Supplementing network flow analysis with endpoint information

1. A non-transitory, computer-readable medium having stored thereon instructions that are part of a cloud activity analysis agent, wherein the instructions are executable within a virtual machine in a cloud computing environment to perform operations comprising:

the cloud activity analysis agent creating information regarding computing activity within the virtual machine in the cloud computing environment, wherein the information includes one or more cryptographic hash values of processes executing within the virtual machine and generating network flows, and wherein the cloud computing environment provides access to data of an entity;

before transmitting one or more network flow data records corresponding to the network flows, the cloud activity analysis agent including, in the one or more network flow data records, cloud activity data based on the created information, wherein the one or more network flow data records are formatted in accordance with Internet Protocol Flow Information Export (IPFIX), and wherein the cloud activity data is included in an extended field of the one or more network flow data records; and

the cloud activity analysis agent transmitting the one or more network flow data records to a network device for flow analysis.

2. The computer-readable medium of claim 1 , wherein the transmitting includes transmitting the one or more network flow data records to a network flow analyzer that is configured to receive the cloud activity data and is further configured to receive network flow data from one or more flow collectors within a network of the entity; and

wherein the network flow analyzer is further configured to perform a security analysis for the entity based on the network flow data received from the one or more flow collectors and further based on the cloud activity data included in the one or more network flow data records transmitted by one or more endpoint computer systems.

3. The computer-readable medium of claim 1 , wherein the included cloud activity data includes one or more of the following types:

system compliance information, system and application patch levels, data encryption status, presence of indicators of compromise, user activity information, user identity information, user login information, process creation information, process termination information, information regarding foreground processes, process metadata, process hierarchy information, process network activity, process storage activity, process registry activity, process resource consumption information, endpoint computer system event information, and endpoint computer system fault information.

4. The computer-readable medium of claim 1 , wherein the virtual machine is operable to receive input to access the data of the entity from a user via an endpoint computer system, wherein the user has a network account with the entity.

5. The computer-readable medium of claim 1 , wherein the network device is within the cloud computing environment, and wherein the network device is configured to perform network flow analysis within a virtual machine.

6. The computer-readable medium of claim 1 , wherein the network device is within an on-premise network infrastructure of the entity.

7. The computer-readable medium of claim 1 , wherein the cloud computing environment is hosted by a cloud computing provider other than the entity.

8. The computer-readable medium of claim 1 , wherein the one or more network flow data records include flow data identifying a network address and a port associated with a particular set of network traffic, and wherein the cloud activity data included in the extended field identifies an application executing within the virtual machine and associated with the network traffic.

9. A system, comprising:

a plurality of server computer systems configured to provide a user cloud access to data of an entity via a virtual machine, wherein the server computer systems are hosted by a cloud provider other than the entity;

wherein the server computer systems are configured to execute a cloud activity analysis agent within the virtual machine, wherein the cloud activity analysis agent is executable to:

collect information regarding computing activity within the virtual machine, wherein the information includes one or more cryptographic hash values of processes generating network flows;

include, in one or more network flow data records associated with the network flows, cloud activity data based on the collected information, wherein the one or more network flow data records are formatted in accordance with Internet Protocol Flow Information Export (IPFIX), and wherein the cloud activity data is included in an extended field of the one or more network flow data records; and

transmit the one or more network flow data records from the virtual machine to a device for flow analysis.

10. The system of claim 9 , wherein the collected information includes an activity profile of current processes executing on the virtual machine.

11. The system of claim 9 , wherein the server computer systems are further configured to:

perform data reduction operations on the collected information such that an amount of data transmitted to the device is reduced.

12. The system of claim 11 , wherein the reduction includes summarizing the collected information based on a dynamic risk assessment made by the cloud activity analysis agent.

13. The system of claim 9 , wherein the collected information includes source and destination network addresses and port information for processes with active network connections.

14. The system of claim 9 , wherein the virtual machine is operable to receive input to access the data of the entity from a user via an endpoint computer system, wherein the user has a network account with the entity.

15. The system of claim 9 , wherein the one or more network flow data records include flow data identifying a network address and a port associated with a particular set of network traffic, and wherein the cloud activity data included in the extended field identifies an application executing within the virtual machine and associated with the network traffic.

16. The system of claim 9 , wherein the one or more network flow data records have an extensible format.

17. A method, comprising:

executing a cloud activity analysis agent within a virtual machine in a cloud computing environment to collect information regarding computing activity within the virtual machine in the cloud computing environment, wherein the information includes one or more cryptographic hash values for processes executing within the virtual machine and generating network flows, and wherein the cloud computing environment provides access to data of an entity;

the cloud activity analysis agent within a virtual machine including, in one or more network flow data records regarding the network flows, cloud activity data based on the collected information, wherein the one or more network flow data records are formatted in accordance with Internet Protocol Flow Information Export (IPFIX), and wherein the cloud activity data is included in an extended field of the one or more network flow data records; and

the cloud activity analysis agent transmitting the one or more network flow data records from the virtual machine to a device for flow analysis.

18. The method of claim 17 , wherein the information includes a listing of current processes executing on the virtual machine.

19. The method of claim 17 , wherein the cloud computing environment is hosted by a cloud computing provider other than the entity, wherein the transmitting uses network bandwidth of the cloud computing provider.

20. The method of claim 17 , wherein the device is within an on-premise infrastructure of the entity.