs;

determining one or more relationships between the one or more destinations, sources, and networks based on the correlations; and

generating connectivity predictions for the cloud environment, the connectivity predictions including recommendations for future connectivity needs of the cloud environment, wherein the connectivity predictions identify actual connections required and their direction and are based on analyzing access patterns over time using common destination groupings and metadata attributes of source workloads or networks.

8 . The non-transitory computer-readable medium of claim 7 , wherein the plurality of inline inputs are retrieved from one or more cloud-based security solutions.

9 . The non-transitory computer-readable medium of claim 7 , wherein the plurality of out-of-band inputs are retrieved from any of AWS Route 53, AWS VPC Flow Logs, Azure DNS Query Logs, Azure VNet Flow Logs, Google Cloud DNS Logs, and Google Cloud Flow Logs.

10 . The non-transitory computer-readable medium of claim 7 , wherein the steps further comprise:

providing one or more graphical representations depicting one or more relationships based on the one or more correlations.

11 . The non-transitory computer-readable medium of claim 10 , wherein a graphical representation of the one or more graphical representations includes a depiction of relationships between one or more networks, one or more risk categories, and one or more destinations.

12 . The non-transitory computer-readable medium of claim 7 , wherein the steps further comprise:

generating a risk score for any of workloads and networks based on the one or more correlations.

13 . A server comprising:

a processor; and

memory configured to store executable instructions that, when executed, cause the processor to;

retrieve a plurality of out-of-band inputs related to a cloud environment from one or more external log sources without being inline in the cloud environment;

retrieve a plurality of inline inputs related to the cloud environment from one or more inline network security services;

determine one or more correlations between one or more destinations, sources, and networks associated with the cloud environment based on the out-of-band inputs and the inline inputs, wherein the correlations bridge gaps between the out-of-band inputs and the inline inputs by mapping the out-of-band inputs to threat information or uniform resource locator (URL) category information available from the inline inputs;

determine one or more relationships between the one or more destinations, sources, and networks based on the correlations; and

generate connectivity predictions for the cloud environment, the connectivity predictions including recommendations for future connectivity needs of the cloud environment, wherein the connectivity predictions identify actual connections required and their direction and are based on analyzing access patterns over time using common destination groupings and metadata attributes of source workloads or networks.

14 . The server of claim 13 , wherein the plurality of inline inputs are retrieved from one or more cloud-based security solutions.

15 . The server of claim 13 , wherein the executable instructions that, when executed, further cause the processor to:

provide one or more graphical representations depicting one or more relationships based on the one or more correlations.

16 . The server of claim 15 , wherein a graphical representation of the one or more graphical representations includes a depiction of relationships between one or more networks, one or more risk categories, and one or more destinations.

17 . The server of claim 13 , wherein the executable instructions that, when executed, further cause the processor to:

generate a risk score for any of workloads and networks based on the one or more correlations.