Cloud data attack detection query builder

1. A computer-implemented method for analyzing security posture of a cloud environment, the method comprising:

generating a graphical user interface having configurable node elements and edge elements;

in response to user input on the graphical user interface, configuring the node elements to represent entities in a subject vulnerability signature in the cloud environment and the edge elements to represent relationships between the entities in the subject vulnerability signature;

generating a query representing the subject vulnerability signature;

executing the query to qualify a set of network paths in the cloud environment as conforming to the subject vulnerability signature, wherein executing the query comprises executing the query to qualify one or more compute resources or storage resources as vulnerable to breach attack based on classification data conforming to the subject vulnerability signature; and

outputting query results identifying the qualified set of network paths.

2. The computer-implemented method of claim 1 , wherein outputting query results comprises generating a representation of propagation of breach attack along the network paths.

3. The computer-implemented method of claim 1 , wherein the node elements comprise configurable variables that define a type of network path for the subject vulnerability signature.

4. The computer-implemented method of claim 1 , and further comprising a set of return data fields that define properties of the entities to return in response to the query.

5. The computer-implemented method of claim 4 , and further comprising:

a query preview display pane configured to display one or more of the set of return data fields or the generated query.

6. The computer-implemented method of claim 1 , wherein the entities comprise one or more of:

cloud accounts, compute resources, storage resources, and roles.

7. The computer-implemented method of claim 1 , wherein each given node display element includes a filter mechanism configured to receive user input defining a filter criterion relative to the entity represented by the given node display element.

8. The computer-implemented method of claim 1 , wherein the relationships comprise at least one of permissions data or access control data, and the edge elements comprise visual links between the node elements on the graphical user interface.

9. A computing system comprising:

at least one processor; and

memory storing instructions executable by the at least one processor, wherein the instructions, when executed, cause the computing system to:

generate a graphical user interface having configurable node elements and edge elements;

in response to user input on the graphical user interface, configure the node elements to represent entities in a subject vulnerability signature in the cloud environment and the edge elements to represent relationships between the entities in the subject vulnerability signature;

generate a query representing the subject vulnerability signature;

execute the query to

qualify a set of network paths in the cloud environment as conforming to the subject vulnerability signature, and

qualify one or more compute resources or storage resources as vulnerable to breach attack based on classification data conforming to the subject vulnerability signature; and

output query results identifying the qualified set of network paths.

10. The computing system of claim 9 , wherein the instructions, when executed, cause the computing system to generate a representation of propagation of breach attack along the network paths.

11. The computing system of claim 9 , wherein the node elements comprise configurable variables that define a type of network path for the subject vulnerability signature.

12. The computing system of claim 9 , wherein the instructions, when executed, cause the computing system to generate a set of return data fields that define properties of the entities to return in response to the query.

13. The computing system of claim 12 , wherein the instructions, when executed, cause the computing system to:

generate a query preview display pane configured to display one or more of the set of return data fields or the generated query.

14. The computing system of claim 11 , wherein

the entities comprise one or more of:

cloud accounts, compute resources, storage resources, or roles; and

the relationships comprising at least one of permissions data or access control data.

15. The computing system of claim 11 , wherein each given node display element includes a filter mechanism configured to receive user input defining a filter criterion relative to the entity represented by the given node display element.

16. A computing system comprising:

memory storing permissions data and access control data for pairs of compute resources and storage resources in a cloud environment;

accumulation logic configured to trace network paths between the compute resources and the storage resources based on the permissions data and the access control data;

graphical user interface generator logic configured to:

generate a graphical user interface having configurable node elements and edge elements; and

in response to user input on the graphical user interface, configure the node elements to represent entities in a subject vulnerability signature in the cloud environment and the edge elements to represent relationships between the entities in the subject vulnerability signature;

query generator logic configured to generate a query representing the subject vulnerability signature; and

query execution logic configured to:

execute the query to

qualify a set of network paths in the cloud environment as conforming to the subject vulnerability signature, and

qualify one or more compute resources or storage resources as vulnerable to breach attack based on classification data conforming to the subject vulnerability signature; and

output query results identifying the qualified set of network paths.