Activity monitoring of a cloud compute environment based on container orchestration data
Activity monitoring of a cloud compute environment based on container orchestration data may be performed by a data platform. For example, the data platform may obtain audit log data generated by a container orchestrator within a cloud compute environment, generate a data model based on the audit log data, and use the data model to monitor the activity for a security issue. The data model may be indicative of activity occurring with respect to one or more containerized applications executing within the cloud compute environment and the monitored activity may be activity with respect to the one or more containerized applications. Corresponding methods, systems, and products are also disclosed.
1. A method comprising:
obtaining, by a data platform, audit log data generated by a container orchestrator within a cloud compute environment, wherein the audit log data comprises at least creation, modification and destruction of container orchestrator resources;
generating, by the data platform, a data model based on the audit log data, the data model to track and maintain resource states of the cloud compute environment, the model indicative of activity occurring with respect to one or more containerized applications executing within the cloud compute environment; and
using, by the data platform, the data model to continuously monitor the activity for a security issue with respect to the one or more containerized applications.
2. The method of claim 1 , wherein:
the data model is implemented as a graph comprising a plurality of node points connected by a plurality of edges, each node point of the plurality of node points representing a logical entity and each edge of the plurality of edges representing a behavioral relationship between node points connected by the edge; and
the use of the data model to monitor for the security issue includes using the graph to monitor for an anomaly associated with the activity occurring with respect to the one or more containerized applications.
3. The method of claim 1 , further comprising:
obtaining, by the data platform from an agent deployed in the cloud compute environment, cloud data associated with the activity occurring with respect to the one or more containerized applications and distinct from the audit log data generated by the container orchestrator; and
performing, by the data platform, data enrichment in which at least one of: the audit log data is enriched based on the cloud data or the cloud data is enriched based on the audit log data; wherein the data model is based on the audit log data and the cloud data after the performing of the data enrichment.
4. The method of claim 1 , further comprising:
obtaining, by the data platform from an agent deployed in the cloud compute environment, cloud data associated with the activity occurring with respect to the one or more containerized applications and distinct from the audit log data generated by the container orchestrator; and
merging, by the data platform, the audit log data with the cloud data for one or more events represented by both the audit log data and the cloud data;
wherein the data model is based on the audit log data and the cloud data as merged for the one or more events.
5. The method of claim 1 , wherein:
the data model is implemented as a data repository incorporating the audit log data; and the use of the data model to monitor for the security issue includes applying a policy to a query result returned by a query of the data repository.
6. The method of claim 5 , wherein the policy is a custom policy configured for managing the one or more containerized applications within the cloud compute environment.
7. The method of claim 5 , further comprising obtaining, by the data platform, cloud data associated with the activity occurring with respect to the one or more containerized applications and distinct from the audit log data generated by the container orchestrator;
wherein the data repository further incorporates the cloud data, such that the query result returned by the query represents a result with respect to both the audit log data and the cloud data.
8. The method of claim 1 , wherein:
the container orchestrator within the cloud compute environment that generates the audit log data is a first container orchestrator within a first cloud compute environment associated with a first cloud service provider;
the method further comprises obtaining, by the data platform, additional audit log data generated by a second container orchestrator within a second cloud compute environment associated with a second cloud service provider, the second container orchestrator functionally related to the first container orchestrator and the second cloud compute environment and second cloud service provider distinct from the first cloud compute environment and first cloud service provider; and
the generating of the data model is further based on the additional audit log data.
9. The method of claim 8 , wherein the first and second cloud service providers are different commercial cloud service providers.
10. The method of claim 8 , wherein the first cloud service provider is a commercial cloud service provider and the second cloud service provider is a private cloud service provider.
11. The method of claim 1 , wherein the obtaining of the audit log data is performed by way of a data ingestion service that processes the audit log data as part of ingesting the audit log data.
12. The method of claim 11 , wherein the processing of the audit log data as part of the ingesting includes at least one of:
converting the audit log data to be compatible with additional audit log data generated by an additional container orchestrator functionally related to the container orchestrator;
scrubbing the audit log data to remove sensitive information; or
enriching the audit log data to add additional information related to the activity occurring with respect to the one or more containerized applications.
13. The method of claim 1 , wherein the container orchestrator is a Kubernetes orchestrator and the audit log data is Kubernetes audit log data.
14. The method of claim 1 , wherein:
the use of the data model to monitor the activity for the security issue results in a detection of at least one of an anomaly, a vulnerability, or a threat; and
the method further comprises providing, by the data platform and based on the detection, an alert indicative of the at least one of the anomaly, the vulnerability, or the threat.
15. A system comprising:
a memory storing instructions; and
one or more processors communicatively coupled to the memory and configured to execute the instructions to perform a process comprising:
obtaining, by a data platform, audit log data generated by a container orchestrator within a cloud compute environment, wherein the audit log data comprises at least creation, modification and destruction of container orchestrator resources;
generating, by the data platform, a data model based on the audit log data, the data model to track and maintain resource states of the cloud compute environment, the model indicative of activity occurring with respect to one or more containerized applications executing within the cloud compute environment; and
using, by the data platform, the data model to continuously monitor the activity for a security issue with respect to the one or more containerized applications.
16. The system of claim 15 , wherein:
the data model is implemented as a graph comprising a plurality of node points connected by a plurality of edges, each node point of the plurality of node points representing a logical entity and each edge of the plurality of edges representing a behavioral relationship between node points connected by the edge; and
the use of the data model to monitor for the security issue includes using the graph to monitor for an anomaly associated with the activity occurring with respect to the one or more containerized applications.
17. The system of claim 15 , wherein:
the data model is implemented as a data repository incorporating the audit log data; and
the use of the data model to monitor for the security issue includes applying a policy to a query result returned by a query of the data repository.
18. The system of claim 15 , wherein:
the container orchestrator within the cloud compute environment that generates the audit log data is a first container orchestrator within a first cloud compute environment associated with a first cloud service provider;
the process further comprises obtaining additional audit log data generated by a second container orchestrator within a second cloud compute environment associated with a second cloud service provider, the second container orchestrator functionally related to the first container orchestrator and the second cloud compute environment and second cloud service provider distinct from the first cloud compute environment and first cloud service provider; and
the generating of the data model is further based on the additional audit log data.
19. The system of claim 15 , wherein the container orchestrator is a Kubernetes orchestrator and the audit log data is Kubernetes audit log data.
20. A computer program product embodied in a non-transitory computer-readable storage medium and comprising computer instructions for performing a process comprising:
obtaining audit log data generated by a container orchestrator within a cloud compute environment, wherein the audit log data comprises at least creation, modification and destruction of container orchestrator resources;
generating a data model based on the audit log data, the data model to track and maintain resource states of the cloud compute environment, the model indicative of activity occurring with respect to one or more containerized applications executing within the cloud compute environment; and
using the data model to continuously monitor the activity for a security issue with respect to the one or more containerized applications.